Windows 2003 cannot connect samba NT_STATUS_ACCESS_DENIED

English Network/Internet
#1

[LEFT]I migrated my server from Leap 42.1 to 42.3, after that, my terminals with windows 2003 no longer access the samba, it asks the user and password, but it does not connect, when I look at the Samba LOG, I see these errors. Note: Before migrating, it was working perfectly

[2018/07/12 11:17:21.791954, 1] …/source3/smbd/service.c:502(make_connection_snum)
create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
[2018/07/12 11:21:09.978349, 1] …/source3/smbd/service.c:502(make_connection_snum)
create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
[2018/07/12 11:21:11.037707, 1] …/source3/smbd/service.c:502(make_connection_snum)
create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
[2018/07/12 11:21:11.039161, 1] …/source3/smbd/service.c:502(make_connection_snum)
create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
[2018/07/12 11:21:14.230298, 1] …/source3/smbd/service.c:502(make_connection_snum)
create_connection_session_info failed: NT_STATUS_ACCESS_DENIED

[/LEFT]
My Samba package

LANG=C zypper info samba
Loading repository data…
Reading installed packages…

Information for package samba:

Repository : openSUSE-Leap-42.3-Update
Name : samba
Version : 4.6.14+git.150.1540e575faf-15.1
Arch : x86_64
Vendor : openSUSE
Installed Size : 1.4 MiB
Installed : Yes
Status : up-to-date
Source package : samba-4.6.14+git.150.1540e575faf-15.1.src
Summary : A SMB/CIFS File, Print, and Authentication Server
Description :
Samba is a suite of programs that allows SMB/CIFS clients to use the
Unix file space, printers, and authentication subsystem.

The package named samba contains all programs that are needed to act as
a server.  The binaries expect the configuration file to be found in
/etc/samba/smb.conf

For a more detailed description of Samba, check the samba-doc package
or the Samba.org Web page at https://www.Samba.org/

Please check https://en.openSUSE.org/Samba for general information on
Samba as part of SUSE Linux Enterprise or openSUSE products, links to
binary packages of the most current Samba version, and a bug reporting
how to.

Source Timestamp: 3761
Branch:         4.6.14+git.150.1540e575faf
#2

Based on a quick Internet search of your error…

It seems your error is likely both clear (Authentication problem access denied) but also insufficient. What you’ve posted returns too many possible causes, and some situations even report that despite the error a connection was still possible for unexplained reasons.

So,
Recommend you collect more info.
There might be more info in the SAMBA log, Windows Event Viewer, even the openSUSE system log, the latter I’d recommend by reading your system log in real time while your client makes its connection attempt (Best if there is no other traffic happening).

To read your system log in real time, run the following in an elevated console

journalctl -f

HTH,
TSU

#3

Hi
Windows 2003 uses smb1 which is deprecated…
https://blogs.technet.microsoft.com/josebda/2015/04/21/the-deprecation-of-smb1-you-should-be-planning-to-get-rid-of-this-old-smb-dialect/

You would need to configure the samba server to allow for SMB 1 connections (if that will even work still?)…

#4

This is likely the result of security.changes to samba with SMBv2 being the minimum protocol version set. It is possible to override though (with the security implications that has). Set the ‘min protocol’ as needed in the ‘global’ section of smb.conf. Refer to ‘man smb.conf’ for more info.

#5

I already configured the minimum protocol and it still does not work

testparm -v | grep proto
Load smb config files from /etc/samba/smb.conf
Processing section “[dados]”
Processing section “[copias]”
Processing section “[web]”
Processing section “[netlogon]”
Processing section “[tmp]”
Processing section “[docs]”
Processing section “[upper]”
Processing section “[print$]”
Processing section “[printers]”
Processing section “[home]”
Loaded services file OK.
idmap range not specified for domain ‘*’
ERROR: Invalid idmap range for domain *!

Server role: ROLE_DOMAIN_PDC

Press enter to see a dump of your service definitions

    client ipc max protocol = default
    client ipc min protocol = CORE
    client max protocol = default
    client min protocol = CORE
    server max protocol = SMB3
    server min protocol = CORE