samba - May 2002 - joining a w2k machine to a samba domain

I hope someone has some ideas on this problem I've hitting against 
since yesterday afternoon.

I've set up a samba server (samba 2.2.3a on RH7.2) as a PDC as per the 
combined samba howto docs. I have no problem joining Win9x machines to 
the domain but cannot add a w2k machine to the domain. It always fails 
with the message (on the W2K worksation):

login failure: unknown user name or bad password

I have atached my smb.conf file. The way in which I am trying to add the 
w2k computer to the domain:

(1) manually created the machine trust account on samba server
(2) created a user (ntadmin) whose primary group is root on samba server
(3) configured smb.conf (see attached) as per the example in the samba docs
(4) clean install of W2K with workgroup WORKGROUP (W2K machine name is 
ZAPHOD)
(5) boot W2K machine and login as the administrator
(6) open system properties in the control panel, go 'network 
identification' and click 'properties'
(7) click the 'Domain' radio button and type name of domain (OFFICE) 
then click OK
(8) in the 'Domain Username and Password' dialog I enter ntadmin as user
and the ntadmin password

I then get the error message shown above. If I look in 
/var/log/samba/zaphod.log I get the following message..

.
.
[2002/05/19 12:50:44, 0] passdb/pdb_smbpasswd.c:pdb_getsampwrid(1416)
unable to open passdb database
.
.
This message seems to be independent of whether or not I have the "obey 
pam restrictions" option set to yes or no. My pam file for samba is also 
attached in case it is relevant.

Any help on this will be really welcome.

Neil
email: neil@neologix.net


-------------- next part --------------
#%PAM-1.0
auth       required	/lib/security/pam_smbpass.so nodelay
account    required	/lib/security/pam_pwdb.so audit nodelay
session    required	/lib/security/pam_pwdb.so nodelay
password   required	/lib/security/pam_smbpass.so nodelay
smbconf=/etc/samba/smb.conf
-------------- next part --------------
#======================= Global Settings
====================================[global]
  workgroup = OFFICE
  netbios name = DENT
  server string = Samba Server
  hosts allow = 192.168.1. 127.
   printcap name = /etc/printcap
   load printers = yes
   printing = lprng
   log file = /var/log/samba/%m.log
   max log size = 500
   security = user
  password level = 8
  username level = 8
   encrypt passwords = yes
   smb passwd file = /etc/samba/smbpasswd
  unix password sync = Yes
  passwd program = /usr/bin/passwd %u
  passwd chat = *New*password* %n\n *Retype*new*password* %n\n
*passwd:*all*authentication*tokens*updated*successfully*
  username map = /etc/samba/smbusers
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   remote announce = 192.168.1.255
   local master = yes
  os level = 64
  domain master = yes
  preferred master = yes
   domain logons = yes
  logon script = logon.bat
  logon path = \\%N\profiles\%U
  logon home = \\%L\%U\.profiles
  logon drive = H:
   wins support = yes
   wins proxy = yes
   dns proxy = yes
  preserve case = yes
  short preserve case = yes
  default case = lower
  case sensitive = no

#============================ Share Definitions
=============================[homes]
   comment = Home Directories
   writable = yes
   valid users = %S
   browseable = yes

[netlogon]
   comment = Network Logon Service
   path = /usr/local/samba/lib/netlogon
   write list = ntadmin

[profiles]
  path = /usr/local/samba/profiles
  read only = no
  create mask = 0600
  directory mask = 0700
  browseable = yes

[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   guest ok = yes
   writable = no
   printable = yes
   public = yes
#

Thanks to everyone who replied. I've got it all working now, including 
the roaming profiles.

Neil

Because the replies to my question came direct to my email and not 
through the list I thought others with the same problem might benefit if 
I summarised the way in which I solved the problem of adding a w2k 
workstation to a domain managed by a samba pdc.

(1) make sure your samba is up to date. I actually used samba 2.2.3a but 
am about to upgrade to 2.2.4
(2) read the docs on the samba.org site, in particular the combined 
howtos in pdf format
(3) set up and test your smb.conf using testparm. I actually did it in 3 
stages (the final stage was based on the help I received from the email 
replies to my original posting)
(4) stage 1: set up your initial smb.conf and make sure samba is working 
for your W9x environment
(5) stage 2:
   (a) configure your smb.conf as per the model supplied in the combined 
howtos mentioned above
   (b) create the machine trust account referred to in the docs. I did 
this manually but the docs also show how this can be done by samba 
itself which is the recommended approach
   (c) read the man pages for smb.conf several times and add in all the 
bits that you've missed above in particular add in settings in the 
global area of smb.conf for 'domain admin group = root' and 'domain 
admin users = root'
(6) stage 3:
       (a) check out

http://de.samba.org/samba/ftp/docs/htmldocs/samba-pdc-faq.html

http://de.samba.org/samba/ftp/docs/htmldocs/samba-pdc-howto.html

   (b) make root a samba user (yeah I know I was stupid not to have 
thought of this first but we can't all be perfect)

(7) login to your w2k box as administrator and add the box to your new 
(NT4) domain. When prompted for a domain user with permission to add the 
w2k machine enter your root userid and password. Reboot the w2k box when 
prompted and login to your samba domain in the usual way.

Hope someone else finds this useful.

Neil