Hello,

Problem0!! problem0!! problemz!!

Lets start

My Area Have a Very Big Network on LAN of about 600 Peoplez using From a Win2k server which is providing them internet connection on sum fee ...

so the server is on win2k and all workstations are windows ...
the server owner have a very tight security ... that is

1) A system name is issued by Him like Skynet12 .( this is my system name)

2) A Username is given by Him like Deltanet212 (this is my username)

3) A password is given by him (suppose : Blah_Blah)

4) workgroup is "deltanet"

5) Server is Also running in DHCP mode so server will assign IP Address to my box.

6) Server is also running M$ I$A server.

7) Server IP is (172.16.0.2) & name is (Chatserver)

1 + 2 + 3 if i change any of these thing ... my net stop working and ISA shows a red bulb on it.

But rite now, in simple i just want to join the domain

i have tried these setting in samba

[Global]

netbios = skynet12

workgroup = deltanet

password server = *

security = domain

then i tried

# smbpasswd -j deltanet -r <PDC> -U deltanet212

and when it asked password i type my password (blah_blah)

but i giv me an NT error sumthing like "NT_ERROR_INVALID_WORKSTATION"

but when i tried a wrong password with the same it gives me the error "NT_ERROR_ACCESS_DENIED" sum thing like this ...

now wat i know is that it is trying to join the domain but bcuz very much tight security it gives me that error .....

Any one here can help me in this matter

Please Give me ur Suggestions ... right or rong ... tested or untested every thing will be appreciated ....

I m running

1) Athlon 2100 XP +
2) Redhat linux 8
3) dual boot with windows XP & 98
4) Grub Boot Loader
5) Kernel 2.4.18-14

if any one wana ask sum thing else please go ahead ....


kEsHiF
---------------------------------------------------------------------------------
I Belive Problems are created to be solved

Ok, maybe this helps:

To join a domain, your server wants you to have 2 accounts, 1 for you (the user) and 1 for the computer (trust account).

Apparently, the user account is ok (since you don't get an ACCESS_DENIED) however, your workstation account is not: INVALID_WORKSTATION.

I'm not sure weather Samba can use that workstation account or not. You might check for that.

I think once you can log into the server, the rest will come along! (I used ISA once, very nice and very restrictive)

I'll bet your problem is due to smb signing. Your windows server requires it and samba isn't capable of smb signing at the moment.

To solve the problem, look for the "Require SMB signing" option in either local security policy (on your 2000 server) or in your default group policy. If you can't find it I'll look and find it (guide you). What I did is I made smb signing optional. That means your 2000 and xp clients will still use smb signing, but the samba is let in even though it can't do signing.

Hope that helps!

Hello ,

First of let me tell you ... i can't change any thing on server bcoz it is'nt in my control ....
secondly i think my server operator or my "DCN wala" (Desi Cable Network) operator dont want us users to use other then Windows OS ...

Third thing .... I tried, as i know when we make a domain on work station from Network ID on Xp or win2kpro it add a machine name on server ........... so i tried to join domain from Xp and i did it easily ..... so i think machines account is added on server ... but when i booted from linux and tried it again .. no such luck same message rather calling it error .. i dont know y ...


AND tisource

I can't so any thing on server it is not in my control i m just a restricted user who wana use Linux system on network but coz of very tight security i couldn't manage to do that .... kindly tell me wat else can i do with that thing .... other wise i just have to stick with this windows

thnx in advance

And lastly wat sort problem i m having is this ...


#### when i giv it a correct password

[root@skynet12 root]# smbpasswd -j deltanet -r 172.16.0.2 -U deltanet212
Password:
Error connecting to 172.16.0.2 - NT_STATUS_INVALID_WORKSTATION
Unable to join domain DELTANET.

#### when i tried without -U and username

[root@skynet12 root]# smbpasswd -j deltanet -r 172.16.0.2
cli_net_req_chal: Error NT_STATUS_INVALID_COMPUTER_NAME
cli_nt_setup_creds: request challenge failed
modify_trust_password: unable to setup the PDC credentials to machine 172.16.0.2. Error was : NT_STATUS_UNSUCCESSFUL.
2004/02/03 17:53:55 : change_trust_account_password: Failed to change password for domain DELTANET.
Unable to join domain DELTANET.

#### when i tried with rong password

[root@skynet12 root]# smbpasswd -j deltanet -r 172.16.0.2 -U deltanet212
Password:
Error connecting to 172.16.0.2 - NT_STATUS_LOGON_FAILURE
Unable to join domain DELTANET.

[root@skynet12 root]#

I understand that you don't have control over the Windows server. Too bad you don't. It's always tough when you don't have the control you need to get a particular task done.

I am quite confident that SMB signing is to blame for your problem (or at-least part of the problem). You likely won't be able to mount window shares or join the domain until the issue is resolved. I ran into that prob myself, but I am the netadmin, so I was able to adjust policies on windows.

You might want to try mounting a windows share via linux (which does not require domain membership). If you can mount, then smb signing isn't to blame.

Domain membership in linux isn't a necessity like it is in windows. The main reason, as far as I'm aware, that someone joins a domain in linux is to integrate their samba server with the domain, so that you can grant rights on your samba server to domain users. (samba + winbind). If all you want to do is access files on the windows server, then you don't really need to join the domain. Shares can be auto-mounted via your fstab file (/etc/fstab) at boot-up.

Of course, if you do have a SMB signing problem (also referred to as CIFS), and you can't add support to samba, then you don't have many options. But if you can mount folders and/or shares, then you're okay.

The only other option you have (if you really want to join the domain), (since the windows server is out of reach) is to add SMB signing support to samba. I've never done it, but there is support (possibly experimental) for such. Check on google, and I'm sure you'll find something. If that doesn't work for you, then you're probably out of luck, unless you can convince your netadmin to change the group policy to ease SMB signing restrictions (which is doubtful, I'll bet).

Good luck!

Hello tisource,

I have tried to mount and yes i can mount the drive the share of windows through samba like this

# smbmount //172.16.0.2/mspclnt /mnt/new -o username=deltanet212

then it ask for password and when i give it a correct password it mount the share from server to my drive ... so i think ther is ... no problem of mounting and user is also working.

And to add information...

i want to use internet access ..... browsing and IRC but bcuz of the policies at server that if we aren't a domain member or didn't joined the domain we can't access internet or browsing facility ..... the server is a internet service provider on big LAN basis .....

and wat else i think from this below line is ..... the server operator dont want us to use other then windows .....

[root@skynet12 root]# smbpasswd -j deltanet -r 172.16.0.2 -U deltanet212
Password:
Error connecting to 172.16.0.2 - NT_STATUS_INVALID_WORKSTATION
Unable to join domain DELTANET.

i think these words tell the story "NT_STATUS_INVALID_WORKSTATION" ....
invalid workstation like linux on Win2k domain ....

and as i said in my first post that .... they want us to login under domain only on these circumstances ....

1) A system name is issued by Him like Skynet12 .( this is my system name)

2) A Username is given by Him like Deltanet212 (this is my username)

3) A password is given by him (suppose : Blah_Blah)

4) workgroup is "deltanet"

5) Server is Also running in DHCP mode so server will assign IP Address to my box.

if any of these setting doesn't match we can't login or we can't join domain .... so is ther any other problem in my samba setting or sum thing else..

thnx for ur reply ......

kEsHiF

I just realized this (should have realized sooner)....you have to have administrator priviledges (on the domain itself) to add computers to the domain. Since you are not an administrator, your credentials are not sufficient. The reason you are seeing the workstation error is because you don't have permissions to create objects in Active Directory, and when a machine joins the domain, a workstation object is created that represents that particular machine.

As far as internet access is concerned, your netadmin is probably routing traffic through a windows proxy server, which has strict access guidelines. Nothing you can really do about it, unless he/she decides to have mercy on you (lol).

It's up to your network administrator to grant you the permission you need. Based on what you've said, it sounds unlikely that will happen.

I'm sorry I can't be more help.

hi tisource

Thnx for every help ....
May be i should do it first in my office then i will try telling my this server admin to do wat i did ...... in my office ........ I hope he will help me in doing that ....

thnx again tisource
..............

keshif