[Help] Active-Directory domain join doesn't work

[sumpffuss]

Hi all

I'm new to the TerraMaster NAS, just bought a F2-425 and got TOS Version 6.0.770.00002 installed upon boot.

I don't seem to be able to join the NAS to the (Samba based) Active-Directory domain. I have different Operating Systems (Windows 10, Windows 11, Linux) here working all well in the AD.

When I try to join the NAS to the AD, DNS checking succeeds, "checking Networking" succeeds as well but when it comes to "checking domain services" it fails with "SMB workgroup set incorrectly".

I saw in the Samba server logs that the login succeeds, so the credentials are OK.

I then tried to execute on the NAS

Code: Select all

smbclient -L dc1.dom.tld -N

against my domain controller and it tells me

Code: Select all

Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        netlogon        Disk      
        sysvol          Disk      
        IPC$            IPC       IPC Service (Samba 4.13.13-Debian)
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available

Is the NAS really relying on wrokgroup enumeration using SMB1? SMB1 is inherently insecure and should not be used anymore, I thought, or am I wrong?

Regards,
Sumpffuss

[CursaYang]

Hello, our NAS uses SMB protocol by default, with the minimum version set to SMB1 and the maximum version set to SMB3. You can modify this in the File Service - SMB settings.

[SomeGuyInCalifornia]

I'm having the same issue on a similar model. I have a domain controller running Samba-AD-DC on a Debian server. Other Windows and Linux hosts can join the domain, but my F4-424Pro cannot join the domain. The system is running version 6.0.783, has a static IP on the same subnet as the DC, and has the DNS server set as the IP of the DC.

In the File Services control panel, I switched the minimum version to SMB2, but the error message continues to display "SMB workgroup set incorrectly". I provided screenshots, but blurred out the domain and workgroup names, which are the same. I've also verified that the username and password combination are good, and used them on other systems. I also tried the domain-administrator account, but it failed with the same error, too.







When I SSH into the NAS and run the smbclient command to list:

Code: Select all

# smbclient -L dc0.domain.local -N
Anonymous login successful

	Sharename       Type      Comment
	---------       ----      -------
	sysvol          Disk      
	netlogon        Disk      
	IPC$            IPC       IPC Service (Samba 4.22.4-Debian-4.22.4+dfsg-1~deb13u1)
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available

[sumpffuss]

I'm glad that I'm not alone, however I'm not happy with the situation as such.

@TerraMaster: Are we doing anything wrong? Is there a solution to the problem? If it's not possible in the GUI, I'm fine to do it via the CLI.

Kind regards.

[sianderson]

we had an issue with our aging buffalo NAS, that wouldnt join the domain on one of our DC's but would from our backup DC

turned out the issue was server end as hinted a windows update on our Server 2019 system disabled SMB1 on one server, we must have enabled it on the backup at some point, so rightly or wrongly we enabled SMB1 on the server which solved the issue

[TMLila]

Hi all

I'm new to the TerraMaster NAS, just bought a F2-425 and got TOS Version 6.0.770.00002 installed upon boot.

I don't seem to be able to join the NAS to the (Samba based) Active-Directory domain. I have different Operating Systems (Windows 10, Windows 11, Linux) here working all well in the AD.

When I try to join the NAS to the AD, DNS checking succeeds, "checking Networking" succeeds as well but when it comes to "checking domain services" it fails with "SMB workgroup set incorrectly".

I saw in the Samba server logs that the login succeeds, so the credentials are OK.

I then tried to execute on the NAS

Code: Select all

smbclient -L dc1.dom.tld -N

against my domain controller and it tells me

Code: Select all

Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        netlogon        Disk      
        sysvol          Disk      
        IPC$            IPC       IPC Service (Samba 4.13.13-Debian)
Reconnecting with SMB1 for workgroup listing.
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
protocol negotiation failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available

Is the NAS really relying on wrokgroup enumeration using SMB1? SMB1 is inherently insecure and should not be used anymore, I thought, or am I wrong?

Regards,
Sumpffuss

Hello! Thank you so much for your feedback regarding SMB1 being set as the default minimum version. Your input is extremely important to us, and we will include this issue in our considerations for future optimizations.
Additionally, we sincerely apologize that we have not yet been able to replicate the problem you encountered in our testing environment. For the time being, we recommend restarting your NAS device and then attempting to reconnect. If it is convenient for you, we would also be happy to provide remote assistance to resolve this issue. You can schedule remote support with our online customer service team via our official website. Remote scheduling link: https://www.terra-master.com/global/

[sumpffuss]

Thanks a lot for the insights, that helps understanding where the problem might be.

If I understand you right, enabling SMB1 on the server side should solve the problem? Well, to be honest, I do not want enable an almost 30y old, security-wise flaky protocol on the domain controller. As far as I recall even Microsoft recommend against using it. Or maybe it got it wrong?

I still hope there's another solution.

[cmicallef]

I have same issue and SMB 1 is enabled on AD server but still gives error on TOS 6.0.783 SMB workgroup set incorrectly when trying to join Domain, it was working when on TOS 5.1 and earlier versions of TOS 6 please fix

[CursaYang]

I have same issue and SMB 1 is enabled on AD server but still gives error on TOS 6.0.783 SMB workgroup set incorrectly when trying to join Domain, it was working when on TOS 5.1 and earlier versions of TOS 6 please fix

We need to troubleshoot the issue remotely. Please go to the official website's live chat to schedule remote handling.

[cmicallef]

This seems a bug, not a config issue, same setup worked for months till upgraded to TOS 6.0.783 !!