samba - Apr 2018 - Raising Domain Level

G'day All,


	We are trying to raise the level of our test samba4 DCs. Our windows 
dude wants the Domain level to be 2012_R2.

	I am referencing:

https://wiki.samba.org/index.php/Raising_the_Functional_Levels#Supported_Functional_Levels

	We managed to get both domain and forest levels to 2008 R2 - forest was 
2003.

	However, when we try to raise further, we are getting what seems to be 
a chicken and egg issue.

# samba-tool domain level raise --domain-level=2012_R2
ERROR: Domain function level can't be higher than the lowest function 
level of a DC!

# samba-tool domain level raise --forest-level=2012_R2
ERROR: Forest function level can't be higher than the domain function 
level(s). Please raise it/them first!


	Am I missing something?


os: Centos 6
Samba 4.7 (will go to 4.8 soon)
Self compiled

-- 

Cheers,
David Minard.
Ph:    0247 360 155
Fax:    0247 360 770

ITDS - ACE - SSTaRS
Western Sydney University
Building Y - Penrith Campus (Kingswood)
Locked bag 1797
Penrith NSW 2751

[Sometimes waking up just isn't worth the insult of the day to come.]

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

On Thu, 2018-04-12 at 11:45 +1000, David Minard via samba
wrote:
> G'day All,
> 
> 
> 	We are trying to raise the level of our test samba4 DCs. Our windows 
> dude wants the Domain level to be 2012_R2.
> 
> 	I am referencing:
> 
>
https://wiki.samba.org/index.php/Raising_the_Functional_Levels#Supported_Functional_Levels
> 
> 	We managed to get both domain and forest levels to 2008 R2 - forest was 
> 2003.
> 
> 	However, when we try to raise further, we are getting what seems to be 
> a chicken and egg issue.
> 
> # samba-tool domain level raise --domain-level=2012_R2
> ERROR: Domain function level can't be higher than the lowest function 
> level of a DC!
> 
> # samba-tool domain level raise --forest-level=2012_R2
> ERROR: Forest function level can't be higher than the domain function 
> level(s). Please raise it/them first!
> 
> 
> 	Am I missing something?
We don't support FL 2012 (or 2012R2 yet).   We have code to prepare the
domain for it, but we don't have the Kerberos features that it implies.

I hope this clarifies things,

Andrew Bartlett

-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba