A Windows 11 domain member refuses to take its time from a Samba AD DC running chrony. Plain NTP works, the configuration is fine, yet the DC never answers. The cause: above functional level 2012, Windows uses the MS-SNTP extended authenticator, which neither chrony nor Samba support. I patched both, and after one more trap in the byte order, Windows now accepts the signed replies.
Category: Samba
Where (and why) it all began While trying to join an Ubuntu client to my Samba domain, I got this error that most likely prevented a successful login. From the sssd’s log files I got this as a first hint: So it looks like we got a problem with my Samba domain not serving GPO […]
While trying to get radius working with my Samba domain controller, I was looking for a way to get attributes like radiusTunnelPrivateGroupId into it. In the end the solution was something completely different, but anyhow: Here’s what I did to raise the domain level (and as it turns out the function and forest level) of […]