Unable to connect windows clients to AD DC

UCS - Univention Corporate Server
, ,
9

Okay, great :slight_smile: That looks as expected.

Now, how should we proceed … I think it’s necessary to determine if this is a problem of UCS itself or maybe caused by a networking/firewall issue.

  1. I recommend to update the UCS system to the latest Errata-Level (26). That won’t solve your problem, but Errata 18 contains a critical security fix for Samba.
  2. Is the pfSense “between” the Windows client and the UCS? If so, please double check your firewall config. I’ve seen UDP packets denied but TCP packets allowed for DNS (port 53), leading to similiar strange responses.
  3. Please check if you have any S4-Connector-Rejects:
    univention-s4connector-list-rejected
  4. Please try to update the relevant DNS entries via this samba command on the UCS:
    samba_dnsupdate
    Does this change anything?
  5. Try to check the DNS records directly on the UCS. I’ll attach a patched version of a script that will do this (the version delivered with UCS 4.2 has a little flaw causing it to fail, unfortunately. Fix is on the way).
    → copy the attached check_essential_samba4_dns_records.txt to your UCS (using scp or something like WinSCP or downloading it via the direct link with a commandline tool like wget or curl)
    → rename it: mv check_essential_samba4_dns_records.txt check_essential_samba4_dns_records.sh
    → make it executable: chmod +x check_essential_samba4_dns_records.sh
    → execute it: ./check_essential_samba4_dns_records.sh
    → copy&paste the output