samba - Dec 2020 - transferring fsmo

Hello,

I just tried to transfer all fsmo roles by

samba-tool fsmo transfer --role=all

and got:

FSMO transfer of 'rid' role successful

FSMO transfer of 'pdc' role successful

FSMO transfer of 'naming' role successful

FSMO transfer of 'infrastructure' role successful

FSMO transfer of 'schema' role successful

ERROR: Failed to add role 'domaindns': LDAP error 50
LDAP_INSUFFICIENT_ACCESS_RIGHTS -  <00002098: Object
CN=Infrastructure,DC=DomainDnsZones,DC=samba,DC=lindenberg,DC=one has no write
property access
> <>
now

samba-tool fsmo show

results in 

SchemaMasterRole owner: CN=NTDS
Settings,CN=COBRA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=lindenberg,DC=one

InfrastructureMasterRole owner: CN=NTDS
Settings,CN=COBRA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=lindenberg,DC=one

RidAllocationMasterRole owner: CN=NTDS
Settings,CN=COBRA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=lindenberg,DC=one

PdcEmulationMasterRole owner: CN=NTDS
Settings,CN=COBRA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=lindenberg,DC=one

DomainNamingMasterRole owner: CN=NTDS
Settings,CN=COBRA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=lindenberg,DC=one

DomainDnsZonesMasterRole owner: CN=NTDS
Settings,CN=BOA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=lindenberg,DC=one

ForestDnsZonesMasterRole owner: CN=NTDS
Settings,CN=BOA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samba,DC=lindenberg,DC=one

 

How can I clean up that?

Thanks, Joachim

On 16/12/2020 18:46, Joachim Lindenberg via samba wrote:
> Hello,
>
> I just tried to transfer all fsmo roles by
>
> samba-tool fsmo transfer --role=all
>
> and got:
>
> FSMO transfer of 'rid' role successful
>
> FSMO transfer of 'pdc' role successful
>
> FSMO transfer of 'naming' role successful
>
> FSMO transfer of 'infrastructure' role successful
>
> FSMO transfer of 'schema' role successful
>
> ERROR: Failed to add role 'domaindns': LDAP error 50
LDAP_INSUFFICIENT_ACCESS_RIGHTS -  <00002098: Object
CN=Infrastructure,DC=DomainDnsZones,DC=samba,DC=lindenberg,DC=one has no write
property access
>
I take it that you didn't run 'samba-tool fsmo transfer --help'
where it
shows (amongst others) this:

 ? --role=ROLE?????????? The FSMO role to seize or transfer.
 ??????????????????????? rid=RidAllocationMasterRole schema=SchemaMasterRole
 ??????????????????????? pdc=PdcEmulationMasterRole
 ??????????????????????? naming=DomainNamingMasterRole
 ??????????????????????? infrastructure=InfrastructureMasterRole
 ??????????????????????? domaindns=DomainDnsZonesMasterRole
 ??????????????????????? forestdns=ForestDnsZonesMasterRole all=all of the
 ??????????????????????? above? You must provide an Admin user and password.

Try reading the last line ?

It only really applies to the dns roles.

Rowland