CIFS machine account creation using child domain fails with error the search was timed out
Applies to
Issue
- CIFS machine account creation is failing with below error :
::*> vserver cifs create -vserver Data_Svm01 -cifs-server ACCOUNT_01 -domain NET.domain1.COM -ou CN=Computers -default-site "" -status-admin up.
In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of a Windows account with sufficient privileges to add computers to the "CN=Computers" container within the "NET.domain1.COM" domain.
Enter the user name: administrator
Enter the password:
Error: Machine account creation procedure failed
[ 8039] Loaded the preliminary configuration.
[ 10252] Successfully connected to ip 172.xx.xx.xx, port 445 using TCP
[ 12262] Successfully connected to ip 172.xx.xx.xx, port 88 using TCP
** [39142] FAILURE : Could not create account
** 'cn=ACCOUNT_01, CN=Computers, dc=NET, dc=domain1, dc=COM':** Timed out
Error: command failed: Failed to create the Active Directory machine account "ACCOUNT_01". Reason : LDAP Error: The search was timed out
- SECD logs during the time shows after CIFS account creation, it initiates kerberos authentication using this CIFS account and fails with error
(KRB5KDC_ERR_SVC_UNAVAILABLE). - It falls back to NTLM which fails with error
(NT_STATUS_AUTH_LOGON_FAILURE)
[kern_secd:info:11167] [ 12262] Successfully connected to ip 172.xx.xx.xx, port 88 using TCP
[kern_secd:info:11167] [ 50287] A service is not available that is required to process the request (KRB5KDC_ERR_SVC_UNAVAILABLE)
[kern_secd:info:11167] [ 50287] Failed to initiate Kerberos authentication. Trying NTLM.
[kern_secd:info:11167] [ 50289] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED) for SMB command SessionSetup
[kern_secd:info:11167] [ 50292] Encountered NT error (NT_STATUS_AUTH_LOGON_FAILURE) for SMB command SessionSetup