Bug 10265 - Samba 4.1 supports to join Windows 2012 server as a secondary DC??
Summary: Samba 4.1 supports to join Windows 2012 server as a secondary DC??
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.1.1
Hardware: x64 Linux
: P5 enhancement (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
Depends on:
Reported: 2013-11-12 22:38 UTC by Maximiliano Beltritti
Modified: 2015-07-31 08:28 UTC (History)
2 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Maximiliano Beltritti 2013-11-12 22:38:03 UTC
After compiling samba 4.1 in an ubuntu server I try to join to a Windows 2012 server and get this error:

root@samba41:~/compilar/samba-4.1.0# /root/compilar/samba-4.1.0/bin/samba-tool domain join zentyal.it.com DC -Uadministrator --realm=zentyal.it.com
Finding a writeable DC for domain 'zentyal.it.com'
Found DC win2k12.zentyal.it.com
Password for [WORKGROUP\administrator]:
workgroup is ZENTYAL
realm is zentyal.it.com
checking sAMAccountName
Adding CN=SAMBA41,OU=Domain Controllers,DC=zentyal,DC=it,DC=com
Adding CN=SAMBA41,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zentyal,DC=it,DC=com
Adding CN=NTDS Settings,CN=SAMBA41,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zentyal,DC=it,DC=com
DsAddEntry failed with status (5, 'WERR_ACCESS_DENIED') info (8567, 'WERR_DS_INCOMPATIBLE_VERSION')
Join failed - cleaning up
checking sAMAccountName
Deleted CN=SAMBA41,OU=Domain Controllers,DC=zentyal,DC=it,DC=com
Deleted CN=SAMBA41,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=zentyal,DC=it,DC=com
ERROR(runtime): uncaught exception - DsAddEntry failed
  File "bin/python/samba/netcmd/__init__.py", line 175, in _run
    return self.run(*args, **kwargs)
  File "bin/python/samba/netcmd/domain.py", line 552, in run
    machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
  File "bin/python/samba/join.py", line 1169, in join_DC
  File "bin/python/samba/join.py", line 1072, in do_join
  File "bin/python/samba/join.py", line 541, in join_add_objects
  File "bin/python/samba/join.py", line 474, in join_add_ntdsdsa
  File "bin/python/samba/join.py", line 437, in DsAddEntry
    raise RuntimeError("DsAddEntry failed")
Comment 1 Arvid Requate 2014-06-02 16:04:05 UTC
Looks like it's necessary to manually lower the domain and forest functional levels on the Windows 2012 server first, via Powershell:

Set-ADForestMode -Identity "mydom.local" -ForestMode Windows2008R2Forest
Set-ADDomainMode -Identity "mydom.local" -DomainMode Windows2008R2Domain

With these settings at least the domain join of a samba 4.1 with a W2k12 DC worked for me.
Comment 2 Björn Jacke 2014-06-04 12:02:20 UTC
samba as an AD DC together with MS AD DCs is not supported. First of all we miss sysvol replication, other things might also be missing. This is not a supported setup currently.
Comment 3 Andrew Bartlett 2014-06-04 20:30:46 UTC
This is a valid bug, and pending time these issues can and should be addressed.

Some aspects will be easier than others, but this isn't a WONTFIX.


Feel free to discuss this with my offline if you need further clarification.


Andrew Bartlett
Comment 4 Björn Jacke 2014-06-11 12:57:27 UTC
if you want to keep bug reports of unsupported features as enhancement / TODO issues, you should set the title and the importance of those bugs accordingly then
Comment 5 Christian Möllering 2014-09-10 15:07:44 UTC
Is there any roadmap, when this feature: join samba as an DC in a MS AD - may be integrated?
Comment 6 Stefan Metzmacher 2014-09-10 20:04:26 UTC
(In reply to comment #5)
> Is there any roadmap, when this feature: join samba as an DC in a MS AD - may
> be integrated?

Implementing the sysvol replication is a lot of work, so its unlikely to be ready before 4.4.0 unless someone sponsors the work.