Comment 47 for bug 1993934

Anyone having login issues even after applying this fix please read this:
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/linux-accounts-cannot-get-aes-tickets

It may be your Samba host's LDAP entry operatingSystemVersion attribute causing this.
Numerical values less than 6 are interpreted as "not AES capable OS" by recent Windows updates.
Change value "4.x.x" to "Samba 4.x.x" and reboot Windows machine. Did the trick for me.