I upgraded A windows host from windows 10 to windows 11, and of course i could no longer authenticate.

Samba logs showed

[2022/10/02 15:48:24.186783,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: ENC-TS Pre-authentication succeeded -- Administrator@DOMAIN] using aes256-cts-hmac-sha1-96
[2022/10/02 15:48:24.186919,  3] ../../auth/auth_log.c:635(log_authentication_event_human_readable)
  Auth: [Kerberos KDC,ENC-TS Pre-authentication] user [(null)]\[Administrator@DOMAIN] at [Sun, 02 Oct 2022 15:48:24.186874 CEST] with [aes256-cts-hmac-sha1-96] status [NT_STATUS_OK] workstation [(
null)] remote host [ipv4:192.168.50.47:59182] became [DOMAIN]]\[Administrator] [S-1-5-21-3293602716-1359220633-1131700490-500]. local host [NULL] 
  {"timestamp": "2022-10-02T15:48:24.187054+0200", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4624, "logonId": "3be75b668c8b39de", "logonType": 3, "statu
s": "NT_STATUS_OK", "localAddress": null, "remoteAddress": "ipv4:192.168.50.47:59182", "serviceDescription": "Kerberos KDC", "authDescription": "ENC-TS Pre-authentication", "clientDomain": null, "clientA
ccount": "Administrator@DOMAIN]", "workstation": null, "becameAccount": "Administrator", "becameDomain": "DOMAIN]", "becameSid": "S-1-5-21-3293602716-1359220633-1131700490-500", "mappedAccount": "Ad
ministrator", "mappedDomain": "DOMAIN", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "p
asswordType": "aes256-cts-hmac-sha1-96", "duration": 10444}}
[2022/10/02 15:48:24.280991,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ authtime: 2022-10-02T15:48:24 starttime: unset endtime: 2022-10-03T01:48:24 renew till: 2022-10-09T15:48:24
[2022/10/02 15:48:24.281140,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Client supported enctypes: aes256-cts-hmac-sha1-96, arcfour-hmac-md5, -133, -128, 24, -135, using aes256-cts-hmac-sha1-96/aes256-cts-hmac-sha1-96
[2022/10/02 15:48:24.281273,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Requested flags: renewable-ok, canonicalize, renewable, forwardable
[2022/10/02 15:48:24.285839,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/02 15:48:24.293498,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed to verify authenticator checksum: Decrypt integrity check failed for checksum type rsa-md5, key type aes256-cts-hmac-sha1-96
[2022/10/02 15:48:24.293619,  3] ../../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: Failed parsing TGS-REQ from ipv4:192.168.50.47:59183
[2022/10/02 15:48:24.297725,  3] ../../source4/smbd/service_stream.c:67(stream_terminate_connection)
  stream_terminate_connection: Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
[2022/10/02 15:49:29.696239,  3] ../../source4/lib/socket/interface.c:91(add_interface)

I know NTLM /SMB1 is now disabled by default in windows 11, but i could not figure out how thats related.

in the end i found:

Cannot connect to Samba AD DC on Windows 11 Dev from windowsinsiders

The fast solution is

Local Security Policy> Local Policies> Security Options> Network security: Configure encryption types allowed for Kerberos Check only DES_CBC_CRC and DES_CBC_MD5

Apparently samba 4.16 also fixes it. But its not hit stable yet for debian.