Bug 13298 - Samba fails to join Active Directory with WERR_DNS_ERROR_RCODE_NAME_ERROR
Samba fails to join Active Directory with WERR_DNS_ERROR_RCODE_NAME_ERROR
Status: NEW
Product: Samba 4.1 and newer
Classification: Unclassified
x64 Linux
: P5 major
: ---
Assigned To: Andrew Bartlett
Samba QA Contact
Depends on:
  Show dependency treegraph
Reported: 2018-02-24 20:16 UTC by Carsten Menke
Modified: 2018-02-24 20:18 UTC (History)
0 users

See Also:

Trace of the Join Process (19.54 KB, text/plain)
2018-02-24 20:16 UTC, Carsten Menke
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Carsten Menke 2018-02-24 20:16:16 UTC
Created attachment 13980 [details]
Trace of the Join Process

We wanted to join a Windows Server 2003 AD as a DC, but Samba fails to join the DC with WERR_DNS_ERROR_RCODE_NAME_ERROR. We tested it with earlier versions and found out that it works perfectly with Samba 4.6.13, and Samba 4.5, however Samba 4.7.5 and up to 4.8.0rc3 fail. 

This setup is a little bit special so I will describe in Detail what we've done. We want to migrate a Windows Server 2003, this was installed in mixed mode initially years ago, we then bumped up the Schema to 2003. As the naming design was not good chosen we also needed to do a domain rename procedure on the 2003 DC. dcdiag and repadmin showed no errors before the renaming and do also not show errors after the rename. After the rename Windows Clients can join the domain without problems.

We've already read that setting ms-DS-ReplicationEpoch = 0 is required, which we've done with ADSIEDIT after the rename.

With Samba < 4.7 we are able to join the domain, with Samba >= 4.7 the join fails.
I've tested that the join proceeds before the domain rename with all versions. 

I substituted the Real domain Name by "example" for disclosure reasons in this bug report.

Domain before rename was: example.local, Workgroup: EXAMPLE
this was renamed to:
Domain: intranet.example.com, Workgroup: INTRANET

DNS is working correctly, all references are updated to the new settings netdiag shows now errors.

I'll attach a Debug level 5 trace to this report, setting the debug level higher does not give more information as the failing part does not getting more verbose and the error message remains the same.

I've got a copy of the server 2003 before the rename as a virtual machine so I'm able to help and test things.

We used the Sernet Packages for CentOS 7.4
Comment 1 Carsten Menke 2018-02-24 20:18:57 UTC
Sorry it is Debug Level 3, however raising the level does not contain more informations on before or after the line, so I don't have even an idea *why* the join fails (even tested with Debug Level 9 this does not show the real reason

Join failed - cleaning up