Samba/Winbind - Windows ActiveDirectory - Event log 4768 audit failure

[tom]

Hi all,

I use a Ubuntu 16.04.4 LTS version with samba / winbind packages to get information of Active Directory (Users, group membership etc). This information are needed for my squid setup. The information are received well and the integration into squid.conf works fine. Unfortunately I have one big problem. I am seeing numerous amount of kerberos errors in DC event. Event id- 4768(Audit Failure)

A Kerberos authentication ticket (TGT) was requested.
Account Information:
Account Name: root
Supplied Realm Name: TEST.LOCAL
User ID: NULL SID
Service Information:
Service Name: krbtgt/TEST.LOCAL
Service ID: NULL SID

There is no user as root in my DC and there is no functionality breakup. It
is getting correct user name. But, by default first kerberos ticket
requested by root. Whenever samba is restarted or communicating with my
system. Audit failure logs are dumped. Over the time (day) there are a lot of such kerberos requests through my DC.

I think it might be a regression issue from samba while fixing badlock.

Could anyone help regarding this issue?

Thanks

[Andreas Hasenack (ahasenack)]

Thanks for filing this ticket in Ubuntu.

Unfortunately your report is too broad to be considered a bug, and feels more like a support request. Not only that, but support for windows audit logs.

I suggest you try to get help within the community at askubuntu.com, or perhaps the samba mailing list at https://lists.samba.org/mailman/listinfo/samba