This option is deprecated and will be removed in future, as it is a security problem if not set to "yes" (which will be the hardcoded behavior in future). Avoid using this option! Use explicit 'no' instead! Samba will log an error in the log files at log level 0 if legacy a client is rejected or allowed without an explicit, 'no' option for the client. The message will indicate the explicit 'no' line to be added, if the legacy client software requires it. (The log level can be adjusted with '1' in order to complain only at a higher log level). This allows admins to use "auto" only for a short grace period, in order to collect the explicit 'no' options. See CVE-2020-1472(ZeroLogon), https://bugzilla.samba.org/show_bug.cgi?id=14497. This option is over-ridden by the option. This option is over-ridden by the effective value of 'yes' from the '' and/or '' options. yes If you still have legacy domain members, which required "server schannel = auto" before, it is possible to specify explicit exception per computer account by using 'server require schannel:COMPUTERACCOUNT = no' as option. Note that COMPUTERACCOUNT has to be the sAMAccountName value of the computer account (including the trailing '$' sign). Samba will complain in the log files at log level 0, about the security problem if the option is not set to "no", but the related computer is actually using the netlogon secure channel (schannel) feature. (The log level can be adjusted with '1' in order to complain only at a higher log level). Samba will warn in the log files at log level 5, if a setting is still needed for the specified computer account. See CVE-2020-1472(ZeroLogon), https://bugzilla.samba.org/show_bug.cgi?id=14497. This option overrides the option. This option is over-ridden by the effective value of 'yes' from the '' and/or '' options. Which means 'no' is only useful in combination with 'no' server require schannel:LEGACYCOMPUTER1$ = no server require schannel seal:LEGACYCOMPUTER1$ = no server require schannel:NASBOX$ = no server require schannel seal:NASBOX$ = no server require schannel:LEGACYCOMPUTER2$ = no server require schannel seal:LEGACYCOMPUTER2$ = no