Bug 9565 - Adding additional Samba 4.0 DC to W2k8 srv AD domain (in win200 functional level) produces dbcheck errors
Summary: Adding additional Samba 4.0 DC to W2k8 srv AD domain (in win200 functional le...
Status: RESOLVED DUPLICATE of bug 9597
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.0.0
Hardware: x64 Linux
: P5 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-01-15 15:40 UTC by Chris Lewis (dead mail address)
Modified: 2013-01-28 08:26 UTC (History)
1 user (show)

See Also:

Attachments
patches cherry-picked from master (1.85 KB, patch)
2013-01-27 20:36 UTC, Andrew Bartlett 		metze: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Lewis (dead mail address) 2013-01-15 15:40:06 UTC 
A samba 4.0 server is added an additional to a AD domain in windows 2000 functional level. DNS is provided by existing bind servers.

samba-tool domain join inview.local DC -U clewis  -W INVIEW --dns-backend=NONE

output:
Setting account password for INVIEW-DC2$
Enabling account
Calling bare provision
No IPv6 address will be assigned
Provision OK for domain DN DC=inview,DC=local
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=inview,DC=local] objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=inview,DC=local] objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=inview,DC=local] objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=inview,DC=local] objects[1608] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=inview,DC=local] objects[2010] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=inview,DC=local] objects[2412] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=inview,DC=local] objects[2636] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=inview,DC=local] objects[402] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[804] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[1206] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[1608] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[2010] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[2412] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[2735] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[2873] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[3008] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[3144] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[3453] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[3855] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[4257] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[4631] linked_values[0]
Partition[CN=Configuration,DC=inview,DC=local] objects[4701] linked_values[0]
Replicating critical objects from the base DN of the domain
Partition[DC=inview,DC=local] objects[101] linked_values[0]
Partition[DC=inview,DC=local] objects[346] linked_values[0]
Partition[DC=inview,DC=local] objects[487] linked_values[0]
Partition[DC=inview,DC=local] objects[636] linked_values[0]
Partition[DC=inview,DC=local] objects[756] linked_values[0]
Done with always replicated NC (base, config, schema)
Committing SAM database
descriptor_sd_propagation_recursive: DC=DomainDnsZones,DC=inview,DC=local not found under DC=inview,DC=local
descriptor_sd_propagation_recursive: DC=ForestDnsZones,DC=inview,DC=local not found under DC=inview,DC=local
Sending DsReplicateUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain INVIEW (SID S-1-5-21-4149485512-2772067854-3362118187) as a DC


errors produced on all objects when

samba-tool dbcheck

was run:

ERROR: wrong instanceType 4 on CN=INVIEW-DC2,OU=Domain Controllers,DC=inview,DC=local, should be 0
Not changing instanceType from 4 to 0 on CN=INVIEW-DC2,OU=Domain Controllers,DC=inview,DC=local
ERROR: wrong instanceType 4 on CN=Domain System Volume (SYSVOL share),CN=NTFRS Subscriptions,CN=INVIEW-DC1,OU=Domain Controllers,DC=inview,DC=local, should be 0
Not changing instanceType from 4 to 0 on CN=Domain System Volume (SYSVOL share),CN=NTFRS Subscriptions,CN=INVIEW-DC1,OU=Domain Controllers,DC=inview,DC=local


Also symptomatic:

samba-tool drs showrepl only shows information for the following namespacess:

samba-tool drs showrepl
Default-First-Site-Name\INVIEW-DC2
DSA Options: 0x00000001
DSA object GUID: a7ffb10c-826e-459e-9959-480847790cc5
DSA invocationId: 82e59ee0-222c-4a28-82c5-d926918aa49e

==== INBOUND NEIGHBORS ====

DC=ForestDnsZones,DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 09:50:27 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 09:50:27 2013 GMT

DC=DomainDnsZones,DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 09:50:27 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 09:50:27 2013 GMT

==== OUTBOUND NEIGHBORS ====

==== KCC CONNECTION OBJECTS ====

Connection --
	Connection name: f94ea998-b5de-4069-a06d-8dd1a22c192b
	Enabled        : TRUE
	Server DNS name : INVIEW-DC1.inview.local
	Server DN name  : CN=NTDS Settings,CN=INVIEW-DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=inview,DC=local
		TransportType: RPC
		options: 0x00000001
Warning: No NC replicated for Connection!

Other than the above, the server appears to function normally. i.e. it can authenticate logins, and objects created on it, appear on its replication partner, and vice versa.


If the domain functional level is raised to windows 2003 server, and the same process followed, we see no errors in samba-tool dbcheck and all namespaces are mentioned in samba-tool drs showrepl thus:

Default-First-Site-Name\INVIEW-DC2
DSA Options: 0x00000001
DSA object GUID: 9f7b6201-cd1c-40dc-b930-f826cf9cad82
DSA invocationId: 70ec0850-684b-42e4-ad4b-ff23686ee424

==== INBOUND NEIGHBORS ====

DC=DomainDnsZones,DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 15:35:04 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 15:35:04 2013 GMT

DC=ForestDnsZones,DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 15:35:04 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 15:35:04 2013 GMT

CN=Schema,CN=Configuration,DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 15:35:06 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 15:35:06 2013 GMT

CN=Configuration,DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 15:35:06 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 15:35:06 2013 GMT

DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 15:35:06 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 15:35:06 2013 GMT

==== OUTBOUND NEIGHBORS ====

CN=Schema,CN=Configuration,DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 11:02:34 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 11:02:34 2013 GMT

CN=Configuration,DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 11:02:34 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 11:02:34 2013 GMT

DC=inview,DC=local
	Default-First-Site-Name\INVIEW-DC1 via RPC
		DSA object GUID: 8be331d4-be37-43d6-9593-2ea1d095d504
		Last attempt @ Tue Jan 15 11:12:44 2013 GMT was successful
		0 consecutive failure(s).
		Last success @ Tue Jan 15 11:12:44 2013 GMT

==== KCC CONNECTION OBJECTS ====

Connection --
	Connection name: c3c2ed9e-adb7-4e82-8ede-5e894b004e38
	Enabled        : TRUE
	Server DNS name : INVIEW-DC1.inview.local
	Server DN name  : CN=NTDS Settings,CN=INVIEW-DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=inview,DC=local
		TransportType: RPC
		options: 0x00000001
Warning: No NC replicated for Connection!
Comment 1 Andrew Bartlett 2013-01-27 20:36:44 UTC 
Created attachment 8503 [details]
patches cherry-picked from master
Comment 2 Stefan Metzmacher 2013-01-27 21:49:43 UTC 
Comment on attachment 8503 [details]
patches cherry-picked from master

Looks good
Comment 3 Stefan Metzmacher 2013-01-28 08:26:10 UTC 

*** This bug has been marked as a duplicate of bug 9597 ***