SMB: "This user can't sign in because this account is currently disabled"

[ezekiel.incorrigible]

When I try and access the SMB share, I get "This user can't sign in because this account is currently disabled" but the same user is able to ssh in. The user ('accountsvol') is in the group ('accountsvol') that owns the dataset being shared, the user is also owner of the share. If I allow guest access on the share then it allows me passwordless access, as expected. Furthermore, if I create a new user ('testuser') with identical configuration (as far as I can tell - none of the boxes ticked - the group is both a primary and auxialliary group) and add that new user to the group ('accountsvol'), it is able to access the share as expected. There is a large number of existing users that I created previously using the WebGUI that I would prefer not to have to delete and recreate from scratch (it'll take hours, plus I really want to understand this problem) what on earth could be going on?

FreeNAS 11-u5, Windows 10 client (also tested also on a macOS client - tried restrating SMB, FreeNAS and the clients multiple times, made no difference)

- There are about 40 users, all apparently disabled in the same way as above in such a way as to be able to access ssh but unable to access shares - deleting the user and recreating them fixes the problem - but.... is there a simpler way?.... why?

 

[anodos]

Are these local users, post output of pdbedit -v <username> for the affected user.

 

[ezekiel.incorrigible]

These are users created on the FreeNAS share.. is that local? There's no directory service or anything.

Code:

*This user works as expected*
root@freenas_server:/mnt/main_share_vol # pdbedit -v accounts
Unix username:		accounts
NT username:		 
Account Flags:		[U		  ]
User SID:			 S-1-5-21-2081728029-3531873654-3478107161-1005
Primary Group SID:	S-1-5-21-2081728029-3531873654-3478107161-513
Full Name:			accounts
Home Directory:	   \\freenas_server\accounts
HomeDir Drive:	   
Logon Script:		 
Profile Path:		 \\freenas_server\accounts\profile
Domain:			   FREENAS_SERVER
Account desc:		 
Workstations:		 
Munged dial:		 
Logon time:		   0
Logoff time:		  9223372036854775807 seconds since the Epoch
Kickoff time:		 9223372036854775807 seconds since the Epoch
Password last set:	Mon, 27 Aug 2018 18:34:50 BST
Password can change:  Mon, 27 Aug 2018 18:34:50 BST
Password must change: never
Last bad password   : 0
Bad password count  : 0
Logon hours		 : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF


*this user does not work as expected - attempts to access the share are met with reports that the account is disabled*
root@freenas_server:/mnt/main_share_vol # pdbedit -v adminvol
Unix username:		adminvol
NT username:		 
Account Flags:		[DU		 ]
User SID:			 S-1-5-21-2081728029-3531873654-3478107161-3032
Primary Group SID:	S-1-5-21-2081728029-3531873654-3478107161-513
Full Name:			admin volunteer
Home Directory:	   \\freenas_server\adminvol
HomeDir Drive:	   
Logon Script:		 
Profile Path:		 \\freenas_server\adminvol\profile
Domain:			   FREENASBACKUP
Account desc:		 
Workstations:		 
Munged dial:		 
Logon time:		   0
Logoff time:		  9223372036854775807 seconds since the Epoch
Kickoff time:		 9223372036854775807 seconds since the Epoch
Password last set:	Tue, 14 Aug 2018 19:29:46 BST
Password can change:  Tue, 14 Aug 2018 19:29:46 BST
Password must change: never
Last bad password   : 0
Bad password count  : 0
Logon hours		 : FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

 

[anodos]

Yeah, if you look at the line Account Flags: [DU ], the "D" means "Disabled".

You can fix this by removing the "Disabled" flag. pdbedit -c "[]" adminvol

 

[ezekiel.incorrigible]

Thanks! Do you have any idea how this could have happened? I just created these users in the webgui, exported the config and imported them. Is that process of exporting and importing supposed to disable all users?