samba - Mar 2015 - Users and groups named in Russian disappeared after upgrade samba4 PDC

Hello. I use Ubuntu 11.04. Yesterday I upgraded samba from 
2:4.1.6+dfsg-1ubuntu2.14.04.3 to 2:4.1.6+dfsg-1ubuntu2.14.04.7 with some other 
packages. After restart samda my users and groups named in RUssian have 
disappeared. Neither Windows RSAT shows then, nor samba-tool user list, nor 
wbinfo -u, nor getent passwd, nor pdbedit -L. There are only some users 
available like Administrator, Guest, krbtgt, dhcpd and root. I didn't find
any
related errors in the log files. I can see my lost users and groups in output 
of commands

    ldbsearch -H ldap://localhost -U administrator

or

    ldapsearch -x -W -H ldap://localhost -D 
'CN=Administrator,CN=Users,DC=mydomain,DC=com' -b DC=mydomain,DC=com

My locale is ru_RU.UTF-8 and I have no any problems with that.
This is the output of testparm:

    Loaded services file OK.
    Server role: ROLE_ACTIVE_DIRECTORY_DC
    Press enter to see a dump of your service definitions
    
    [global]
            workgroup = MYDOMAIN
            realm = MYDOMAIN.COM
            server role = active directory domain controller
            passdb backend = samba_dsdb
            max log size = 30000
            printcap name = /dev/null
            allow dns updates = nonsecure and secure
            dns forwarder = 8.8.8.8
            rpc_server:tcpip = no
            rpc_daemon:spoolssd = embedded
            rpc_server:spoolss = embedded
            rpc_server:winreg = embedded
            rpc_server:ntsvcs = embedded
            rpc_server:eventlog = embedded
            rpc_server:srvsvc = embedded
            rpc_server:svcctl = embedded
            rpc_server:default = external
            idmap_ldb:use rfc2307 = yes
            idmap config * : backend = tdb
            printing = bsd
            print command = lpr -r -P'%p' %s
            lpq command = lpq -P'%p'
            lprm command = lprm -P'%p' %j
            veto files = /lost+found/aquota.user/
            map archive = No
            map readonly = no
            store dos attributes = Yes
            vfs objects = dfs_samba4, acl_xattr

samba-tool dbcheck --fix --yes --verbose shows me errors related to my missed 
users "ERROR: Object CN=user name,CN=Users,DC=mydomain,DC=com disappeared 
during check"

samba-tool dbcheck --fix doesn't help.

I started samba-tool dbcheck --cross-ncs --fix --yes --verbose
but it is still processing about some hours.

I can log into domain only with Administrator account.
I tried to downgrade samba, but it didn't help. I also tried to restore my 
domain from backup, but it also didn't help. I spend a lot of time gooling
the
issue and I didn't find anything helpful. Can anybody help me please? Any 
advice would be appreciated.

Hello Vitaly,


Am 09.03.2015 um 02:06 schrieb Vitaly Pyslar:
> Hello. I use Ubuntu 11.04. Yesterday I upgraded samba from 
> 2:4.1.6+dfsg-1ubuntu2.14.04.3 to 2:4.1.6+dfsg-1ubuntu2.14.04.7 with some
other
> packages. After restart samda my users and groups named in RUssian have 
> disappeared. Neither Windows RSAT shows then, nor samba-tool user list, nor
> wbinfo -u, nor getent passwd, nor pdbedit -L. 
Did you got errors during the classicupgrade?

@all: Didn't we had someone here on the list with a similar problem?
Accounts with chinese characters didn't worked or something like that?


> samba-tool dbcheck --fix --yes --verbose shows me errors related to my
missed
> users "ERROR: Object CN=user name,CN=Users,DC=mydomain,DC=com
disappeared
> during check"
About how many accounts do we talk about? Is it worth investigating or
easier recreating?


I don't know how good samba-tool works with special characters. Here I
e. g. avoid german umlauts in usernames, because you will quickly find
applications that can't handle it and it always cause problems.

You can try to edit the entry. If dbcheck complains, there must be at
least something inside the database.

You can try to edit the record and replace the russian characters (at
least temporary).

# ldbedit -H /usr/local/samba/private/sam.ldb 'cn=mmuehlfeld'
or if you have the special characters already inside the CN and can't
use it for search, the filter for something more general like
# ldbedit -H /usr/local/samba/private/sam.ldb 'objectClass=user'

Try to replace the problematic entries of one account and see, if it
appears in ADUC. If yes, then try remaing it in ADUC. Maybe it was just
a charset issue during the classic upgrade.

But before, you should, of course, create a working backup!


> I tried to downgrade samba, but it didn't help. I also tried to restore
my
> domain from backup, but it also didn't help. I spend a lot of time
gooling the
> issue and I didn't find anything helpful. Can anybody help me please?
Any
> advice would be appreciated.
If your clients once saw an AD DC, they don't connect to an NT4 PDC any
more. You have to re-join them.


Regards,
Marc

Thanks for the answer.
> Did you got errors during the classicupgrade?
I didn't do classicupgrade. My Samba AD DC was installed from scratch some 
months ago using the instructions from this page 
https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO and everything had been 
working well. I just upgraded some deb-packages with samba to the same version 
but different buid-release. Regarding to the changelog there were some bug- and 
security-fixes.
> @all: Didn't we had someone here on the list with a similar problem?
> Accounts with chinese characters didn't worked or something like that?
I supposed that it could be a characters encoding issue because only users and 
groups named in Russian disappeared, default administrative accounts and user 
"dhcpd" that I created manually were available.
> About how many accounts do we talk about? Is it worth investigating or
> easier recreating?
You right. It was 36 accounts and 2 groups, not too many. After all my 
attempts to fix it I have recreated whole my domain and rejoined all clients. 
It was very tiresomely but I had no more time to try to repair it.
 
I am still conserned if some day it may happen again. It was strange that 
restoring backup didn't help. I thought that my operating system can be 
damaged, so I tried to restore the backup inside an lxc-container. I tried to 
restore some different backups that have been made in different days and months.
No one of them worked. Have all my backups been making broken? To backing up I 
use the instruction from this page 
https://wiki.samba.org/index.php/Backup_and_Recovery with little modifications, 
but I didn't try to restore it before the fault.