Windows xp подождите создается список доменов

• Remove From My Forums

All replies

• «Is windows XP still supported to join the domain«

  No.  Windows XP is out of support.  No testing for compatibility/usability with 2019 has been performed by Microsoft because Windows XP is not supported.  As intimated by Clement, you might be able to get it to join by downgrading the domain,
  but that does not change the fact that it is still unsupported, even when the domain is at a lower level.  Not only does lower the settings in the domain lower the overall security of the domain, just having a Windows XP system in your environment lowers
  the overall security of your environment.

  ---

  tim

• Windows XP is generally unsupported — you might be able to arrange a custom support contract with Microsoft, but keep in mind that this is an expensive proposition and includes only support for security updates.

  hth
  Marcin

• It is not supported. You may be able to make it work but you should not be surprised if future updates will break it again.

  ---

• Hello,
  We can try the following common ways to troubleshoot the issue:

  1. Check if we can ping domain or domain controller.

  2. Check whether the Windows XP points to the correct DNS server.

  3. Check whether all the Windows XP clients can not be added to the same domain.

  4. Check whether we use correct domain administrator credentials when we join Windows XP to domain.

  5. Check if we try to create the Windows XP computer name in the domain first, then if we can add it to domain.

  If all the above is OK and all the Windows XP clients can not be added to the domain. I am sorry, please understand because Windows XP is out of support. We don’t have such an environment to test. It may have potential and incompatible
  problems. It is recommended that we use the new version of Windows client.

  Thank you for your understanding and support.

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

  • Edited by

    Tuesday, February 12, 2019 2:49 AM

  • Proposed as answer by
    Daisy ZhouMicrosoft contingent staff
    Thursday, February 28, 2019 2:30 AM

• Hi,
  If this question has any update or is this issue solved? Also, for the question, is there any other assistance we could provide?

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

• Hi Daisy Zhou,

  Please see the comments below:

  1. Check if we can ping domain or domain controller.
   — Yes….

  2. Check whether the Windows XP points to the correct DNS server.
   — Yes, it’s correct..

  3. Check whether all the Windows XP clients can not be added to the same domain.
   — Unfortunately, all windows XP clients are failed to join to the domain.

  4. Check whether we use correct domain administrator credentials when we join Windows XP to domain.
   — The domain admin credentials are correct.

  5. Check if we try to create the Windows XP computer name in the domain first, then if we can add it to domain.

   — Thanks for the suggestion. However, this method is not work either. But surprisingly that, I found the computers membership is
  been disabled when I join the win p client to the domain. It’s strange!

  Btw, thanks all for your feedback, suggestion and answer, appreciate it. Anyway, i think i need to find a plan for the win XP client.

  Thanks.

  Scriven Tan.

• Hi,
  You are welcome!

  Thanks for your understanding and time. Have a nice day!

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

• Hello

  I have the same problem and same error.

  According to my investigation , it seems that Windows 2019 AD controller supplies kerberos ticket to the Windows XP client  with AES encryption despite the fact that Windows XP asks and supports RC4 encryption only.

  The RC4 encryption support is enabled in policies for DC but it still doesn’t work and DC ignores this setting when 2016 and 2012 r2 and even 2008 r2 works correctly.

  I think that MS got decision to block RC4 support but no documentation about that was found. I hope that this is a bug and it will fixed whenever because this also affects other RC4 kerberos clients as various old Linux implementations being joined to AD
  domain.

• I seriously doubt that Microsoft enforcing a higher level of security in a domain would be considered a ‘bug’ by Microsoft.  They did the same thing many years ago when they stopped supporting NT4 security in a domain out of the box.  They did
  provide a way to ‘downgrade’ the environment to allow the NT4 security.  I would hazard a guess (I have not tried it) that if you downgraded your domain to something prior to 2019 functional level, you could get by the outdated security.  But you
  are sacrificing security in order to include operating systems that most likely do not have support anymore.  The OP was asking about Windows XP.  That is definitely not supported.  So downgrading security level to add an unsupported and security
  vulnerable operating system to the environment seems counter-intuitive.

  ---

  tim

• Hi

  Personally, I have no problem with nonsupporting of old protocols by default.  Moreover , DES and RC4 in Kerberos are not supported by default even in Win2008 R2 unless a administrator defines their supporting in policies.

  So, it is definitely OK to not support it by default but still let to admins the option to enable it on their own risk in case they do want to support old clients such as XP or old Linux. 

  But this is not the same case because theoretically Microsoft still  has left the option to enable DES and RC4 support in policies in Windows 2019 but despite this it isn’t working and no glue in MS documentations has been found about this limitation.
  So, my conclusion this is a bug or some undocumented design change.

• If you do believe it is a bug, then you should report it to Microsoft.  Microsoft does not charge for support cases that are determined to be bugs.

  ---

  tim

• Remove From My Forums

All replies

• «Is windows XP still supported to join the domain«

  No.  Windows XP is out of support.  No testing for compatibility/usability with 2019 has been performed by Microsoft because Windows XP is not supported.  As intimated by Clement, you might be able to get it to join by downgrading the domain,
  but that does not change the fact that it is still unsupported, even when the domain is at a lower level.  Not only does lower the settings in the domain lower the overall security of the domain, just having a Windows XP system in your environment lowers
  the overall security of your environment.

  ---

  tim

• Windows XP is generally unsupported — you might be able to arrange a custom support contract with Microsoft, but keep in mind that this is an expensive proposition and includes only support for security updates.

  hth
  Marcin

• It is not supported. You may be able to make it work but you should not be surprised if future updates will break it again.

  ---

• Hello,
  We can try the following common ways to troubleshoot the issue:

  1. Check if we can ping domain or domain controller.

  2. Check whether the Windows XP points to the correct DNS server.

  3. Check whether all the Windows XP clients can not be added to the same domain.

  4. Check whether we use correct domain administrator credentials when we join Windows XP to domain.

  5. Check if we try to create the Windows XP computer name in the domain first, then if we can add it to domain.

  If all the above is OK and all the Windows XP clients can not be added to the domain. I am sorry, please understand because Windows XP is out of support. We don’t have such an environment to test. It may have potential and incompatible
  problems. It is recommended that we use the new version of Windows client.

  Thank you for your understanding and support.

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

  • Edited by

    Tuesday, February 12, 2019 2:49 AM

  • Proposed as answer by
    Daisy ZhouMicrosoft contingent staff
    Thursday, February 28, 2019 2:30 AM

• Hi,
  If this question has any update or is this issue solved? Also, for the question, is there any other assistance we could provide?

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

• Hi Daisy Zhou,

  Please see the comments below:

  1. Check if we can ping domain or domain controller.
   — Yes….

  2. Check whether the Windows XP points to the correct DNS server.
   — Yes, it’s correct..

  3. Check whether all the Windows XP clients can not be added to the same domain.
   — Unfortunately, all windows XP clients are failed to join to the domain.

  4. Check whether we use correct domain administrator credentials when we join Windows XP to domain.
   — The domain admin credentials are correct.

  5. Check if we try to create the Windows XP computer name in the domain first, then if we can add it to domain.

   — Thanks for the suggestion. However, this method is not work either. But surprisingly that, I found the computers membership is
  been disabled when I join the win p client to the domain. It’s strange!

  Btw, thanks all for your feedback, suggestion and answer, appreciate it. Anyway, i think i need to find a plan for the win XP client.

  Thanks.

  Scriven Tan.

• Hi,
  You are welcome!

  Thanks for your understanding and time. Have a nice day!

  Best Regards,
  Daisy Zhou

  ---

  Please remember to mark the replies as answers if they help.
  If you have feedback for TechNet Subscriber Support, contact
  tnmff@microsoft.com.

• Hello

  I have the same problem and same error.

  According to my investigation , it seems that Windows 2019 AD controller supplies kerberos ticket to the Windows XP client  with AES encryption despite the fact that Windows XP asks and supports RC4 encryption only.

  The RC4 encryption support is enabled in policies for DC but it still doesn’t work and DC ignores this setting when 2016 and 2012 r2 and even 2008 r2 works correctly.

  I think that MS got decision to block RC4 support but no documentation about that was found. I hope that this is a bug and it will fixed whenever because this also affects other RC4 kerberos clients as various old Linux implementations being joined to AD
  domain.

• I seriously doubt that Microsoft enforcing a higher level of security in a domain would be considered a ‘bug’ by Microsoft.  They did the same thing many years ago when they stopped supporting NT4 security in a domain out of the box.  They did
  provide a way to ‘downgrade’ the environment to allow the NT4 security.  I would hazard a guess (I have not tried it) that if you downgraded your domain to something prior to 2019 functional level, you could get by the outdated security.  But you
  are sacrificing security in order to include operating systems that most likely do not have support anymore.  The OP was asking about Windows XP.  That is definitely not supported.  So downgrading security level to add an unsupported and security
  vulnerable operating system to the environment seems counter-intuitive.

  ---

  tim

• Hi

  Personally, I have no problem with nonsupporting of old protocols by default.  Moreover , DES and RC4 in Kerberos are not supported by default even in Win2008 R2 unless a administrator defines their supporting in policies.

  So, it is definitely OK to not support it by default but still let to admins the option to enable it on their own risk in case they do want to support old clients such as XP or old Linux. 

  But this is not the same case because theoretically Microsoft still  has left the option to enable DES and RC4 support in policies in Windows 2019 but despite this it isn’t working and no glue in MS documentations has been found about this limitation.
  So, my conclusion this is a bug or some undocumented design change.

• If you do believe it is a bug, then you should report it to Microsoft.  Microsoft does not charge for support cases that are determined to be bugs.

  ---

  tim

Ответы

• Предлагаю вам
  еще раз на пару тестовых утр )) не переопределять параметр ждать сеть ( Вы для чего его определили, поделитесь? Чтобы все круто было?)

  Лог обработки и применения а также много всего можно поглядеть в Журналы приложений и служб—>Microsoft—>Windows—>Group Ploicy—>Operational

  Отфильтруйте коды событий- информации вагон получите.

  Что касается ХП машин, по умолчанию, Windows XP не ждет полного завершения инициализации сети при загрузке и входе в систему — т.н. фоновое применение результатов обработки ГП.

  А проблема внезапно нарисовалась, на ровном месте? Я к тому, может, обновление поставили на драйверы карточек какое модное, нет? Поройтесь в памяти)

  • Помечено в качестве ответа
    Rotar Maksim
    5 октября 2012 г. 4:36

• Что касается ХП машин, по умолчанию, Windows XP не ждет полного завершения инициализации сети при загрузке и входе в систему — т.н. фоновое применение результатов обработки ГП.

  Оставьте дефолтное значение политики. Все политики безопасности и др. настройки все равно обработаются -«не применятся» в этот момент только «тяжелые» параметры политик ( установка софта и пр.)

  В общем, всё разрешилось изменением порядка (приоритета) политик.

  ---

  Сергей Панченко

  • Помечено в качестве ответа
    Rotar Maksim
    5 октября 2012 г. 4:36

Странности с входом в домен Windows

Re: Странности с входом в домен Windows

Сообщение

allez » 02.08.2007 08:02

chown BARNAUL\palex file
chown 'BARNAULpalex' file

Re: Странности с входом в домен Windows

Сообщение

f095 » 02.08.2007 10:00

Aug  2 12:39:24 palex kdm: :0[3571]: pam_krb5[3571]: error resolving user name 'BARNAULpalex' to uid/gid pair
Aug  2 12:39:24 palex kdm: :0[3571]: pam_krb5[3571]: error getting information about 'BARNAULpalex'
Aug  2 12:39:24 palex kdm: :0[3571]: pam_winbind(xdm:auth): request failed: No logon servers, PAM error was Authentication service cannot retrieve authentication info (9), NT error was NT_STATUS_NO_LOGON_SERVERS
Aug  2 12:39:24 palex kdm: :0[3571]: pam_winbind(xdm:auth): internal module error (retval = 9, user = 'BARNAULpalex')

Re: Странности с входом в домен Windows

Сообщение

f095 » 03.08.2007 05:54

palex:~ # smbclient -L 10.0.0.201 -A smb
Domain=[BARNAUL] OS=[Windows Server 2003 3790 Service Pack 1] Server=[Windows Server 2003 5.2]

        Sharename       Type      Comment
        ---------       ----      -------
        efremovatf      Disk      Users home dir
        egorovaev       Disk      Users home dir
        ivoilovang      Disk      Users home dir
        karpenko        Disk      Users home dir
        krilovanv       Disk      Users home dir
        ladogaag        Disk      Users home dir
        marchny         Disk      Users home dir
        sandrey         Disk      Users home dir
        yashkina        Disk      Users home dir
        print$          Disk      Printer Drivers
        cheprasovds     Disk
[skip]
session request to 10.0.0.201 failed (Called name not present)
session request to 10 failed (Called name not present)
Domain=[BARNAUL] OS=[Windows Server 2003 3790 Service Pack 1] Server=[Windows Server 2003 5.2]

        Server               Comment
        ---------            -------
        -SHPILEVA-
        0909_09              æá󿡬«ГіГЎ Г„. Г©.
        1-9CE1C2FECF2E4
        1-ED2530E6DCD04      äÑÓõ½ÑÓ
        10A04A06
        13A03A06
[skip]

        Workgroup            Master
        ---------            -------
        BARNAUL              PRIFS
        ELEKTR               TEL_STAN
        WORKGROUP            COMMHOST

Re: Странности с входом в домен Windows

Сообщение

allez » 03.08.2007 07:07

smbclient -U BARNAUL\palex \\10.0.0.201\c$

Re: Странности с входом в домен Windows

Сообщение

f095 » 03.08.2007 10:30

alexey@palex:~> smbclient -U BARNAUL\palex \\10.0.0.201\c$
Password:
Domain=[BARNAUL] OS=[Windows Server 2003 3790 Service Pack 1] Server=[Windows Server 2003 5.2]
tree connect failed: NT_STATUS_ACCESS_DENIED
alexey@palex:~> smbclient -U BARNAUL\palex \\10.0.0.201\Protect
Password:
Domain=[BARNAUL] OS=[Windows Server 2003 3790 Service Pack 1] Server=[Windows Server 2003 5.2]
smb: >

Re: Странности с входом в домен Windows

Сообщение

allez » 03.08.2007 11:21

Re: Странности с входом в домен Windows

Сообщение

f095 » 06.08.2007 04:47

palex:~ # smbclient -U BARNAUL\palex \\10.0.0.201\NETLOGON
Password:
Domain=[BARNAUL] OS=[Windows Server 2003 3790 Service Pack 1] Server=[Windows Server 2003 5.2]
smb: >
[1]+  Stopped                 smbclient -U BARNAUL\palex \\10.0.0.201\NETLOGON
palex:~ # smbclient -U BARNAUL\palex \\10.0.0.201\SYSVOL
Password:
Domain=[BARNAUL] OS=[Windows Server 2003 3790 Service Pack 1] Server=[Windows Server 2003 5.2]
smb: >
[2]+  Stopped                 smbclient -U BARNAUL\palex \\10.0.0.201\SYSVOL
palex:~ #

Re: Странности с входом в домен Windows

Сообщение

f095 » 07.08.2007 05:04

Re: Странности с входом в домен Windows

Сообщение

allez » 07.08.2007 07:41

Ну что же, начнем копать глубже.
Покажите, пожалуйста, вывод следующих команд:
1. ifconfig
2. route -n
3. cat /etc/resolv.conf
4. cat /etc/samba/smb.conf

Re: Странности с входом в домен Windows

Сообщение

f095 » 07.08.2007 08:41

palex:~ # ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0A:5E:53:59:ED
          inet addr:10.0.0.157  Bcast:10.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4785 errors:0 dropped:0 overruns:1 frame:0
          TX packets:3362 errors:0 dropped:0 overruns:0 carrier:0
          collisions:34 txqueuelen:1000
          RX bytes:851113 (831.1 Kb)  TX bytes:513996 (501.9 Kb)
          Interrupt:169 Base address:0xc000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:97 errors:0 dropped:0 overruns:0 frame:0
          TX packets:97 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:16121 (15.7 Kb)  TX bytes:16121 (15.7 Kb)

vnic0     Link encap:Ethernet  HWaddr 00:01:23:45:BE:EF
          inet addr:10.37.129.2  Bcast:10.37.129.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:67 errors:0 dropped:0 overruns:0 frame:0
          TX packets:67 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:8546 (8.3 Kb)  TX bytes:8546 (8.3 Kb)

palex:~ # route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.37.129.0     0.0.0.0         255.255.255.0   U     0      0        0 vnic0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         10.0.0.254      0.0.0.0         UG    0      0        0 eth0
palex:~ # cat /etc/resolv.conf
### BEGIN INFO
#
# Modified_by:  NetworkManager
# Process:      /usr/bin/NetworkManager
# Process_id:   2980
#
### END INFO

search barnaul.fb


nameserver 10.0.0.201
nameserver 10.0.0.203


palex:~ # cat /etc/samba/smb.conf
# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the
# samba-doc package is installed.
# Date: 2006-11-27
[global]
        workgroup = BARNAUL
        printing = cups
        printcap name = cups
        printcap cache time = 750
        cups options = raw
        map to guest = Bad User
        include = /etc/samba/dhcp.conf
        logon path = \%Lprofiles.msprofile
        logon home = \%L%U.9xprofile
        logon drive = Z:
        usershare allow guests = No
        idmap gid = 10000-20000
        idmap uid = 10000-20000
        security = domain
        template shell = /bin/bash
        domain logons = No
        domain master = No
        passdb backend = smbpasswd
        add machine script = /usr/sbin/useradd  -c Machine -d /var/lib/nobody -s /bin/false %m$
        winbind offline logon = yes
# [homes]
#       comment = Home Directories
#       valid users = %S, %D%w%S
#       browseable = No
#       read only = No
#       inherit acls = Yes
# [profiles]
#       comment = Network Profiles Service
#       path = %H
#       read only = No
#       store dos attributes = Yes
#       create mask = 0600
#       directory mask = 0700
[temp]
        comment = Shared Directory
        path = /home/alexey/temp/shared
        read only = No
        inherit acls = Yes
        create mask = 777
        directory mask = 777
# [groups]
#       comment = All groups
#       path = /home/groups
#       read only = No
#       inherit acls = Yes
[printers]
        comment = All Printers
        path = /var/tmp
        printable = Yes
        create mask = 0600
        browseable = No
[print$]
        comment = Printer Drivers
        path = /var/lib/samba/drivers
        write list = @ntadmin root
        force group = ntadmin
        create mask = 0664
        directory mask = 0775

[dstrbtvs]
        comment = Дистрибутивы программ
        inherit acls = Yes
        path = /home/alexey/dstrbtvs
        read only = Yes

## Share disabled by YaST
# [netlogon]

Re: Странности с входом в домен Windows

Сообщение

allez » 07.08.2007 11:06

[global]
    idmap gid = 10000-20000
    idmap uid = 10000-20000
    realm = EXAMPLE.RU
    security = ADS
    template homedir = /home/%U
    template shell = /bin/bash
    usershare allow guests = No
    winbind offline logon = yes
    winbind refresh tickets = yes
    workgroup = EXAMPLE

realm = BARNAUL.FB
security = ADS
winbind refresh tickets = yes

Re: Странности с входом в домен Windows

Сообщение

Xan » 24.10.2007 20:47

Oct 24 20:10:18 ubuntu gdm[4652]: pam_winbind(gdm:auth): getting password (0x00000190)
Oct 24 20:10:18 ubuntu gdm[4652]: pam_winbind(gdm:auth): pam_get_item returned a password
Oct 24 20:10:18 ubuntu gdm[4652]: pam_winbind(gdm:auth): request failed: No logon servers, PAM error was Authentication servi
ce cannot retrieve authentication info (9), NT error was NT_STATUS_NO_LOGON_SERVERS
Oct 24 20:10:18 ubuntu gdm[4652]: pam_winbind(gdm:auth): internal module error (retval = 9, user = 'roma')
Oct 24 20:10:20 ubuntu gdm[4652]: pam_winbind(gdm:account): request failed
Oct 24 20:10:32 ubuntu gdm[4652]: pam_winbind(gdm:auth): getting password (0x00000190)
Oct 24 20:10:32 ubuntu gdm[4652]: pam_winbind(gdm:auth): pam_get_item returned a password
Oct 24 20:10:33 ubuntu gdm[4652]: pam_winbind(gdm:auth): request failed: No such user, PAM error was User not known to the un
derlying authentication module (10), NT error was NT_STATUS_NO_SUCH_USER
Oct 24 20:10:33 ubuntu gdm[4652]: pam_winbind(gdm:account): request failed
Oct 24 20:10:38 ubuntu gdm[4652]: pam_winbind(gdm:auth): getting password (0x00000190)
Oct 24 20:10:38 ubuntu gdm[4652]: pam_winbind(gdm:auth): pam_get_item returned a password
Oct 24 20:10:38 ubuntu gdm[4652]: pam_winbind(gdm:auth): request failed: No such user, PAM error was User not known to the un
derlying authentication module (10), NT error was NT_STATUS_NO_SUCH_USER

[global]
winbind use default domain = yes
idmap uid = 10000-20000
realm = FOSNIR.RU
workgroup = FOSNIR
password server = 192.168.5.3
encrypt passwords = true
winbind enum users = yes
winbind enum groups = yes
template shell = /bin/bash
template homedir = /home/%D/%U
hosts allow = 192.168.5. 192.168.6. 192.168.2. 127.
winbind uid = 10000-20000
winbind gid = 10000-20000
security = ads
idmap gid = 10000-20000
netbios name = UBUNTU
restrict anonymous = 2
client use spnego = yes

[global]
workgroup = FOSNIR
server string = %h server (Samba, Ubuntu)
wins server = 192.168.5.3
dns proxy = no
log file = /var/log/samba/log.%m
max log size = 1000
syslog = 0
panic action = /usr/share/samba/panic-action %d

security = ads
password server = 192.168.5.3
realm = FOSNIR.RU
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = yes
invalid users = root
passwd program = /usr/bin/passwd %u
passwd chat = *EntersnewsUNIXspassword:* %nn *RetypesnewsUNIXspassword:* %nn *passwd:*passwordsupdatedssuccessfully* .
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
wide links=yes

idmap uid = 10000-20000
idmap gid = 10000-20000
template shell = /bin/bash
winbind enum groups = yes
winbind enum users = yes
template homedir = /home/%D/%U
client use spnego = yes
winbind use default domain = yes
winbind refresh tickets = yes
winbind offline logon = yes
restrict anonymous = 2
domain master = no
local master = no
preferred master = no
os level = 0

auth    required        pam_mount.so
auth    optional        pam_group.so
auth    sufficient      pam_winbind.so use_first_pass krb5_auth krb5_ccache_type=FILE
auth    sufficient      pam_unix.so nullok_secure use_first_pass
auth    required        pam_deny.so

Re: Странности с входом в домен Windows

Сообщение

NiKoLa_N » 24.10.2007 21:37

Re: Странности с входом в домен Windows

Сообщение

Xan » 25.10.2007 00:27

Re: Странности с входом в домен Windows

Сообщение

easy2002 » 12.11.2007 16:36

Re: Странности с входом в домен Windows

Сообщение

UTiM » 12.11.2007 23:43

Re: Странности с входом в домен Windows

Сообщение

zuledtux » 13.11.2007 13:15

Приветствую всех! Хочу поделиться своим небольшим опытом, может поможет. У меня тоже были аналогичные описанным здесь проблемам при входе в виндовый домен, долго не мог найти причину. Настривал все через Yast, после продолжительных поисков по инету наткнулся на одну статью, где было сказано, что для нормальной работы в домене не следует задавать опцию о создании домашней папки при входе в домен и обязательно определить офлайновую аутентификацию. После того как последовал этому совету все проблемы исчезли. Правда пришлось удалить ранее созданную при входе в домен домашнюю папку. При загрузке под local входишь под своей учетной записью в домене и все в норме. К сожелению ссылку на статью не нашел, но на скриншоте в статье было так же как на моем.

Вложения

Debian GNU/Linux
ICQ 339031874

Re: Странности с входом в домен Windows

Сообщение

UTiM » 13.11.2007 15:15

Re: Странности с входом в домен Windows

Сообщение

zuledtux » 13.11.2007 18:54

Debian GNU/Linux
ICQ 339031874

Re: Странности с входом в домен Windows

Сообщение

UTiM » 13.11.2007 22:59

Re: Странности с входом в домен Windows

Сообщение

Xan » 20.11.2007 23:17

-------
до рестарта winbind. ПОльзователь получил отлуп. И даже не в виде NO_LOGON_SERVERS

Nov 20 14:09:26 rusin gdm[4836]: pam_unix(gdm:auth): check pass; user unknown
Nov 20 14:09:26 rusin gdm[4836]: pam_unix(gdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=
Nov 20 14:09:26 rusin gdm[4836]: pam_winbind(gdm:auth): [pamh: 0x080ce710] ENTER: pam_sm_authenticate (flags: 0x0000)
Nov 20 14:09:26 rusin gdm[4836]: pam_winbind(gdm:auth): getting password (0x00000191)
Nov 20 14:09:26 rusin gdm[4836]: pam_winbind(gdm:auth): pam_get_item returned a password
Nov 20 14:09:26 rusin gdm[4836]: pam_winbind(gdm:auth): Verify user 'test'
Nov 20 14:09:26 rusin gdm[4836]: pam_winbind(gdm:auth): PAM config: krb5_ccache_type 'FILE'
Nov 20 14:09:26 rusin gdm[4836]: pam_winbind(gdm:auth): [pamh: 0x080ce710] LEAVE: pam_sm_authenticate returning 10
----------

после рестарта winbind пользователь зашел.

Nov 20 14:12:24 rusin gdm[4836]: pam_unix(gdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost=  user=test
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): [pamh: 0x080d3fa8] ENTER: pam_sm_authenticate (flags: 0x0000)
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): getting password (0x00000191)
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): pam_get_item returned a password
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): Verify user 'test'
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): PAM config: krb5_ccache_type 'FILE'
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): enabling krb5 login flag
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): enabling request for a FILE krb5 ccache
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): user 'test' granted access
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): request returned KRB5CCNAME: FILE:/tmp/krb5cc_10175
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): Returned user was 'test'
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:auth): [pamh: 0x080d3fa8] LEAVE: pam_sm_authenticate returning 0
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:account): user 'test' OK
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:account): user 'test' granted access
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:setcred): [pamh: 0x080d3fa8] ENTER: pam_sm_setcred (flags: 0x0002)
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:setcred): PAM_ESTABLISH_CRED not implemented
Nov 20 14:12:24 rusin gdm[4836]: pam_winbind(gdm:setcred): [pamh: 0x080d3fa8] LEAVE: pam_sm_setcred returning 0
Nov 20 14:12:24 rusin gdm[4836]: pam_unix(gdm:session): session opened for user test by (uid=0)
Nov 20 14:12:24 rusin gdm[4836]: pam_mount(mount.c:177) realpath of volume "/home/FOSNIR" is "/home/FOSNIR"

Re: Странности с входом в домен Windows

Сообщение

Saks » 23.11.2007 16:44

С доменным входом вроде все нормально иногда грабли выползают,но лечаться. А вот то что nsswitch.conf не работает это точно. И в слесе и следе и опенсусе101 и группы и юзеры доменные показывались в mc или по getent passwd или getent group. А сейчас как ни бился с nsswitch.conf не обрабатываются. Хотя можно поставить права chown -ом.

4 X SLES 10 SP1, Suse 11.1(GNOME), Win Vista

Re: Странности с входом в домен Windows

Сообщение

UTiM » 26.11.2007 11:24