samba - Jun 2015 - Possible brainsplit

Hello,
I have a problem with my samba4 domain cluster:
there are 2 machines, - primary and secondary server.
Everything was working fine, but i had a hard drive failure on primary PDC,
so i reinstalled and restored a backup to it.
Aftrwards i saw the warning about never restoring database from backups.
Now I have the following problems:
users can login and all group policies are provided, but that's only for a
computers, who were added to domain before crash.
New computers cant get group policies from domain (also users can't). Debug
log states that:
DOMAIN\PC20$] FAILED with error NT_STATUS_INTERNAL_DB_CORRUPTION
What would be the solution? Would demoting and adding secondary DC back
solve this?
Thank you.

Hello,

Am 18.06.2015 um 18:31 schrieb Tadas:
> I have a problem with my samba4 domain cluster:
> there are 2 machines, - primary and secondary server.
> Everything was working fine, but i had a hard drive failure on primary PDC,
> so i reinstalled and restored a backup to it.
If you're having an Active Directory, you should forget the terms
"primary" or "PDC". It confuses, because these are terms
from NT4 domain
environments. In an AD you're having just DC(s). See
https://wiki.samba.org/index.php/Flexible_Single-Master_Operations_%28FSMO%29_roles#Introduction
for details.


> Aftrwards i saw the warning about never restoring database from backups.
> Now I have the following problems:
> users can login and all group policies are provided, but that's only
for a
> computers, who were added to domain before crash.
> New computers cant get group policies from domain (also users can't).
Debug
> log states that:
> DOMAIN\PC20$] FAILED with error NT_STATUS_INTERNAL_DB_CORRUPTION
> What would be the solution? Would demoting and adding secondary DC back
> solve this?
You can try the following:

- Shut down Samba on all your DC's.
- Take an offline copy of the Samba databases on all DCs. So you
  can at least roll back to this state, if neccessary.
- Remove all databases and smb.conf on the DC with the broken databases.
- Start Samba on all working DCs again.
- Remove the old objectGUID DNS entry.

https://wiki.samba.org/index.php/Check_and_fix_DNS_entries_on_DC_joins#Resolve_the_objectGUID_CNAME_record_of_the_new_joined_Domain_Controller
  shows how to search and add it, when you join a new DC. You
  search for it and remove it!
- Rejoin the broken DC. Make sure, it has exactly the same name and
  IP, than before your restore (follow
  https://wiki.samba.org/index.php/Join_a_domain_as_a_DC
- Don't forget to add the DNS entries, as mentioned in the "Join as
DC"
  guide
(https://wiki.samba.org/index.php/Check_and_fix_DNS_entries_on_DC_joins)
- See if replication works again.

Regards,
Marc

Am 18.06.2015 um 18:31 schrieb Tadas:
> Hello,
> I have a problem with my samba4 domain cluster:
> there are 2 machines, - primary and secondary server.
> Everything was working fine, but i had a hard drive failure on primary 
> PDC,
> so i reinstalled and restored a backup to it.
> Aftrwards i saw the warning about never restoring database from backups.
> Now I have the following problems:
> users can login and all group policies are provided, but that's only 
> for a
> computers, who were added to domain before crash.
> New computers cant get group policies from domain (also users can't). 
> Debug
> log states that:
> DOMAIN\PC20$] FAILED with error NT_STATUS_INTERNAL_DB_CORRUPTION
> What would be the solution? Would demoting and adding secondary DC back
> solve this?
> Thank you.
Hi,

if you have a nt-style domain, did you restore the domain sid?

I guess no. I just reinstalled the controller and copied one-hour old
backup of failed DC to it.

-- 



On Thu, 2015-06-18 at 20:26 +0200, J. Echter wrote:
> Am 18.06.2015 um 18:31 schrieb Tadas:
> > Hello,
> > I have a problem with my samba4 domain cluster:
> > there are 2 machines, - primary and secondary server.
> > Everything was working fine, but i had a hard drive failure on primary
> > PDC,
> > so i reinstalled and restored a backup to it.
> > Aftrwards i saw the warning about never restoring database from
backups.
> > Now I have the following problems:
> > users can login and all group policies are provided, but that's
only
> > for a
> > computers, who were added to domain before crash.
> > New computers cant get group policies from domain (also users
can't).
> > Debug
> > log states that:
> > DOMAIN\PC20$] FAILED with error NT_STATUS_INTERNAL_DB_CORRUPTION
> > What would be the solution? Would demoting and adding secondary DC
back
> > solve this?
> > Thank you.
> Hi,
> 
> if you have a nt-style domain, did you restore the domain sid?
>