samba - Dec 2012 - Cannot Join Existing Windows 2003 Domain

Trying to add a new samba 4 domain controller to an existing Windows 
2003 domain.  There are two existing domain controllers: 
dc1.home.aaronson.com and dc2.home.aaronson.com.  As you can see below, 
samba 4 dies during the join.  I am stumped.  Dcdiag throws no errors on 
the existing controllers.  Any ideas/


ubuntu at sulu:/usr/local/samba# sudo bin/samba-tool domain join 
home.aaronson.com DC -Uadministrator --realm=HOME.AARONSON.COM
password:
Finding a writeable DC for domain 'home.aaronson.com'
Found DC dc2.home.aaronson.com
workgroup is HOME
realm is home.aaronson.com
checking sAMAccountName
Adding CN=SULU,OU=Domain Controllers,DC=home,DC=aaronson,DC=com
Adding 
CN=SULU,CN=Servers,CN=HOME,CN=Sites,CN=Configuration,DC=home,DC=aaronson,DC=com
Adding CN=NTDS 
Settings,CN=SULU,CN=Servers,CN=HOME,CN=Sites,CN=Configuration,DC=home,DC=aaronson,DC=com
Adding SPNs to CN=SULU,OU=Domain Controllers,DC=home,DC=aaronson,DC=com
Setting account password for SULU$
Enabling account
Calling bare provision
More than one IPv6 address found. Using 2002:4b90:e8ed:0:21a:4bff:fe48:97d9
Provision OK for domain DN DC=home,DC=aaronson,DC=com
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=home,DC=aaronson,DC=com] 
objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=home,DC=aaronson,DC=com] 
objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=home,DC=aaronson,DC=com] 
objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=home,DC=aaronson,DC=com] 
objects[1608] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=home,DC=aaronson,DC=com] 
objects[2010] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=home,DC=aaronson,DC=com] 
objects[2348] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=home,DC=aaronson,DC=com] objects[369] 
linked_values[0]
Partition[CN=Configuration,DC=home,DC=aaronson,DC=com] objects[520] 
linked_values[0]
Partition[CN=Configuration,DC=home,DC=aaronson,DC=com] objects[665] 
linked_values[0]
Partition[CN=Configuration,DC=home,DC=aaronson,DC=com] objects[800] 
linked_values[0]
Partition[CN=Configuration,DC=home,DC=aaronson,DC=com] objects[1035] 
linked_values[0]
Replicating critical objects from the base DN of the domain
Partition[DC=home,DC=aaronson,DC=com] objects[95] linked_values[0]
Partition[DC=home,DC=aaronson,DC=com] objects[497] linked_values[0]
Partition[DC=home,DC=aaronson,DC=com] objects[890] linked_values[0]
Refusing to replicate 
DC=DomainDnsZones\0ADEL:accca481-ed86-4259-bcf2-fe5adebd7676,DC=home,DC=aaronson,DC=com
from a read-only repilca into a read-write replica!
Failed to convert object 
DC=DomainDnsZones\0ADEL:accca481-ed86-4259-bcf2-fe5adebd7676,DC=home,DC=aaronson,DC=com:

WERR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA
Failed to convert objects: WERR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA
Join failed - cleaning up
checking sAMAccountName
Deleted CN=SULU,OU=Domain Controllers,DC=home,DC=aaronson,DC=com
Deleted CN=NTDS 
Settings,CN=SULU,CN=Servers,CN=HOME,CN=Sites,CN=Configuration,DC=home,DC=aaronson,DC=com
Deleted 
CN=SULU,CN=Servers,CN=HOME,CN=Sites,CN=Configuration,DC=home,DC=aaronson,DC=com
ERROR(<type 'exceptions.TypeError'>): uncaught exception - Failed
to
process chunk: NT code 0xc0002111
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
     return self.run(*args, **kwargs)
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py",
line 552, in run
     machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
   File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", 
line 1104, in join_DC
     ctx.do_join()
   File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", 
line 1009, in do_join
     ctx.join_replicate()
   File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", 
line 748, in join_replicate
     replica_flags=ctx.domain_replica_flags)
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/drs_utils.py",
line
252, in replicate
     schema=schema, req_level=req_level, req=req)

On Tue, 2012-12-25 at 14:06 -0500, Larry Aaronson wrote:
> Trying to add a new samba 4 domain controller to an existing Windows 
> 2003 domain.  There are two existing domain controllers: 
> dc1.home.aaronson.com and dc2.home.aaronson.com.  As you can see below, 
> samba 4 dies during the join.  I am stumped.  Dcdiag throws no errors on 
> the existing controllers.  Any ideas/
> Refusing to replicate 
>
DC=DomainDnsZones\0ADEL:accca481-ed86-4259-bcf2-fe5adebd7676,DC=home,DC=aaronson,DC=com
> from a read-only repilca into a read-write replica!
> Failed to convert object 
>
DC=DomainDnsZones\0ADEL:accca481-ed86-4259-bcf2-fe5adebd7676,DC=home,DC=aaronson,DC=com:
> 
> WERR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA
> Failed to convert objects: WERR_DS_DRA_SOURCE_IS_PARTIAL_REPLICA
So, what is happening here is that the DC you are joining is not the
full DNS server for the domain, but it may well be a global catalog.

We had an issue a few months back where somehow we replicated back in
data from a server that marked it's partition as being a global catalog,
and we had terrible trouble recovering the domain.

So, we put in this assertion that we just won't do this.

What we should do is find the DC that does have this information, and
replicate from there, but I've not added that complexity yet.

In the short term, to try things out, make both your DCs DNS servers,
and try again, and file a bug so we don't forget to look into DNS
partition replication some more. 

Andrew Bartlett
-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org