samba - Nov 2013 - Replicating failing after installing RODC

We've joined an RODC to the domain (Windows 2008R2 running a W2003 
FFL/DFL AD) but are getting these errors on first startup.

It was joined with:

samba-tool domain join main.adlab.netdirect.ca RODC 
--realm=main.adlab.netdirect.ca 
--username=administrator at main.adlab.netdirect.ca --dns-backend=BIND9_DLZ

but we get these errors right after startup:
Nov 28 12:35:27 sles-bree samba[3939]: [2013/11/28 12:35:27.824986, 0] 
../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
Nov 28 12:35:27 sles-bree samba[3939]: Failed to apply records: Conflict 
adding object 
'DC=6b51956f-604c-41a4-8366-6fb31664f468,DC=_msdcs.main.adlab.netdirect.ca,CN=MicrosoftDNS,DC=ForestDnsZones,DC=main,DC=adlab,DC=netdirect,DC=ca'
from incoming replication as we are read only for the partition.
Nov 28 12:35:27 sles-bree samba[3939]: - We must fail the operation 
until a master for this partition resolves the conflict: Entry already 
exists
Nov 28 12:35:27 sles-bree samba[3939]: [2013/11/28 12:35:27.825496, 0] 
../source4/dsdb/repl/drepl_out_helpers.c:725(dreplsrv_op_pull_source_apply_changes_trigger)
Nov 28 12:35:27 sles-bree samba[3939]: Failed to commit objects: 
WERR_GENERAL_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE
Nov 28 12:35:27 sles-bree samba[3939]: [2013/11/28 12:35:27.994815, 0] 
../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
Nov 28 12:35:27 sles-bree samba[3939]: Failed to apply records: Conflict 
adding object 
'DC=6b51956f-604c-41a4-8366-6fb31664f468,DC=_msdcs.main.adlab.netdirect.ca,CN=MicrosoftDNS,DC=ForestDnsZones,DC=main,DC=adlab,DC=netdirect,DC=ca'
from incoming replication as we are read only for the partition.
Nov 28 12:35:27 sles-bree samba[3939]: - We must fail the operation 
until a master for this partition resolves the conflict: Entry already 
exists
Nov 28 12:35:27 sles-bree samba[3939]: [2013/11/28 12:35:27.995340, 0] 
../source4/dsdb/repl/drepl_out_helpers.c:725(dreplsrv_op_pull_source_apply_changes_trigger)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to commit objects: 
WERR_GENERAL_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE
Nov 28 12:35:28 sles-bree samba[3939]: [2013/11/28 12:35:28.042643, 0] 
../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to apply records: Conflict 
adding object 
'DC=_kerberos._tcp.Shire._sites,DC=main.adlab.netdirect.ca,CN=MicrosoftDNS,DC=DomainDnsZones,DC=main,DC=adlab,DC=netdirect,DC=ca'
from incoming replication as we are read only for the partition.
Nov 28 12:35:28 sles-bree samba[3939]: - We must fail the operation 
until a master for this partition resolves the conflict: Entry already 
exists
Nov 28 12:35:28 sles-bree samba[3939]: [2013/11/28 12:35:28.043116, 0] 
../source4/dsdb/repl/drepl_out_helpers.c:725(dreplsrv_op_pull_source_apply_changes_trigger)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to commit objects: 
WERR_GENERAL_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE
Nov 28 12:35:28 sles-bree samba[3939]: [2013/11/28 12:35:28.139010, 0] 
../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to apply records: Conflict 
adding object 
'DC=_kerberos._tcp.Shire._sites,DC=main.adlab.netdirect.ca,CN=MicrosoftDNS,DC=DomainDnsZones,DC=main,DC=adlab,DC=netdirect,DC=ca'
from incoming replication as we are read only for the partition.
Nov 28 12:35:28 sles-bree samba[3939]: - We must fail the operation 
until a master for this partition resolves the conflict: Entry already 
exists
Nov 28 12:35:28 sles-bree samba[3939]: [2013/11/28 12:35:28.139343, 0] 
../source4/dsdb/repl/drepl_out_helpers.c:725(dreplsrv_op_pull_source_apply_changes_trigger)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to commit objects: 
WERR_GENERAL_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE

Any idea what to do about this?

-- 
Michael Brown               | `One of the main causes of the fall of
Systems Consultant          | the Roman Empire was that, lacking zero,
Net Direct Inc.             | they had no way to indicate successful
?: +1 519 883 1172 x5106    | termination of their C programs.' - Firth

On 13-11-28 02:15 PM, Michael Brown wrote:
> samba-tool domain join main.adlab.netdirect.ca RODC 
> --realm=main.adlab.netdirect.ca 
> --username=administrator at main.adlab.netdirect.ca --dns-backend=BIND9_DLZ
Three SLES RODCs in the environment were joined at the same time with 
the same commands and only one of them is giving these errors.

sles-bree (the one failing replication on the DNS zone partitions) 
pulled from AD1 whereas the other two pulled from AD2.

Repadmin output shows this:
https://gist.github.com/Supermathie/a982748fb8a328e2b150

AD replication status tool output:
http://i.imgur.com/Oe1H9u7.png
(AD1 and AD2 get the same failures replicating to sles-bree)

M.

-- 
Michael Brown               | `One of the main causes of the fall of
Systems Consultant          | the Roman Empire was that, lacking zero,
Net Direct Inc.             | they had no way to indicate successful
?: +1 519 883 1172 x5106    | termination of their C programs.' - Firth