samba - Apr 2023 - Unable to "rejoin" existing DC after upgrade (infamous WERR_FILE_NOT_FOUND)

> That all smells quite similar to what I were seeing
> here before, and what someone else were seeing too,
> all with 4.17[.4]. This famouse WERR_FILE_NOT_FOUND
> error too.
We upgraded one more domain, and in the hope to avoid this error, we remained on
4.16. So we deployed a new 4.16.9 DC, joined, everything is fine.
Remove the old DC, upgrade OS, install 4.16.10 (which was released in the
meantime), join back, everything is fine.

After "some time", on the second DC (the one implemented for upgrading
the first):

DC=DomainDnsZones,DC=wdc,DC=dom,DC=it
        Default-First-Site-Name\DC1 via RPC
                DSA object GUID: 60b7eeda-0650-4efe-a576-569dfc012847
                Last attempt @ Fri Apr 14 11:39:38 2023 CEST failed, result 2
(WERR_FILE_NOT_FOUND)
                1 consecutive failure(s).
                Last success @ Fri Apr 14 11:39:38 2023 CEST


The replica has been working fine for one or two hours (didn't constantly
monitor, but was checked regularly). Then we moved FSMO roles "back"
to dc1, and the error popped up.
I cannot say it this has been the trigger, but this is the only change we did
after the upgrade.

Now dc1 shows ALL GOOD, while dc2 shows all replication items with errors.


Is there any way I can determine dc1 being "correct" or not? FSMO
roles are all in charge to that.

thanks again
-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.com 
CTO @ YetOpen Srl

Corso Martiri della Liberazione 114 - 23900 Lecco - ITALY - | 4801 Glenwood
Avenue - Suite 200 - Raleigh, NC 27612 - USA -
Tel +39 0341 220 205 - info.it at yetopen.com  | Phone +1 919-817-8106 - info.us
at yetopen.com

Think green - Non stampare questa e-mail se non necessario / Don't print
this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso
esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da
ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo
679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non
autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad
eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci
non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the
sole use of the intended recipient and may contain confidential and privileged
information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection
Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or
distribution
is prohibited. If you are not the intended recepient please delete this message
without copying, printing or forwarding it to others, and alert us as soon as
possible.
Thank you.

On 14/04/2023 12:13, Lorenzo Milesi via samba wrote:
> 
>> That all smells quite similar to what I were seeing
>> here before, and what someone else were seeing too,
>> all with 4.17[.4]. This famouse WERR_FILE_NOT_FOUND
>> error too.
> 
> We upgraded one more domain, and in the hope to avoid this error, we
remained on 4.16. So we deployed a new 4.16.9 DC, joined, everything is fine.
> Remove the old DC, upgrade OS, install 4.16.10 (which was released in the
meantime), join back, everything is fine.
> 
> After "some time", on the second DC (the one implemented for
upgrading the first):
> 
> DC=DomainDnsZones,DC=wdc,DC=dom,DC=it
>          Default-First-Site-Name\DC1 via RPC
>                  DSA object GUID: 60b7eeda-0650-4efe-a576-569dfc012847
>                  Last attempt @ Fri Apr 14 11:39:38 2023 CEST failed,
result 2 (WERR_FILE_NOT_FOUND)
>                  1 consecutive failure(s).
>                  Last success @ Fri Apr 14 11:39:38 2023 CEST
> 
> 
> The replica has been working fine for one or two hours (didn't
constantly monitor, but was checked regularly). Then we moved FSMO roles
"back" to dc1, and the error popped up.
> I cannot say it this has been the trigger, but this is the only change we
did after the upgrade.
> 
> Now dc1 shows ALL GOOD, while dc2 shows all replication items with errors.
> 
> 
> Is there any way I can determine dc1 being "correct" or not? FSMO
roles are all in charge to that.
> 
> thanks again

Can you please run this command on a DC and post the output:

host -t SRV _ldap._tcp.pdc._msdcs.wdc.dom.it

Rowland

> Now dc1 shows ALL GOOD, while dc2 shows all replication items with errors.
We found a config error: dc2 had dc1's IP as DNS in resolv.conf. Updating it
to dc2's IP made the error go away.
Now replication is ALL GOOD on both DCs.

-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.com 
CTO @ YetOpen Srl

Corso Martiri della Liberazione 114 - 23900 Lecco - ITALY - | 4801 Glenwood
Avenue - Suite 200 - Raleigh, NC 27612 - USA -
Tel +39 0341 220 205 - info.it at yetopen.com  | Phone +1 919-817-8106 - info.us
at yetopen.com

Think green - Non stampare questa e-mail se non necessario / Don't print
this email unless necessary

-------- D.Lgs. 196/2003 e GDPR 679/2016 --------
Tutte le informazioni contenute in questo messaggio sono riservate ed a uso
esclusivo del destinatario.
Tutte le informazioni ivi contenute, compresi eventuali allegati, sono da
ritenere confidenziali e riservate secondo i termini
del vigente D.Lgs. 196/2003 in materia di privacy e del Regolamento europeo
679/2016 - GDPR - e quindi ne e' proibita l'utilizzazione ulteriore non
autorizzata.
Nel caso in cui questo messaggio Le fosse pervenuto per errore, La invitiamo ad
eliminarlo senza copiarlo, stamparlo, a non inoltrarlo a terzi e ad avvertirci
non appena possibile.
Grazie.

Confidentiality notice: this email message including any attachment is for the
sole use of the intended recipient and may contain confidential and privileged
information;
pursuant to Legislative Decree 196/2003 and the European General Data Protection
Regulation 679/2016 - GDPR - any unauthorized review, use, disclosure or
distribution
is prohibited. If you are not the intended recepient please delete this message
without copying, printing or forwarding it to others, and alert us as soon as
possible.
Thank you.