samba - Jan 2018 - Adding a Windows Server 2008 as a DC to the domain fails

Hi,
 I have a samba domain based on Samba version 4.7.4 compiled from sources
running on Debian Stretch v 9.3.   The domain is working fine, but when I try to
add another DC (a Windows Server 2008 Standard Edition) using the Wiki at
https://wiki.samba.org/index.php/Joining_a_Windows_Server_2008_/_2008_R2_DC_to_a
_Samba_AD it fails with the error:

"The operation failed because:
The functional level of the domain or forest is incompatible with this operating
system...."

I have tried with a Windows Server 2008 R2 version and that works OK, but cannot
get the one without the R2 upgrade to join. 

Any help please?

Thanks,

Roy Eastwood

Hai Roy, 

What happens if you disable smb1 in win 2008, reboot and try again. 
In powershell run : 

Get-WindowsFeature FS-SMB1
Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol 


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Roy 
> Eastwood via samba
> Verzonden: vrijdag 5 januari 2018 13:23
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] Adding a Windows Server 2008 as a DC to 
> the domain fails
> 
> Hi,
>  I have a samba domain based on Samba version 4.7.4 compiled 
> from sources
> running on Debian Stretch v 9.3.   The domain is working 
> fine, but when I try to
> add another DC (a Windows Server 2008 Standard Edition) using 
> the Wiki at
> https://wiki.samba.org/index.php/Joining_a_Windows_Server_2008
> _/_2008_R2_DC_to_a
> _Samba_AD it fails with the error:
> 
> "The operation failed because:
> The functional level of the domain or forest is incompatible 
> with this operating
> system...."
> 
> I have tried with a Windows Server 2008 R2 version and that 
> works OK, but cannot
> get the one without the R2 upgrade to join. 
> 
> Any help please?
> 
> Thanks,
> 
> Roy Eastwood
> 
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Hi Louis,
Thanks you for your quick answer.
 
> 
> Hai Roy,
> 
> What happens if you disable smb1 in win 2008, reboot and try again.
> In powershell run :
> 
> Get-WindowsFeature FS-SMB1
> Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol
> 
> 
Unfortunately the command is not recognised - it would seem that the Server
Manager Command-line tools are not available on
Windows Server 2008, only on 2008 R2 upwards!   So I set the SMB1 DWORD value to
0 in the appropriate key in the registry to disable SMB1.
That did not help at all - same failure notice.

I checked the Forest/Domain functional level using "samba-tool domain level
show" and indeed it is set to 2008 R2.   
There doesn't seem to be  any command to lower the Functional Levels in
samba.
However, I found this:
https://blogs.technet.microsoft.com/aman/2012/12/28/step-by-step-guide-to-lower-
active-directory-functional-level/

Would this work?   For example, if I re-join my Windows 2008 R2 machine as a DC,
lower the functional levels of the forest & domain,
join my 2008 machine, then demote the 2008 R2 DC?
 
> Greetz,
> 
> Louis
> 
Thanks,

Roy

Hai Roy, 

Hmm, i dont know for sure, but based on my google magic, i say your correct. 
Lowering the samba DC domain level should help you out. 

If someone can confirm this, thanks! 
But i must mention. 
Adding a "unsupported" ms 2008 server as dc...  wil cost you ms
licenses..

I suggest if possible, add a new samba AD DC. 
Add the windows server as member, and you dont have to lower the domain level.


Greetz, 

Louis


 
> -----Oorspronkelijk bericht-----
> Van: Roy Eastwood [mailto:spindles7 at gmail.com] 
> Verzonden: vrijdag 5 januari 2018 14:32
> Aan: 'L.P.H. van Belle'; samba at lists.samba.org
> Onderwerp: RE: [Samba] Adding a Windows Server 2008 as a DC 
> to the domain fails
> 
> Hi Louis,
> Thanks you for your quick answer.
>  
> > 
> > Hai Roy,
> > 
> > What happens if you disable smb1 in win 2008, reboot and try again.
> > In powershell run :
> > 
> > Get-WindowsFeature FS-SMB1
> > Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol
> > 
> > 
> 
> Unfortunately the command is not recognised - it would seem 
> that the Server
> Manager Command-line tools are not available on
> Windows Server 2008, only on 2008 R2 upwards!   So I set the 
> SMB1 DWORD value to
> 0 in the appropriate key in the registry to disable SMB1.
> That did not help at all - same failure notice.
> 
> I checked the Forest/Domain functional level using 
> "samba-tool domain level
> show" and indeed it is set to 2008 R2.   
> There doesn't seem to be  any command to lower the Functional 
> Levels in samba.
> However, I found this:
> https://blogs.technet.microsoft.com/aman/2012/12/28/step-by-st
ep-guide-to-lower-
> active-directory-functional-level/
> 
> Would this work?   For example, if I re-join my Windows 2008 
> R2 machine as a DC,
> lower the functional levels of the forest & domain,
> join my 2008 machine, then demote the 2008 R2 DC?
>  
> > Greetz,
> > 
> > Louis
> > 
> 
> Thanks,
> 
> Roy
> 
>