samba - Mar 2018 - Unable to successfully join Samba 4.8.0 or Windows 2008 R2 to a Samba 4.6.7 DC

When I attempt to join samba 4.8.0 (stable) to my samba 4.6.7 DC (Ubuntu),
I receive the following error:

Partition[DC=us,DC=dignitastech,DC=com] objects[500/1605]
linked_values[0/118]
Failed to commit objects: WERR_GEN_FAILURE
Join failed - cleaning up
Deleted CN=DC3-CLONE,OU=Domain Controllers,DC=us,DC=dignitastech,DC=com
Deleted CN=NTDS
Settings,CN=DC3-CLONE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=us,DC=dignitastech,DC=com
Deleted
CN=DC3-CLONE,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=us,DC=dignitastech,DC=com
ERROR(runtime): uncaught exception - (31, "Failed to process
'chunk' of DRS
replicated objects: WERR_GEN_FAILURE")
  File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 176, in _run
    return self.run(*args, **kwargs)
  File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py",
line
706, in run
    plaintext_secrets=plaintext_secrets)
  File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py",
line
1482, in join_DC
    ctx.do_join()
  File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py",
line
1383, in do_join
    ctx.join_replicate()
  File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py",
line
942, in join_replicate
    replica_flags=ctx.domain_replica_flags)
  File
"/usr/local/samba/lib/python2.7/site-packages/samba/drs_utils.py",
line 330, in replicate
    raise e

Possibly related, when I join a Windows 2008 R2 server, I see the following
in the event viewer during the join:
Internal error: An Active Directory Domain Services error has occurred.

Additional Data
Error value (decimal):
8374
Error value (hex):
20b6
Internal ID:
30d07c5

After a reboot, I get a blue screen with the following:
STOP: c00002cb Security Accounts Manager initialization failed because of
the following error:
The system cannot find the file specified.

I can only get into the Windows DC through DSRM at this point.

dbcheck --cross-ncs is clean.

Let me know what type of logging you need from the Samba DC and I can
reproduce this.

On Tue, 2018-03-13 at 15:54 -0400, Justin Foreman via samba
wrote:
> When I attempt to join samba 4.8.0 (stable) to my samba 4.6.7 DC (Ubuntu),
> I receive the following error:
> 
> Partition[DC=us,DC=dignitastech,DC=com] objects[500/1605]
> linked_values[0/118]
> Failed to commit objects: WERR_GEN_FAILURE
> Let me know what type of logging you need from the Samba DC and I can
> reproduce this.
Carefully turn up the logging with eg -d5 on the command line until you
get a more useful message about what actually went wrong, taking care
that at some point it will spit out a dump of the DB containing
sensitive info, so avoid posting that to a mailing list.

Thanks,

Andrew Bartlett
-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba

This showed up at -d3:

DRS replication add DN of aca72580-587e-4dab-adee-07a5f8027dfa is
CN=foo,OU=bar,DC=baz
Failed to apply records: Failed to locally apply remote add of
CN=foo,OU=bar,DC=baz: ../lib/ldb/ldb_tdb/ldb_index.c:2012: Failed to
re-index servicePrincipalName in CN=blah,OU=blah,DC=blah - (null):
Operations error
Failed to commit objects: WERR_GEN_FAILURE

I've deleted the object in question and the failure just moves on to the
next object in the list.

Justin


On Tue, Mar 13, 2018 at 10:23 PM, Andrew Bartlett <abartlet at samba.org>
wrote:
> On Tue, 2018-03-13 at 15:54 -0400, Justin Foreman via samba wrote:
> > When I attempt to join samba 4.8.0 (stable) to my samba 4.6.7 DC
> (Ubuntu),
> > I receive the following error:
> >
> > Partition[DC=us,DC=dignitastech,DC=com] objects[500/1605]
> > linked_values[0/118]
> > Failed to commit objects: WERR_GEN_FAILURE
>
> > Let me know what type of logging you need from the Samba DC and I can
> > reproduce this.
>
> Carefully turn up the logging with eg -d5 on the command line until you
> get a more useful message about what actually went wrong, taking care
> that at some point it will spit out a dump of the DB containing
> sensitive info, so avoid posting that to a mailing list.
>
> Thanks,
>
> Andrew Bartlett
> --
> Andrew Bartlett
> https://samba.org/~abartlet/
> Authentication Developer, Samba Team         https://samba.org
> Samba Development and Support, Catalyst IT
> https://catalyst.net.nz/services/samba
>
>
>
>
>