When accessing Samba shares from Windows 10, smbstatus is reporting duplicate nobody:nogroup PID entries

When I run Windows programs located on a Samba share from a Windows 10 Pro 64 computer I get duplicate nobody:nogroup PID entries appearing in the smbstatus output. These entries do not go away until the smbd process is terminated. I have noted that on my production servers, it can take several minutes for files created by a Windows 7 user to be visible by other Windows 7 users. When I remove the Windows 10 computers from my network, the issue goes away.

I am running Samba Version 4.1.6-Ubuntu on Ubuntu 14.04.1 LTS. I have tried Ubuntu 14.04.3 LTS and Ubuntu 15.10 server and the same issue occurs. The computers I am using are as follows:

192.1.1.38 - CONSULTING5 - Windows 8.1 Pro
192.1.1.41 - CONSULTING7 - Windows 10 Pro
192.1.1.42 - CONSULTING8 - Ubuntu Server 14.04.1

The smbstatus output below was produced by running windows notepad three times from a samba network share. This was done from a Windows 8.1 computer and a Windows 10 computer. The output typically grows to 1000+ lines after a typical day of usage on the Windows 10 machine.

Samba version 4.1.6-Ubuntu
PID     Username      Group         Machine                        
-------------------------------------------------------------------
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1445      win81user     win81user     192.1.1.38   (ipv4:192.1.1.38:50422)
1444      win10user     win10user     192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)
1444      nobody        nogroup       192.1.1.41   (ipv4:192.1.1.41:53486)

Service      pid     machine       Connected at
-------------------------------------------------------
aaa          1444   192.1.1.41    Thu Jan  7 12:29:31 2016
aaa          1445   192.1.1.38    Thu Jan  7 12:29:53 2016

Locked files:
Pid          Uid        DenyMode   Access      R/W        Oplock           SharePath   Name   Time
--------------------------------------------------------------------------------------------------
1444         1003       DENY_NONE  0x100081    RDONLY     NONE             /mnt/aaa   .   Thu Jan  7 12:29:31 2016
1445         1002       DENY_NONE  0x100081    RDONLY     NONE             /mnt/aaa   .   Thu Jan  7 12:29:52 2016

I have tried many different samba configuration options and yet the issue remains. I have reverted to the default ubuntu smb.conf as shown below with the addition of a single share definition. The guest ok = yes and guest ok = no options do not fix this.

[global]
    server string = %h server (Samba, Ubuntu)
    server role = standalone server
    map to guest = Bad User
    obey pam restrictions = Yes
    pam password change = Yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    unix password sync = Yes
    syslog = 0
    log file = /var/log/samba/log.%m
    max log size = 1000
    dns proxy = No
    usershare allow guests = Yes
    panic action = /usr/share/samba/panic-action %d
    idmap config * : backend = tdb
[printers]
    comment = All Printers
    path = /var/spool/samba
    create mask = 0700
    printable = Yes
    print ok = Yes
    browseable = No
[print$]
    comment = Printer Drivers
    path = /var/lib/samba/printers
[aaa]
    comment = aaa test share
    path = /mnt/aaa
    read only = No

My apologies in advance but since I have no reputation on this site I am unable to post more than two links. Please find links to the Samba log files for the share mount and notepad execution with log level 3 below. I have also provided lsof output for the Windows 8.1 smbd process and the Windows 10 smbd process.

http://pastebin.com/L8HdZAA1 - log.nmbd
http://pastebin.com/TEbWaB7n - log.smbd
http://pastebin.com/UAmk0tZG - log.192.1.1.38  (Windows 8.1)
http://pastebin.com/wtfB5udx - log.consulting5 (Windows 8.1)
http://pastebin.com/0bAhNqum - log.192.1.1.41  (Windows 10)
http://pastebin.com/zCKsASR0 - log.consulting7 (Windows 10)

http://pastebin.com/1wmFVAjC - lsof-win81process.txt
http://pastebin.com/DyzUF3LS - lsof-win10process.txt

Any help in resolving this issue would be greatly appreciated. Thank you.

Solution 1:

It seems to be a problem with SambaV2/V3 and can be avoided forcing Windows 10 to use SambaV1 via

sc config lanmanworkstation depend= bowser/mrxsmb10/nsi
sc config mrxsmb20 start= disabled

see:
https://groups.google.com/forum/#!topic/spline.eisfair/vtxTbxKVy1Q https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1392647

When accessing Samba shares from Windows 10, smbstatus is reporting duplicate nobody:nogroup PID entries

Solution 1:

Related

Recent Posts