カテゴリー: OS

ONTAP API が失敗しました： Failed to create the Active Directory machine account "ファイルサーバ名". Reason: LDAP Error: Strong authentication is required Details: Error: Machine account creation procedure failed [ 136] Loaded the preliminary configuration. [ 215] Successfully connected to ip ADサーバIP, port 88 using TCP [ 284] Successfully connected to ip ADサーバIP, port 389 using TCP [ 308] Unable to connect to LDAP (Active Directory) service on ADサーバホスト名 (Error: Strong(er) authentication required) **[ 308] FAILURE: Unable to make a connection (LDAP (Active ** Directory):AD名), result: 7609 . （エラー：13001）

netapp::> vserver cifs create -vserver ファイルサーバ名 -cifs-server ファイルサーバ名 -domain AD名 -ou CN=Computers -default-site "" -status-admin up -comment "" -netbios-aliases ファイルサーバ名

In order to create an Active Directory machine account for the CIFS server, you
must supply the name and password of a Windows account with sufficient
privileges to add computers to the "CN=Computers" container within the
"AD名" domain.

Enter the user name: administrator

Enter the password:

Warning: An account by this name already exists in Active Directory at
         CN=ファイルサーバ名,CN=Computers,DC=xx,DC=xx.
         If there is an existing DNS entry for the name ファイルサーバ名, it must be
         removed. Data ONTAP cannot remove such an entry.
         Use an external tool to remove it after this command completes.
         Ok to reuse this account? {y|n}: y

Error: Machine account creation procedure failed
  [    31] Loaded the preliminary configuration.
  [   107] Created a machine account in the domain
  [   108] SID to name translations of Domain Users and Admins
           completed successfully
  [   113] Modified account 'cn=ファイルサーバ名,CN=Computers,dc=xx
           =CO,dc=JP'
  [   114] Successfully connected to ip xx.xx.xx.xx, port 88 using
           TCP
  [   129] Successfully connected to ip xx.xx.xx.xx, port 464
           using TCP
  [   216] Kerberos password set for 'ファイルサーバ名$@AD名'
           succeeded
  [   216] Set initial account password
  [   223] Successfully connected to ip xx.xx.xx.xx, port 445
           using TCP
  [   274] Successfully connected to ip xx.xx.xx.xx, port 88 using
           TCP
  [   297] Successfully authenticated with DC
           adserver.AD名
  [   322] Unable to connect to NetLogon service on
           adserver.AD名 (Error:
           RESULT_ERROR_GENERAL_FAILURE)
**[   322] FAILURE: Unable to make a connection
**         (NetLogon:AD名), result: 3
  [   322] Unable to make a NetLogon connection to
           adserver.AD名 using the new machine account

Error: command failed: Failed to create the Active Directory machine account
       "ファイルサーバ名". Reason: general failure.

netapp::>

netapp::> vserver cifs security show -vserver ファイルサーバ名

Vserver: ファイルサーバ名

                            Kerberos Clock Skew:                   - minutes
                            Kerberos Ticket Age:                   - hours
                           Kerberos Renewal Age:                   - days
                           Kerberos KDC Timeout:                   - seconds
                            Is Signing Required:                   -
                Is Password Complexity Required:                   -
           Use start_tls for AD LDAP connection:               false
                      Is AES Encryption Enabled:               false
                         LM Compatibility Level:  lm-ntlm-ntlmv2-krb
                     Is SMB Encryption Required:                   -
                        Client Session Security:                none
                SMB1 Enabled for DC Connections:               false
                SMB2 Enabled for DC Connections:      system-default
  LDAP Referral Enabled For AD LDAP connections:               false
               Use LDAPS for AD LDAP connection:               false

netapp::>

[2020/08/07 14:26:55.226653,  0] ../../source4/rpc_server/netlogon/dcerpc_netlogon.c:284(dcesrv_netr_ServerAuthenticate3_helper)
  dcesrv_netr_ServerAuthenticate3_helper: schannel required but client failed to offer it. Client was ファイルサーバ名$

# Global parameters
[global]
        netbios name = ADサーバ名
        realm = AD名
        server role = active directory domain controller
        workgroup = AD名
        idmap_ldb:use rfc2307 = yes
        ldap server require strong auth = no
        server schannel = auto

[netlogon]
        path = /usr/local/samba/var/locks/sysvol/AD名/scripts
        read only = No

[sysvol]
        path = /usr/local/samba/var/locks/sysvol
        read only = No