Problem: DC1 is lost. On DC2 you try to seize the roles. All work, only the naming role fails: [root@DC2 ~]# samba-tool fsmo seize --role=rid Attempting transfer... Transfer unsuccessful, seizing... FSMO seize of 'rid' role successful [root@DC2 ~]# samba-tool fsmo seize --role=pdc Attempting transfer... Transfer unsuccessful, seizing... FSMO seize of 'pdc' role successful [root@DC2 ~]# samba-tool fsmo seize --role=infrastructure Attempting transfer... Transfer unsuccessful, seizing... FSMO seize of 'infrastructure' role successful [root@DC2 ~]# samba-tool fsmo seize --role=schema Attempting transfer... Transfer unsuccessful, seizing... FSMO seize of 'schema' role successful [root@DC2 ~]# samba-tool fsmo seize --role=naming Attempting transfer... ERROR(ldb): uncaught exception - Failed FSMO transfer: WERR_CONNECTION_REFUSED File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/__init__.py", line 175, in _run return self.run(*args, **kwargs) File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/fsmo.py", line 160, in run self.seize_role(role, samdb, force) File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/fsmo.py", line 126, in seize_role transfer_role(self.outf, role, samdb) File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/fsmo.py", line 53, in transfer_role samdb.modify(m)
Workaround: If you force the seize command, it works: # samba-tool fsmo seize --role=naming --force Will not attempt transfer, seizing... FSMO seize of 'naming' role successful
in /usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py there is an extra call to samdb.modify(m) in the "naming" part of the if statement. Removing the call will fix the issue def transfer_role(outf, role, samdb): m = ldb.Message() m.dn = ldb.Dn(samdb, "") if role == "rid": m["becomeRidMaster"]= ldb.MessageElement( "1", ldb.FLAG_MOD_REPLACE, "becomeRidMaster") elif role == "pdc": domain_dn = samdb.domain_dn() res = samdb.search(domain_dn, scope=ldb.SCOPE_BASE, attrs=["objectSid"]) assert len(res) == 1 sid = res[0]["objectSid"][0] m["becomePdc"]= ldb.MessageElement( sid, ldb.FLAG_MOD_REPLACE, "becomePdc") elif role == "naming": m["becomeDomainMaster"]= ldb.MessageElement( "1", ldb.FLAG_MOD_REPLACE, "becomeDomainMaster") samdb.modify(m) <--------------- remove elif role == "infrastructure": m["becomeInfrastructureMaster"]= ldb.MessageElement( "1", ldb.FLAG_MOD_REPLACE, "becomeInfrastructureMaster") elif role == "schema": m["becomeSchemaMaster"]= ldb.MessageElement( "1", ldb.FLAG_MOD_REPLACE, "becomeSchemaMaster") else: raise CommandError("Invalid FSMO role.") try: samdb.modify(m) except LdbError, (num, msg): raise CommandError("Failed to initiate transfer of '%s' role: %s" % (role, msg)) outf.write("FSMO transfer of '%s' role successful\n" % role)
Created attachment 10799 [details] s4.2/fsmo.py: fixed fsmo transfer exception
Comment on attachment 10799 [details] s4.2/fsmo.py: fixed fsmo transfer exception This looks good Reviewed-by: Stefan Metzmacher <metze@samba.org> it just need a 2nd review and a Signed-off-by: tag as well as a "Bug: https://bugzilla.samba.org/show_bug.cgi?id=10924" line
Created attachment 10873 [details] Patch for master Patch looks good to me and I've tested it (works). I've re-attached the patch with Stefans + my Reviewed-By tag, Signed-Off tag + link to this bug report. If it's fine, Stefan, can you please push it to autobuild? Thanks.
I have two samba 4.1.17 servers with the same problem: [root@dc1 /]# samba-tool fsmo transfer --role=naming ldb_wrap open of secrets.ldb ERROR(ldb): uncaught exception - Failed FSMO transfer: WERR_CONNECTION_REFUSED File "/usr/local/lib/python2.7/site-packages/samba/netcmd/__init__.py", line 175, in _run return self.run(*args, **kwargs) File "/usr/local/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line 268, in run transfer_role(self.outf, role, samdb) File "/usr/local/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line 53, in transfer_role samdb.modify(m) All other roles seized fine. Force seize command is deprecated in 4.1.17 as I thought. [root@dc1 /]# samba-tool fsmo transfer --role=naming --force Usage: samba-tool fsmo transfer [options] samba-tool fsmo transfer: error: no such option: --force
Created attachment 11112 [details] Patch for v4-2-test
Created attachment 11113 [details] Patch for v4-1-test
Pushed to autobuild-v4-[1|2]-test.
(In reply to Karolin Seeger from comment #9) Pushed to v4-2-test. autobuild-v4-1-test failed, re-trying.
(In reply to Karolin Seeger from comment #10) Pushed to v4-1-test. Closing out bug report. Thanks!