Bug 9429 - Unable to demote Windows Server
Summary: Unable to demote Windows Server
Status: NEW
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.0.0rc5
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
Depends on:
Reported: 2012-11-24 21:50 UTC by Thomas Simmons
Modified: 2015-07-31 08:19 UTC (History)
3 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Simmons 2012-11-24 21:50:05 UTC
I am unable to demote Windows DCs that are also acting as DNS servers. To be clear, this only occurs if the Windows Server is also a DNS server. The problem appears to be that the 2008R2 server fails replicating data back to the S4 DC during the demotion. The specific error that I receive on the Windows server when running "dcpromo" is:

The operation failed because:

Active Directory Domain Services could not transfer the remaining data in the directory partition CN=Schema,CN=Configuration,DC=internal,DC=testdom,DC=com to
Active Directory Domain Controller adc1.internal.testdom.com

I receive the following when trying to replicate using samba-tool (adc1=S4rc5 adc2=2008R2):

[root@ADC1 etc]# samba-tool drs replicate adc1 adc2 CN=Schema,CN=Configuration,DC=internal,DC=testdom,DC=com -U Administrator
Password for [TESTDOM\Administrator]:
ERROR(<class 'samba.drs_utils.drsException'>): DsReplicaSync failed - drsException: DsReplicaSync failed (2, 'WERR_BADFILE')
  File "/usr/local/samba/lib64/python2.6/site-packages/samba/netcmd/drs.py", line 334, in run
    drs_utils.sendDsReplicaSync(self.drsuapi, self.drsuapi_handle, source_dsa_guid, NC, req_options)
  File "/usr/local/samba/lib64/python2.6/site-packages/samba/drs_utils.py", line 83, in sendDsReplicaSync
    raise drsException("DsReplicaSync failed %s" % estr)

Replication from adc1 to adc2 works:

[root@ADC1 etc]# samba-tool drs replicate adc2 adc1 CN=Schema,CN=Configuration,DC=internal,DC=testdom,DC=com -U Administrator                                                                        Password for [TESTDOM\Administrator]:
Replicate from adc1 to adc2 was successful.

This problem is consistent and can be reproduced as follows (tested on Ubuntu 12.04LTS and CentOS 6.3):

1) Provision S4rc5 (clean or classicupgrade)
2) Join a Windows Server to the domain (I used 2008R2)
3) Promote the Windows Server to function as AD DC + DNS Server via "dcpromo".
4) Attempt to demote the Windows Server via "dcpromo".
Comment 1 Stefan Metzmacher 2013-08-29 07:09:45 UTC
No 4.1 blocker => 4.2
Comment 2 Karolin Seeger 2013-12-10 15:41:23 UTC
Any news on this one?