So no one else wastes a couple of hours of their lives wondering why ntlm_auth is failing due to what appear to be permissions issue.

In the version of samba4 installed with Ubuntu 14.04 (4.1.6) the default location of the winbinddd_privileged directory appears to be /var/lib/samba.

The upstart script however, still has it in /var/run/samba/ (it may have changed), and does a lovely job of masking the problem by creating the winbindd_privileged directory there on start:

pre-start script
        test -x /usr/sbin/winbindd || exit 0
        mkdir -p /var/run/samba/winbindd_privileged
        chgrp winbindd_priv /var/run/samba/winbindd_privileged
        chmod 0750 /var/run/samba/winbindd_privileged
end script

Special shout outs go to the samba project for writing a utility with the most useless debugging output ever:

Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)'
(57)    mschap : External script failed
(57)    ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001)
(57)    ERROR: mschap : MS-CHAP2-Response is incorrect

and whoever decided to disable the init.d script on upstart enabled systems by adding:

case "$1" in
        start)
                if init_is_upstart; then
                        exit 1
                fi

Lovely.

Bug reported here for winbindd_privileged:
https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1330220

Arran Cudbard-Bell <a.cudbardb@freeradius.org>

FreeRADIUS Development Team

FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html