topic Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS in Network and Storage Protocols

Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

ritchi641 — Thu, 05 Jun 2025 06:23:04 GMT

We have a few filers who give us the following error periodicaly since we upgrade our Active Directory machine to a Windows 2008R2 (SP1) server.

Wed Jul 11 15:31:29 EDT [LABFILER01: cifs.server.infoMsg:info]: CIFS: Warning for server \\SE601C: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS.

We found out that this error message occur if SMB2 is enable on the filler (options cifs.smb2.enable on, cifs.smb2.client.enable on). We add to enable this 1 year ago becose of new Windows 7 clients.

The error message disappear if we disable SMB2 in our Windows 2008R2 server or in the filer.

Ontap 7.3.4 or 8.0.2P3 7-Mode

Any Idee to resolve this without disabling SMB2 ?

Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

aborzenkov — Thu, 12 Jul 2012 05:42:51 GMT

For client - NetApp communication option cifs.smb2.enable is relevant. IIRC option cifs.smb2.client.enable is for NetApp - domain controller communication. So you still should be able to enable SMB2 for clients.

Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

ritchi641 — Thu, 12 Jul 2012 13:29:11 GMT

Hi, thanks for you fast reply,

If disabling ( cifs.smb2.client.enable ) is only affecting communication for the filer to the DC and don't affect the client (Windows 7) in any way. I will give it a try.

I am a Nseries user. Can you put a cut an paste here of that Now link information ?

http://support.netapp.com/NOW/cgi-bin/bol?Type=Detail&Display=474548

Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

aborzenkov — Thu, 12 Jul 2012 13:33:23 GMT

Title:

Domain Controller responds with 0xc0000022 (Access Denied) error to SMB2 tree connect request from the storage server on IPC$.

Description:

This issue might occur under the following circumstances:

1. The storage server sends an SMB2 session setup request with signing required, regardless of the setting of the option smb2.signing.required.

2. The domain controller returns a signed session setup response.

3. The storage server sends an unsigned tree connect request to IPC$.

4. The domain controller refuses the unsigned request and responds with a 0xc0000022 error (Access Denied).

Workaround:

Disable SMB2 on the storage server by entering the following command:

options cifs.smb2.client.enable off

Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

jjardina_dtech — Thu, 12 Jul 2012 16:47:11 GMT

1) Is your local to the filer, DC an RODC? If so, you have to use the "option ldap.servers.preferred" to specify a non-RODC or change the local AD to be a GC.

2) If possible, update your OnTap to the latest general release for your filer. The two versions you cite are quite old.

See if issue still persists and if so, you may have to options cifs.smb2.client.enable off until fixed.

Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

ritchi641 — Thu, 12 Jul 2012 17:43:21 GMT

Thank you very much!

It help a lot!!!

I think my problem is solve.

I will let it run and see after a week if everyting is ok!

Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

ritchi641 — Thu, 12 Jul 2012 18:39:51 GMT

hi again,

I also get this error in my filers syslog since we upgrade our DC to W2K8R2:

Sun Jul 8 17:43:38 EDT cifs.pipe.errorMsg: CIFS: Error on named pipe with SE601S: Error connecting to server, open pipe failed

Sun Jul 8 17:43:38 EDT smbrpc.pipeCreate.fail: CIFSRPC: Attempt to create pipe LSA for LsarLookupSids failed with error 0xc000005e.

Do you think it's related to the same SMB2 problem?

Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

thomas_glodde — Fri, 13 Jul 2012 05:32:22 GMT

Did you guys try an "options cifs.netbios_over_tcp.enable off"?

Re: Unable to create NETLOGON pipe No Trusted Logon Servers Available - STATUS_NO_LOGON_SERVERS

STORAGE_CIT — Wed, 18 Jul 2012 12:59:09 GMT

It seems you´re facing the OnTap Weakness which is (amongst others) described in BURT 470972

The point is, that OnTap is using a security leak in the smb2-Implementation of Microsoft, which was fixed by some Patches for SMB2 Win2003/2008:

A Kerberos Ticket has a default lifetime of 10 hours. When this Ticket expires, the CIFS Sessions based upon this Ticket must become invalid and the Kerberos-Client (aka Netapp Filer) must request a new ticket and a also a new CIFS Session.

But until now, OnTap is still not able to handle this prodecure correctly, meaning to say pro-actively.

Before Microsoft fixed it, a SMB2-Session wrongly remained active when the Kerberos-Ticket expired.

SMB1 still has this bug, therefore the described workaround (options cifs.smb2.client.enable off => Fallback to SMB1) solves the issue (until Microsoft patches this as well...)

The underlying OnTap Weakness will be corrected in OnTap 8.0.4 and 8.1.2 (just in time for the relase of SMB3 ...;-)