Canadian Luke's questions

I am trying to have Group Policy run a Logon script for a User OU. The script runs, but the part where it creates a Shell Object to run, it does not load during logon. If I double-click the script, it works as expected - the issue is during the logon.

Below is the contents of the script (sanitized):

Dim Response,URL,WshShell,
URL = "https://forms.office.com/Pages/ResponsePage.aspx?id=REDACTED"
Response = MsgBox("Have you completed your Daily Health Check survey today?", vbYesNo + vbQuestion + 4096,"Company Name Here")s
if Response = vbNo Then
    Set WshShell = CreateObject("WScript.shell")
    WshShell.run "CMD /C start """" /MAX /B ""C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"" " & URL, 0, False
End if

I am trying to use a Nagios NRPE plugin to communicate with my servers. I have a command definition in /etc/nagios/nrpe_local.cfg to use it:

command[check_service]=/usr/lib/nagios/plugins/check_service -s $ARG1$

When I manually run the command in my terminal, it succeeds:

# /usr/lib/nagios/plugins/check_service -s bind9
OK: Service bind9 is running!

When I try running it from my Nagios Server, it complains the command is not defined:

# /usr/lib/nagios/plugins/check_nrpe -H 10.32.10.3 -c check_service -a bind9
NRPE: Command 'check_service!bind9' not defined

Other check_nrpe commands work, so I don't think there is an issue in the server's commands.cfg, but here is the definition anyways:

define command {
    command_name        check_nrpe
    command_line        /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -t 30 -c $ARG1$
}

The check would look like this on the server:

define service {
    use                 local-service
    host_name           dc1,dc2
    service_description BIND Service
    check_command       check_nrpe!check_service!bind9
}

On the web interface, it returns CRITICAL: Service is not running!, which is not actually the case.

How can I get check_nrpe to allow the one extra argument? I have tried enabling dont_blame_nrpe, but that did not allow it to go either.

Edit - With debug turned on, and re-running the check, I get the following in my syslog:

Dec 19 09:01:56 dc1 nrpe[5586]: CONN_CHECK_PEER: checking if host is allowed: 10.32.10.12 port 33962
Dec 19 09:01:56 dc1 nrpe[5586]: Connection from 10.32.10.12 port 33962
Dec 19 09:01:56 dc1 nrpe[5586]: is_an_allowed_host (AF_INET): is host >10.32.10.12< an allowed host >10.32.10.12<
Dec 19 09:01:56 dc1 nrpe[5586]: is_an_allowed_host (AF_INET): is host >10.32.10.12< an allowed host >10.32.10.12<
Dec 19 09:01:56 dc1 nrpe[5586]: is_an_allowed_host (AF_INET): host is in allowed host list!
Dec 19 09:01:56 dc1 nrpe[5586]: Host address is in allowed_hosts
Dec 19 09:01:56 dc1 nrpe[5586]: Host 10.32.10.12 is asking for command 'check_service' to be run...
Dec 19 09:01:56 dc1 nrpe[5586]: Running command: /usr/lib/nagios/plugins/check_service -s
Dec 19 09:01:56 dc1 nrpe[5587]: WARNING: my_system() seteuid(0): Operation not permitted
Dec 19 09:01:56 dc1 nrpe[5586]: Command completed with return code 2 and output: CRITICAL: Service  is not running!
Dec 19 09:01:56 dc1 nrpe[5586]: Return Code: 2, Output: CRITICAL: Service  is not running!
Dec 19 09:01:56 dc1 nrpe[5586]: Connection from 10.32.10.12 closed.

I have verified that the Group in /etc/systemd/system/multi-user.target.wants/nagios-nrpe-server.service matches the nrpe_group parameter in /etc/nagios/nrpe.cfg. The same user exists in /etc/group and /etc/passwd.

I am looking for information one way or the other. Should users have Full Control over their Home folder in terms of permissions? Our environment is Samba AD-based, with Samba file servers. The user home folders are in \\example\Users\%USERNAME%, and currently allow the CREATOR OWNER to have Full Control.

The belief among some of the technical staff is that this is too much - it would enable a user to give control of their folder to another user. I see no issue with this, as it's their files, and they're responsible.

The current proposition is to change the ownership to the Domain Administrator, and add each user to their own folder with Read and Write permissions (obviously, done with scripts).

Which way is better? Is there any canonical advice one way or the other from Samba, Microsoft or any other authority on the matter?

I have ISC-DCHP-Server and BIND9 running on Debian Stretch. I am trying to setup Dynamic DNS for my client computers, but I'm struggling with the reverse zone.

Currently, when computers request an address with DHCP, an entry is created in the forward lookup zone correctly. Then, it attempts to add the reverse zone entry - which it does, but very incorrectly. For example, 234.1.168.192.168.192.in-addr.arpa.

In my BIND config, I have the following:

zone "168.192.in-addr.arpa" {
        type master;
        notify no;
        file "/etc/bind/zones/168.192.in-addr.arpa";
        allow-update { key rndc-key; };
};

In my zone file, I have the following:

$ORIGIN .
$TTL 604800     ; 1 week
168.192.in-addr.arpa    IN SOA  ns.example.com. root.example.com. (
                                24         ; serial
                                604800     ; refresh (1 week)
                                86400      ; retry (1 day)
                                2419200    ; expire (4 weeks)
                                604800     ; minimum (1 week)
                                )

It is creating the incorrect zones ($ORIGIN 0.168.192.168.192.in-addr.arpa. for example). I'm confident this is the issue, but cannot find where.

In my DHCPd Config:

ddns-domainname "example.com.";
ddns-rev-domainname "168.192.in-addr.arpa.";
ddns-update-style interim;
ignore client-updates;
update-static-leases on;
use-host-decl-names on;
option domain-name "example.com.";
include "/etc/dhcp/rndc.key";
update-optimization off;
update-conflict-detection off;
key rndc-key {
        algorithm hmac-md5;
        secret "0CZA8H3zL8GxplPmX2MGdQ==";
};
zone example.com. {
        primary 192.168.0.1;
        key rndc-key;
}
zone 168.192.in-addr.arpa. {
        primary 192.168.0.1;
        key rndc-key;
}

The subnet is a /23. I can run nslookup against hostnames; I cannot run it against IP addresses.

I have recently been testing out Cockpit with my various Debian servers, and I like it so far. One issue I have is that it creates the port 9090 that is open by default. I don't want that port opened to the world, but my bastion server is on a dynamic IP.

I noticed that I can install Cockpit on my remote servers, then run systemctl stop cockpit.socket and have it work... But not past disconnects from my main server.

What I would like to know is, what is the minimum configuration required to only allow Cockpit to connect to remote Debian servers that do not have Cockpit installed (preferred), or somehow limit Cockpit's web interface to not work on public-facing interfaces.

Using isc-dhcp-server on Debian Jessie, I'd like to block DHCP requests based on parts of their hostnames - specifically, if the hostname contains the RegEx string somewhere "iPhone|android-". My current solution is to wait until they have a lease, and monitor for those devices, and manually add the MAC address to the Blacklist file.

This black list method is getting quite large (almost 256 entries), and getting harder to maintain.

I understand how to check the beginning of the hostname to determine the class, but how do I check from any part of the hostname to determine which class to assign it?

I have two sets of Dell Laptops that I'm trying to install Windows 7 x64 on. I downloaded the driver packs from Dell's Enterprise site, and slipstreamed them into my install.wim file. On one notebook, it works perfectly fine, and I can enter Audit mode. On the other, I press Ctrl+Shift+F3, and am presented with a black screen with the mouse cursor. Nothing happens, I can't bring up any tools (i.e. Task Manager, UtilMan, etc). All I can do is restart.

I tried to kill the OOBE on the reboot, but then I was left without an account to use to log in. If I use the UtilMan-CMD hack, I can use the Administrator profile, but sysprep.exe will not load - It claims Windows Updates are requiring a reboot, and to try again. Even after rebooting, no change.

How can I get into Audit Mode on this second model? I have tried waiting over an hour to see if it will do its automatic reboot to enter Audit mode, but it never does.

So I had to unplug the Xen server's NIC. When I was done, I plugged it back in, and attempted to SSH into it. Fails. But my connections to the guests work perfectly fine. They're still up and running with the extra IP address.

The HOST is not! Dom0 has no network connection, as far as it's concerned.

The xenbr0 adapter has the correct address that it should, but it cannot ping anything on the local network. route shows the correct gateway address for the network (it's assigned via /etc/network/interfaces anyways). The guests have their regular IP addresses, and I can connect to them OK. Running ifup xenbr0 or ifup eth0 returns a message that it's already up. I don't want to take them down, if possible.

Other than restarting, what do you suppose the issue is, and how to fix? I just want to see if I can fix it without a reboot. Both Debian-based OSes.

I have received some Intel servers with redundant power supplies - Intel S1200v3RP. We have Debian installed on them.

Looking on Intel's site, we cannot find any downloads for Debian, but we see some for RedHat and SLES.

Is there a way to monitor the redundant power supplies to ensure we get an alert if one dies?

My workplace is getting new HP A5500 Series switches, and they include a console cable - a DB-9 Female to RJ-45 Male. I know we talked about them in college, but never actually seen one. I've heard of them being used in other enterprise-level networking equipment.

I'm wondering now, are all console cables (like above) pinned out the same? Can I use this cable on other HP equipment, or even other manufacturer's equipment? Or will it change depending on model or manufacturer?

I have a Debian Jessie server running Exim 4, with GMail setup as the Smarthost. If I try to send mail with an external address (i.e. [email protected]), it works fine. If I send mail to root or canadianluke (local usernames), I get two messages: the message I sent, and an email that GMail automatically generates, saying that it can't deliver mail to root@empty. We are using Google Apps for Non-Profits.

The email comes through, so I know that it's not fully Exim4, but I'm not entirely convinced that it's entirely GMail.

The command I'm using to send emails on my terminal: mail root -s Test

Delivery to the following recipient failed permanently:

     root@empty

Technical details of permanent failure:
DNS Error: Address resolution of empty. failed: Domain name not found

----- Original message -----

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=MYDOMAIN_COM.20150623.gappssmtp.com; s=20150623;
        h=from:to:subject:message-id:date;
        bh=YJWMysPl36audKpPjWIG/TOl/JVGuKuq1l4/HEAjxb8=;
        b=eIIQpLxw5TFAwnKw4P3gQpKlKbnf9I1PRpzfElBK4m+g+8cu/3z3hBFxMIMdV2Heli
         5CDCvVpaxbiqBJBcyeNnJubwyb8pir2CEnkiKaLJVJjTK3fZkpiI0KlTWkjilMnZeTLy
         SSzJdu437Bo2ONDY960+SX4cZtUE2p2fMcY7zhm8OTPWvXuDJ+DMoLVMuMfBfR+000dL
         ksNXGUD9teGOxYBV5a4c5/SPyeHXY++Pr8AOY+4lU9nt3OIocaozwMGfJOiV0MiiC4MZ
         w1UaXPjygFkzywsgjRbGyh483J0r4pS522fTUvz0qzAtMoIWmNOTCzAIulxxSQXb+hlp
         HG8Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=x-gm-message-state:from:to:subject:message-id:date;
        bh=YJWMysPl36audKpPjWIG/TOl/JVGuKuq1l4/HEAjxb8=;
        b=gBolH/1kEUPQVIVrhMhtsOHaBHc9CIbEfqtAru5aJKSgoCst11qOUFQHC+tPrjVuhH
         s1JvVw7w6f05543JED9ak2SaQ5o5Iz6oWAkS3Z72MBwBaFlM144d/e4N64OYUG0Df4aR
         UDo/ryRdFOZ1WInOrTaoF9BWI/glLCtUPoadpqJ1utk74qEuZE4Ff3as/GjKAE5LXM3O
         Me27QYddAMMCdHi2DPtmkiM/3TosQjdaGv1QbGjk/ZS/q1HqdXCbZhjj65PwIiGDRxdk
         kw49ybPDjyoIFR5IzHM/vI7P3lC6LkXZq4zEgitBGuafwB52Luvl1jCTxUXZbLiODXko
         yDxQ==
X-Gm-Message-State: ALoCoQn4f0bfvp6Tk6pmiVZgxHs/bn8OVKale7+375O8j9UzvWgsYVSltXGIbvQQk5Fxi3DKGh5o
X-Received: by 10.140.94.116 with SMTP id f107mr417247qge.0.1447108430809;
        Mon, 09 Nov 2015 14:33:50 -0800 (PST)
Return-Path: <[email protected]>
Received: from example.com ([93.184.216.34])
        by smtp.gmail.com with ESMTPSA id 83sm102514qhw.27.2015.11.09.14.33.50
        for <root@empty>
        (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
        Mon, 09 Nov 2015 14:33:50 -0800 (PST)
From: root <[email protected]>
X-Google-Original-From: root <root@empty>
Received: from root by example.com with local (Exim 4.84)
        (envelope-from <root@empty>)
        id 1Zvv0W-0006Lj-Tf
        for root@empty; Mon, 09 Nov 2015 17:33:48 -0500
To: root@empty
Subject: Sup
Message-Id: <[email protected]>
Date: Mon, 09 Nov 2015 17:33:48 -0500

Update. I got it to send mail again, but it's giving a new error. I added my username into /etc/aliases for where to send mail as root, and /etc/email-addresses is set to send mail destined for me to my regular email account ([email protected]).

# more exim4/update-exim4.conf.conf
dc_eximconfig_configtype='smarthost'
dc_other_hostnames=''
dc_local_interfaces='127.0.0.1'
dc_readhost='ex.com'
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets=''
dc_smarthost='smtp.gmail.com::587'
CFILEMODE='644'
dc_use_split_config='true'
dc_hide_mailname='true'
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'

Now, the email is showing as an error from [email protected], still the same DNS error: Address resolution of server.example.com failed: Domain name not found in Google Apps.

Below is a tail of my /var/log/exim4/mainlog, showing mail is in fact leaving the server:

2015-11-12 07:01:01 1ZwqYn-0001oN-2H <= [email protected] U=root P=local S=2598
2015-11-12 07:01:01 1ZwqYn-0001oN-2H gmail-smtp-msa.l.google.com [2607:f8b0:400c:c06::6d] Network is unreachable
2015-11-12 07:01:02 1ZwqYn-0001oN-2H => [email protected] R=smarthost T=remote_smtp_smarthost H=gmail-smtp-msa.l.google.com [74.125.141.108] X=TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128 DN="C=US,ST=California,L=Mountain View,O=Google Inc,CN=smtp.gmail.com" A=plain C="250 2.0.0 OK 1447329663 h144sm1989632vke.26 - gsmtp"
2015-11-12 07:01:02 1ZwqYn-0001oN-2H Completed

My /etc/aliases file:

# /etc/aliases
mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
noc: root
security: root
root: canadianluke
canadianluke: [email protected]

I have tried to read many documents on running a VoIP system behind a NAT'd router, going out to the Internet, then back through a dedicated connection for the VoIP server. I am not getting anywhere with my research.

I inherited a setup where all the VoIP server equipment is on its own network, with a dedicated ADSL connection. Phones from anywhere on the Internet work! My problem is, from inside my network.

I have tried the usual troubleshooting steps: rebooting the router, disabling the firewall, changing the ports I plug the IP Phones into, but none of this is working.

We use Linux servers as our routers, and iptables as our firewall. The default policies are to DROP packets that do not match, but the issue persists even when I tell them to ACCEPT. Running a tcpdump -ni eth1 host 192.168.0.89 outputs the following as the phone is trying to connect:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
13:45:24.487637 ARP, Request who-has 192.168.0.89 tell 192.168.0.89, length 46
13:45:33.285767 ARP, Request who-has 192.168.0.89 tell 192.168.0.89, length 46
13:45:43.333432 ARP, Request who-has 192.168.0.89 tell 0.0.0.0, length 46
13:45:49.331224 ARP, Reply 192.168.0.89 is-at 00:15:b7:48:04:cd, length 46
13:45:49.337216 ARP, Request who-has 192.168.0.89 tell 192.168.0.89, length 46
13:45:49.341575 ARP, Request who-has 192.168.0.89 tell 192.168.0.89, length 46
13:45:49.444252 ARP, Request who-has 192.168.0.89 tell 192.168.0.89, length 46
13:45:49.612308 ARP, Request who-has 192.168.0.3 tell 192.168.0.89, length 46
13:45:49.612319 ARP, Reply 192.168.0.3 is-at 00:22:b0:70:9a:eb, length 28
13:45:49.613504 IP 192.168.0.89.50138 > xxx.xxx.xxx.xxx.1719: UDP, length 125
13:45:49.631597 IP xxx.xxx.xxx.xxx > 192.168.0.89: ICMP host 216.57.190.87 unreachable - admin prohibited filter, length 36

The xxx.xxx.xxx.xxx is the VoIP Server's public IP address (different ISP from our main network). If I skip my server and plug a phone directly into our Internet connection (we have a /24 subnet), it connects very quickly. If it's behind any of our servers, it will stop at that part of the handshake. I have tried on different gateways, same effect.

From inside my network, I can RDP into the management system, ping the server, etc. I just cannot get my phones to connect. When I dump my iptables out, so everything is set to ACCEPT, it still does not connect.

Where can I look next to get these phones working? They used to work, but they do not anymore; going back to that old configuration is not possible, as the backups are only around for 3 months.

I am playing around with different hypervisors, and I'm on to Proxmox VE. I setup an old server to test it out on, and installed Windows 7 as my first VM, using virtio drivers for everything - networking, disk controller, etc. I followed the recommendations from this page on the Proxmox Wiki, and downloaded the latest ISO using wget from https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso.

I then tried to let Windows automatically search the CD for the drivers, and everything is installed. My issue is that the Network Adapter is showing a Code 10, cannot start, shown below:

This is running on Debian Wheezy (the version the Proxmox ISO had included), with a Windows 7 x86 guest. I have even tried shutting down the VM, and changing the MAC address, but no change. I have also tried disabling the TCP/UDP Checksum Offload options as suggested in this answer to a similar issue. I have also tried uninstalling and reinstalling the drivers repeatedly, restarting in between. Settings below:

Our company uses AVG 2013 Business Edition in a Windows environment, all Windows 7 Pro. At one of the off-site locations, there is only a Linux server available, and it's on its own network (the site, not the server).

At most of my other sites, I have a Windows workstation setup that is always on, and I have the AVG Admin Console installed for being the updates and program Proxy server for AVG. At the site I need help with, I am having issues with updates.

If I try updating through the AVG program on the users' computers, it always fails (cannot access the AVG site). I can browse the Internet just fine, and download the 105MB .bin updates manually. I can then manually install the .BIN update on each computer, but it requires my intervention on each system for an update.

I cannot select an update on a network drive, AVG seems to require it on a local hard drive. I am thinking of saving one copy to the server, then using the login script to copy the file to the client's local hard drive, then I'd like to run a command to install the update. My question is, how can I run the update via a command or batch file, without user intervention?

NOTE: The servers at each site is Debian, not Windows. My organization does not want to spend money on another tech machine, as this site has only 3 clients. It is far out of my way though, so I'd prefer to SSH to the server, download the file to a shared folder, and know that Windows is automatically installing updates.

I am running a DHCP server on Debian Wheezy, with isc-dhcp-server. Because people were connecting unauthorized machines, my DHCP leases were running thin, and eventually, authorized machines could not connect to our network. So, I asked about blocking certain MAC addresses from even picking up an address via DHCP, and that helped.

I decided that I want to sort out the IP addresses here. We have 5 servers, 8 access points, 12 managed switches, between 20 and 30 printers, plus all the authorized clients. My goal is to leave the servers at their IPs (between .0.1 and .0.5, inclusively), then put the printers in the next range, then the other network equipment, leaving a subnet just for these static reservations.

I would like to then separate the IPs of different departments, based on their names. I have a subnet for one pool, just as a test, set up to go to 192.168.6.x, which is still inside the original subnet (192.168.0.0/19). I put the following into my /etc/dhcp/dhcpd.conf file:

class "dlc" {
        match if substring (option host-name,0,3) = "dlc";
}
class "DLC" {
        match if substring (option host-name,0,3) = "DLC";
}

subnet 192.168.0.0 netmask 255.255.224.0 {
pool {
        deny members of "blacklist";
        allow members of "dlc";
        allow members of "DLC";
        range 192.168.6.1 192.168.6.50;
        // Other options not important
    }

The blacklist class relates to the previous question, blocking based on MACs. The machines in this test group all start with either DLC or dlc. I have one machine that is able to get an address into this range. I also changed the Lease Times to a much lower value than before:

default-lease-time 7200;
#default-lease-time 28800;
#max-lease-time 36000;
max-lease-time 14400;

My general pool is listed after this pool, which allows all clients, except those in the blacklist group. All within the same subnet range of 192.168.0.0/19. Eventually, every department will have its own group.

So, I looked for ways of expiring leases. I tried this answer of stopping the DHCP server, blowing away the leases file, then restarting it, but the machines are still claiming the same addresses. I do not mind if I need to go to the machines to run a script, as I can push programs or scripts out to client machines quite easily. All clients are either Windows 7 or 8.1.

What can I do to force machines that otherwise have a valid IP address to get a new one in my specific range? This is more for my own organization of the network, and to more easily recognize when rogue devices get connected.

At my workplace, we have a Public Wifi network, as well as our Private Wifi network. The Private side has access to see other computers, the printers, servers, and access to the Internet. On the Public side, the users need to authenticate with a captive portal with a username/password combo from our server (for our staff's personal devices only).

The key has been leaked long before I came to this job, and I have most things cleaned up. I have scripts (written by other team members, not myself!) that go through the DHCP leases on Debian Wheezy, and spit out the manufacturer, the DNS name, IP Address, and the MAC address of all the devices the DHCP server interacts with. With these scripts, I can create a blacklist of MAC addresses and iptables blocks them for me. I update /etc/blacklist.txt, and when iptables starts, it executes iptables -A INPUT $if -m mac --mac-source $i -j DROP (with $i being read from the file).

This will prevent their device from connecting to our network resources, and to the Internet. Unfortunately, it does not take effect until after the device has gotten an IP address from isc-dhcp-server. So, my issue is, how can I prevent them from even getting an IP address assigned to them? Yes, I know they could just assign themselves a static IP address and bypass the DHCP server, but I still want iptables to block them, based on their (hopefully non-changing) MAC address. Yes, I know I could increase the range on my DHCP server, but I want management to realize the struggle with managing the privately-owned devices taking up our work resources by connecting and bypassing our captive portal.

One solution (well, partial) that someone thought up was to create a blackhole class in my /etc/dhcp/dhcpd.conf file, and fill it with the MAC addresses of the devices I don't want connecting. This would work, but requires updating the MAC addresses in multiple places, which I don't want. I want to be able to update the MACs in one file, and then possibly run a script that will add the changes to my DHCP file, and my iptables rules.

Debian Squeeze, with Apache2 installed and running.

{"installed":"true","version":"5.0.25","versionstring":"5.0.13","edition":""}
http://servername.com/owncloud/status.php

My owncloud/config/config.php file:

<?php
$CONFIG = array (
  'instanceid' => '<gibberish>',
  'passwordsalt' => '<gibberish>',
  'datadirectory' => '/var/www/owncloud/data',
  'dbtype' => 'sqlite3',
  'version' => '5.0.25',
  'installed' => true,
);

"user_backends" => array (
        0 => array (
                "class"         => "OC_User_SMB",
                "arguments"     => array (
                        0 => 'localhost'
                        ),
                ),
        );

When I try accessing the main page (http://server.com/owncloud) or any of the .PHP files under it, I just get a blank page returned. If I comment out the last section for userbackends, it loads with the one user I've created. My goal is to have it authenticate against the SMB server that's running on the same system, as per ownCloud's Documentation. How can I get ownCloud to authenticate against the Samba server running on the same box?

On a server running Debian Wheezy and Samba ver 3 with a tdb backend, how do I restrict a single user from changing the password? This account is one of 2 generic accounts, one for students and one for Teachers on Call (TOC). The users are created, but I'm not deploying the server yet. When looking through Google, I came across setting the maximum password age, but not setting the minumum password age (I'd be happy with a 5 year password...)

My server is Debian-based, running Samba as the Primary Domain Controller. I have verified the permissions on the netlogon share (drwxrwsr-x) and the login.bat (-rwxrwxr-x) file, to allow all users Read and Execute permissions. On some of the systems, the script simply does not run; no drives mapped, no Program Update checks, etc. However, I can manually navigate to \\server\netlogon\login.bat, run the file, and all the drive mappings appear!

I wish I could see a pattern, but it seems to only happen to a few PCs, then it happens to different PCs, and is never constant. All the PCs are Windows 7 Pro, and the users logging in are regular users, no Administrators (other then myself) log in to them for day-to-day use. In the Group Policy Editor, the Computer Configuration\Administrative Templates\System\Logon\Always wait for the network at computer startup and logon parameter is set to Enabled.

I cannot think of any recent changes that may have occurred in the vicinity of these computers, and they always have Internet access, and can manually connect to the server. What else can I look for? Below is the result of testparm -s:

[global]
        workgroup = DOMAIN
        netbios name = SERVER
        server string = server
        interfaces = eth1
        bind interfaces only = Yes
        pam password change = Yes
        passwd program = /usr/bin/passwd %u
        passwd chat = *new*password* %n\n *new*password* %n\n *updated*
        unix password sync = Yes
        log level = 1
        name resolve order = host wins lmhosts bcast
        printcap name = /dev/null
        disable spoolss = Yes
        logon script = login.bat
        logon path = \\server\netlogon
        preferred master = yes
        logon drive = h:
        domain logons = Yes
        os level = 255
        domain master = Yes
        wins support = Yes
        path = /var/spool/lpd/samba
        admin users = machine
        write list = @domainadmins
        printing = lprng
        print command = lpr -r -P'%p' %s
        lpq command = lpq -P'%p'
        lprm command = lprm -P'%p' %j
        lppause command = lpc hold '%p' %j
        lpresume command = lpc release '%p' %j
        queuepause command = lpc stop '%p'
        queueresume command = lpc start '%p'

[netlogon]
        path = /usr/local/share/netlogon

UPDATE - I had to restart the Samba daemon on the server. Some computers that were working fine are now showing issues, and ones that were showing issues seem fine. Is this helpful in narrowing down the issue?

I am having issues on a network I inherited with a Samba 3 server acting as the domain controller, and many, but not all, Windows 7 Pro PCs. The issues described here and here do not solve my issue.

On boot up, on some PCs, I get an error message saying The trust relationship between this workstation and the domain controller has failed. My Google searches explain to remove/re-add the machine from the domain, and this requires manual intervention, and sometimes doesn't work. What I have been doing, since this is intermittent, even with systems that are currently logging in OK, is to run the following command from an Elevated Command Prompt on each PC: echo 192.168.0.3 smb > c:\windows\system32\drivers\etc\lmhosts. I then reboot, and the error stays away then.

The weird thing is that once in a while, it just assumes my server is at a different IP address. The computers sometimes think that the SMB server is 192.168.0.1 instead of 192.168.0.3. I can verify this, because when I do net use \\smb, I get a Network name not found, but I can ping it and get the right address. When I do a new view \\smb, it would go to the old server (which is now 192.168.0.1, never had this name though). Doing a net view \\192.168.0.3 would show the correct server, then let me login to Windows just the one time, until reboot.

My issue is that I need to figure out why this is happening, so I do not need to touch every PC. It's a fast fix, once everything loads, but is not ideal. Below is the output of my testparm command on the Primary Domain Controller:

Load smb config files from /etc/samba/smb.conf
rlimit_max: rlimit_max (1024) below minimum Windows limit (16384)
Processing section "[netlogon]"
Processing section "[homes]"
Processing section "[Programs]"
Processing section "[Login]"
Processing section "[Windsor]"
Processing section "[Office]"
Processing section "[Admin]"
Processing section "[Student_Share]"
Processing section "[Tech_Tips]"
Processing section "[Tech_Apps]"
Processing section "[DropBox]"
Processing section "[SSS]"
Processing section "[JMC]"
Processing section "[DRC]"
Processing section "[FASD]"
Processing section "[CLA]"
Processing section "[YAPS]"
Processing section "[IMAGES]"
Processing section "[Printer_Drivers]"
Processing section "[Self_Serve]"
Loaded services file OK.
WARNING: You have some share names that are longer than 12 characters.
These may not be accessible to some older clients.
(Eg. Windows9x, WindowsMe, and smbclient prior to Samba 3.0.)
Server role: ROLE_DOMAIN_PDC

All of the shares are OK. The time on each workstation is matched up with the domain controller (NET TIME \\SMB /SET /Y in the startup script), and I can log in as the Local Administrator only. What can I look for on my Samba server to not require this weird workaround?