samba - Oct 2020 - automatic transfer or seize fsmo roles

Hello list:
Sorry  for my ignorance but anyone could you tell me if is possible setting
automatic transference or seize fsmo roles on samba4, to avoid manual
action over server, such as HA, i mean in case that my fsmo role owner
crash.
Best regard.

On 13/10/2020 21:33, Dania Ramirez Moya via samba wrote:
>   Hello list:
> Sorry  for my ignorance but anyone could you tell me if is possible setting
> automatic transference or seize fsmo roles on samba4, to avoid manual
> action over server, such as HA, i mean in case that my fsmo role owner
> crash.
> Best regard.
I suppose anything is possible, but it would be fraught with dangers. 
You would have to set up a DC to watch the DC that holds all the FSMO 
roles and if it disappeared, seize the roles. However, what if someone 
unplugs the ethernet cable from the FSMO DC by accident and then 
realises this and plugs it back in again and by this time the other DC 
is starting to seize the roles ?

I personally would suggest getting a DC to email someone if the FSMO DC 
has a problem ;-)

Rowland

On Tue, 2020-10-13 at 15:33 -0500, Dania Ramirez Moya via samba
wrote:
>  Hello list:
> Sorry  for my ignorance but anyone could you tell me if is possible
> setting
> automatic transference or seize fsmo roles on samba4, to avoid manual
> action over server, such as HA, i mean in case that my fsmo role
> owner
> crash.
> Best regard.
AD FSMO role transfers are generally for the case where a DC is really
gone away, not for automatic transfers.

The reason for this is that if the network goes split-brain you don't
want each end of the split deciding to take the FSMO role
unilaterally. 

Also, FSMO roles don't matter that much - new users can still be
created (typically up to another 1500 or more) and schema changes are
vanishingly rare.

So having the FSMO role owner offline isn't a big deal, just bring it
back online when you can.

Andrew Bartlett

-- 
Andrew Bartlett                       https://samba.org/~abartlet/
Authentication Developer, Samba Team  https://samba.org
Samba Developer, Catalyst IT          
https://catalyst.net.nz/services/samba