# Samba Problem after MS Security Update for AD Controllers

**URL:** <https://forums.suse.com/t/samba-problem-after-ms-security-update-for-ad-controllers/45694>\
**Category:** SLES Networking\
**Created:** [July 10, 2025, 7:21pm UTC](https://forums.suse.com/t/samba-problem-after-ms-security-update-for-ad-controllers/45694 "2025-07-10T19:21:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![WoTo3105](https://avatars.discourse-cdn.com/v4/letter/w/a183cd/32.png) [@WoTo3105](https://forums.suse.com/u/WoTo3105)\
**Post date:** [July 10, 2025, 7:21pm UTC](https://forums.suse.com/t/samba-problem-after-ms-security-update-for-ad-controllers/45694/1 "2025-07-10T19:21:01Z")

</div>

## Release Note for Samba 4.22.3: "Important Change in Upcoming Microsoft Update

On 8th of July, Microsoft will release an important security update for  
Active Directory Domain Controllers for Windows Server versions prior to  
2025.

This update includes a change to the Microsoft RPC Netlogon protocol,  
which improves security by tightening access checks for a set of RPC  
requests. Samba running as domain members in these environments will be  
impacted by this change if a specific configuration is used, see below  
for which configuration is affected.

Windows Server version 2025 is already equipped with these specific  
security hardenings, and Microsoft is now planning to deploy them to all  
supported Windows Server versions down to Windows Server 2008.

Who is affected?

Samba installations acting as member servers in Windows AD domains will  
be affected if they are configured to use the ‘ad’ idmapping backend.  
Samba servers not using this configuration will not be affected by the  
change – at least to our current knowledge and understanding of the  
change – and no further action is required.

Current versions of Samba with the affected configuration will no longer  
function correctly once the Microsoft update has been applied. Users  
will not be able to connect to the SMB service provided by Samba for any  
domain configured to use the ‘ad’ idmapping backend."

We use this idmapping backend in SLES15 SP5.  
Is there a corresponding update for SLES15.

---

<div class="post-metadata">

**Author:** ![chamilton](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/chamilton/32/12078_2.png) [@chamilton](https://forums.suse.com/u/chamilton)\
**Post date:** [July 17, 2025, 3:03pm UTC](https://forums.suse.com/t/samba-problem-after-ms-security-update-for-ad-controllers/45694/2 "2025-07-17T15:03:26Z")

</div>

To get a fix you’d either need to have LTSS and patch (SP5 is out of general support) or you’d need to upgrade to SLE 15 SP6 or SLE 15 SP7. The fixes for this were just released today:

- SLE 15 SP5 LTSS: samba-4.17.12+git.505.583145e10d1-150500.3.31.2
- SLE 15 SP6: samba-4.19.8+git.430.a10fe64854c-150600.3.18.2
- SLE 15 SP7: samba-4.21.6+git.493.f39e13aba14-150700.3.6.1
- OpenSUSE Leap 15.6: samba-4.19.8+git.430.a10fe64854c-150600.3.18.2

HTH

---

<div class="post-metadata">

**Author:** ![WoTo3105](https://avatars.discourse-cdn.com/v4/letter/w/a183cd/32.png) [@WoTo3105](https://forums.suse.com/u/WoTo3105)\
**Post date:** [July 23, 2025, 9:00am UTC](https://forums.suse.com/t/samba-problem-after-ms-security-update-for-ad-controllers/45694/3 "2025-07-23T09:00:58Z")

</div>

After updating to SLES15 SP7, I installed the latest Samba fixes. Everything is working fine.  
Thank you for your support.