Unable to join domain

I'm in the same boat as you... I'm now getting the exact same error! You would think MS would release the regkeys to make samba work with win7. I'm almost tempted to install a windows box just to use as an AD box.

I had samba version 3.0.33 of something like that prior...with all the registry hacks and info from this link:
Nabble - Samba - General - Windows 7 RC
...basically adding a DNS suffix in the user's network properties, I was able to login to the domain AND using the username and password...everything functioned ok, normal! I was good to go!!

BUT after a reboot, and trying to login with the username and password, it'd FAIL...this time the samba logs for the user machine would say: _net_auth2: creds_server_check failed

So then based ton this link:
[Samba] Windows 7 RC
it stated that is was a samba version compatibility issue...so then I upgraded samba from 3.0.33 to 3.4...

This created a DISASTER! I had to re-setup the samba conf and delete the user and machine, and re-authenticate all!

And now... I'm back to the settings I had prior to the samba upgrade, including the DNS sufix...but instead of being able to login to the domain AND user... I'm back getting the "the trust relationship between this workstation and the primary domain failed".... BUT this time the samba log for the user machine is saying...

netlogon_creds_server_check: credentials check failed.

_netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client USER machine account USER$

Anyone have any ideas...?

Thanks!

I've come to realize that the error from samba 3.0.33

_net_auth2: creds_server_check failed

And the error from samba 3.4

netlogon_creds_server_check: credentials check failed.

Are the SAME error messages! Grrrr...

Cause the line following is the same:

Rejecting auth request from client HOST machine account HOST$

..sigh...

Can anyone help me...!?!

OK. Back from a little vacation and it must have done me good because I have built a new Win 7 RTM box and connected it to the domain and it works OK. This new build still required all of the mods in my previous note but there is a spelling mistake in one of my registry keys - corrected below:

Morphaniel said:

The four registry mods are:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Parameters]
“DomainCompatibilityMode”=dword:00000001
“DNSNameResolutionRequired”=dword:00000000


The above need to be added to allow the join to work. Then find the key below and set those values to 0.


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Netlogon\Parameters]
“RequireSignOrSeal”=dword:00000000
“RequireStrongKey”=dword:00000000

As I said earlier, on joining the domain you get an error about the primary DNS suffix but it is ignorable.

Now, my upgraded machine (with the corrected key) still fails to join the domain but note that this upgraded box did not have the second two keys in the registry whereas the newly built box did. Clearly, upgrading a Vista machine does not leave the registry in the same state as newly building (or else the MS upgrade process is simply broken )

...and so I move on to my network shares, which on this test rig happen to be located on an elderly Buffalo Terastation, which also has Samba. Whilst one can upgrade Buffalo boxes, I wasn't about to make the jump in versions which would be required (if possible) to get to Samba 3.3.4 so I had to add the old tweak to the Win7 Local Security Settings before I could see the shares:

Click Start
Click Control Panel
Click Administrative Tools
Double-Click Local Security Policy
In the left pane, click the triangle next to Local Policy
In the left pane, click Security Options
In the right pane near the bottom, double-click "Network security:
LAN manager authentication level"
Click the drop-down box, and click "Send LM & NTLM - use NTLMv2
session security if negotiated"
Click OK

Hmmm...just found ou the security policy settings all changed when I did my update to RTM...

I'll play with my settings and see what happens, and report back...

What/where was the spelling error? I don't see any error in mine, especially since I copy/pasted...LOL

As a side note... Should I be restarting the PC after making the Policy changes? Cause I just logoff, then back on....

Thanx for the above - most useful.
Not sure it is relevant, but in the Control Panel (Detail view!!) > Network and Sharing Center > Local Area Connection > Properties, I also had to set the i/p properties to include the i/p address of my DNS server.
This is similar to a problem I encountered ages ago with 2000 & XP on my local domain.

Still no success

I still get:

the trust relationship between this workstation and the primary domain failed

I'll keep playing with the settings and researching on google...

well kids...I'm about to throw in the towel...!

I've messed with this for over 2 weeks now with no success.

If anyone gets any ideas, I'll be keeping an eye out on this thread...

Thanks.