OS X Server 10.4.11 - OS X Server 10.5.5 - PDC - No Windows login

Question

Hey there,
we just upgraded a 10.4.11 Server to 10.5.5. Some little issues occured afterwards which we were possible to solve but one big problem remained.
Before upgrading the server, Windows XP Clients and a Windows 2003 Server could use our OD user accounts for a domain login.
Now the clients prompt that there is no domaincontroller available or the machine account couldn't be found.
Rejoining the domain works but doesn't solve the problem. The message keeps the same.
The OS X Server is PDC and OD Master.
Some relevant informations:
/etc/smb.conf:
xserve:Users sadmin$ more /etc/smb.conf
; Configuration file for the Samba software suite.
; ============================================================================
; For the format of this file and comprehensive descriptions of all the
; configuration option, please refer to the man page for smb.conf(5).
; The following configuration should suit most systems for basic usage and
; initial testing. It gives all clients access to their home directories and
; allows access to all printers specified in /etc/printcap.
; BEGIN required configuration
; Parameters inside the required configuration block should not be altered.
; They may be changed at any time by upgrades or other automated processes.
; Site-specific customizations will only be preserved if they are done
; outside this block. If you choose to make customizations, it is your
; own responsibility to verify that they work correctly with the supported
; configuration tools.
[global]
debug pid = yes
log level = 1
server string = Mac OS X
printcap name = cups
printing = cups
encrypt passwords = yes
use spnego = yes
passdb backend = odsam
idmap domains = default
idmap config default: default = yes
idmap config default: backend = odsam
idmap alloc backend = odsam
idmap negative cache time = 5
map to guest = Bad User
guest account = nobody
unix charset = UTF-8-MAC
display charset = UTF-8-MAC
dos charset = 437
vfs objects = darwinacl,darwin_streams
; Don't become a master browser unless absolutely necessary.
os level = 2
domain master = no
; For performance reasons, set the transmit buffer size
; to the maximum and enable sendfile support.
max xmit = 131072
use sendfile = yes
; The darwin_streams module gives us named streams support.
stream support = yes
ea support = yes
; Enable locking coherency with AFP.
darwin_streams:brlm = yes
; Core files are invariably disabled system-wide, but attempting to
; dump core will trigger a crash report, so we still want to try.
enable core files = yes
; Configure usershares for use by the synchronize-shares tool.
usershare max shares = 1000
usershare path = /var/samba/shares
usershare owner only = no
usershare allow guests = yes
usershare allow full config = yes
; Filter inaccessible shares from the browse list.
com.apple:filter shares by access = yes
; Check in with PAM to enforce SACL access policy.
obey pam restrictions = yes
; Don't be trying to enforce ACLs in userspace.
acl check permissions = no
; Make sure that we resolve unqualified names as NetBIOS before DNS.
name resolve order = lmhosts wins bcast host
; Pull in system-wide preference settings. These are managed by
; synchronize-preferences tool.
include = /var/db/smb.conf
[printers]
comment = All Printers
path = /tmp
printable = yes
guest ok = no
create mode = 0700
writeable = no
browseable = no
; Site-specific parameters can be added below this comment.
; END required configuration.
/var/db/smb.conf:
xserve:Users sadmin$ more /var/db/smb.conf
# Configuration options for smbd(8), nmbd(8) and winbindd(8).
# This file is automatically generated, DO NOT EDIT!
# Defaults signature: 0cff3e2e008004ba46f9cd36000048ff36880000
# Preferences signature: e0080ddc1594905ae70000000000574
# Configuration rules: $Id: rules.cpp 32909 2007-08-17 23:07:40Z jpeach $
# Server role: PrimaryDomainController
# Guest access: never
# NetBIOS browsing: domain master browser
# Services required: org.samba.smbd org.samba.nmbd
[global]
security = USER
add machine script = /usr/bin/opendirectorypdbconfig -c createcomputer
account -r %u -n /LDAPv3/127.0.0.1
add user script = /usr/bin/opendirectorypdbconfig -c createuseraccount
-r %u -n /LDAPv3/127.0.0.1
domain logons = yes
logon drive = H:
logon path = \\%N\profiles\%u
auth methods = odsam
netbios name = xserve
workgroup = OUR-WINDOWS-DOMAIN
dos charset = 437
server string = xserve
ntlm auth = yes
lanman auth = yes
max smbd processes = 40
log level = 1
map to guest = Never
wins server = 192.168.1.1
domain master = yes
preferred master = yes
os level = 65
enable disk services = yes
enable print services = yes
wins support = no
[netlogon]
path = /etc/netlogon
browseable = no
write list = @admin
oplocks = yes
strict locking = no
[profiles]
path = /Users/Profiles
browseable = no
read only = no
oplocks = yes
strict locking = no
[homes]
root preexec = /usr/sbin/inituser %U
comment = User Home Directories
browseable = no
read only = no
create mode = 0750
guest ok = no
com.apple: show admin all volumes = no
[global]
Error messages in the smb log:
[2008/10/23 13:21:18, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbodsam.c:odssamgetsampwnam(1571)
opendirectorysamsearchname gave -14136 [eDSRecordNotFound]: no >dsRecTypeStandard:Computers record for account 'LAZ-IMAC-20-ZOL$'
[2008/10/23 13:21:18, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbodsam.c:odssamgetgrnam(2040)
odssam_getgrnam gave -14136 [eDSRecordNotFound]: no dsRecTypeStandard:Groups >record for 'LAZ-IMAC-20-ZOL$'!
[2008/10/23 13:21:18, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbodsam.c:odssamgetsampwnam(1571)
opendirectorysamsearchname gave -14136 [eDSRecordNotFound]: no >dsRecTypeStandard:Computers record for account 'LAZ-IMAC-20-ZOL$'
kDSStdAuthNewUser was successful for account "laz-imac-20-zol$"
kDSStdAuthNewUser accountid len(392)"0x49005e2f415db9d900000ece00000600,1024 >35 >131244790597481883925064106712462407867419357228339572195109892970463819598600 08944504249596590147264020481450929886533055945735978363855606054033179354725683 16502940822933278295061864335023431267611975840263121713521174193910961618397774 36761029605188471296273168837776820246633980403453223607235696076277111 >[email protected]"
<CFArray 0x129cd0 [0xa06fb174]>{type = mutable-small, count = 1, values = (
0 : <CFDictionary 0x113180 [0xa06fb174]>{type = mutable, count = 3, >capacity = 3, pairs = (
0 : <CFString 0x129800 [0xa06fb174]>{contents = >"dsAttrTypeStandard:RecordName"} = <CFArray 0x129710 [0xa06fb174]>{type = >mutable-small, count = 1, values = (
0 : <CFString 0x128140 [0xa06fb174]>{contents = "passwordserver"}
1 : <CFString 0x12ca80 [0xa06fb174]>{contents = >"dsAttrTypeStandard:PasswordServerLocation"} = <CFArray 0x129100 >[0xa06fb174]>{type = mutable-small, count = 1, values = (
0 : <CFString 0x129f50 [0xa06fb174]>{contents = "192.168.64.55"}
3 : <CFString 0x10ca00 [0xa06fb174]>{contents = >"dsAttrTypeStandard:AppleMetaNodeLocation"} = <CFArray 0x12a450 >[0xa06fb174]>{type = mutable-small, count = 1, values = (
0 : <CFString 0x12b140 [0xa06fb174]>{contents = "/LDAPv3/127.0.0.1"}
[2008/10/23 13:21:19, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbget_set.c:pdb_get_groupsid(211)
pdbget_groupsid: Failed to find Unix account for laz-imac-20-zol$
[2008/10/23 13:21:19, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbget_set.c:pdb_get_groupsid(211)
pdbget_groupsid: Failed to find Unix account for laz-imac-20-zol$
testparm /etc/smb.conf
Load smb config files from /etc/smb.conf
Processing section "[netlogon]"
Processing section "[profiles]"
Processing section "[homes]"
Processing section "[printers]"
Loaded services file OK.
Server role: ROLEDOMAINPDC
testparm /var/db/smb.conf
Load smb config files from /var/db/smb.conf
Processing section "[netlogon]"
Processing section "[profiles]"
Processing section "[homes]"
Loaded services file OK.
Server role: ROLEDOMAINPDC
Is it possible to try the following?
/usr/bin/opendirectorypdbconfig -c createuseraccount -r %u -n /LDAPv3/127.0.0.1
create user account(%u)
no credentials available
opendirectorypdbconfig error(-14200)
Or that?
/usr/bin/opendirectorypdbconfig -c createcomputeraccount -r %u -n /LDAPv3/127.0.0.1
create computer account(%u)
no credentials available
opendirectorypdbconfig error(-14200)
Or must that lead into those error messages?
Error message in the nmbd log:
[2008/10/29 10:20:03, 0, pid=74896] /SourceCache/samba/samba-187.8/samba/source >/libsmb/nmblib.c:send_udp(791)
Packet send failed to 169.254.255.255(138) ERRNO=Host is down
[2008/10/29 10:20:05, 0, pid=74896] /SourceCache/samba/samba-187.8/samba/source >/libsmb/nmblib.c:send_udp(791)
Packet send failed to 169.254.255.255(138) ERRNO=Host is down
It would be awesome if some of you guys could help us back into the communication between OS X Server and Windows!
Thanks a lot!

Answer 1

I had some issues when I initially setup Windows Services on our 10.4 server.
Some things that may help:
1) Check the WINS server box in Server Admin. Make sure your Windows clients have the IP address on your WINS server in their TCP/IP configuration
2) Reset your SID on the server. More info @ http://www.radiotope.com/node/61
2) If the diradmin password has changed, you will have to demote the PDC and recreate it to get the link between OD and samba working again, unless Apple fixed that in Leopard. Of course, you'll have to add all your machines back to the domain after this.
I'm looking at a problem now where just one machine cannot download a roaming profile after I had to restore OD from archive. I'm thinking it is a problem with the SID, bit so far, no love...
-Jon
Jon Auman
Systems Administrator
National Evolutionary Synthesis Center
Duke University
http:www.nescent.org
------------------------------------------------------