samba - Oct 2015 - Failed to transfer all 7 FSMOs

Hello, 

I tested to transfer all 7 FSMOs from Windows Server 2003 Enterprise
to Samba 4.3.0 DC. (I think some users still use Win2K3 and want to 
migrate.) But unfortunately is failed.

To reproduce, 

(1) Promoto Win2K3R2 Enterprise host to first DC.
(2) Join self-built Samba 4.3.0 to the domain.
(3) Run 'samba-tool fsmo transfer --role=all'

root at jessie64-1:~# samba-tool fsmo transfer --role=all
FSMO transfer of 'rid' role successful
FSMO transfer of 'pdc' role successful
FSMO transfer of 'naming' role successful
FSMO transfer of 'infrastructure' role successful
FSMO transfer of 'schema' role successful
ERROR: Failed to delete role 'domaindns': LDAP error 50   
LDAP_INSUFFICIENT_ACCESS_RIGHTS -  <00002098: SecErr: DSID-03151D80, problem
4003 (INSUFF_ACCESS_RIGHTS), data 0> <>

Any suggestions will be much appreciated.

-- 
TAKAHASHI Motonobu <monyo at monyo.com>
  @damemonyo / http://facebook.com/takahashi.motonobu

On 07/10/15 00:33, TAKAHASHI Motonobu/高橋 基信 wrote:
> Hello,
>
> I tested to transfer all 7 FSMOs from Windows Server 2003 Enterprise
> to Samba 4.3.0 DC. (I think some users still use Win2K3 and want to
> migrate.) But unfortunately is failed.
>
> To reproduce,
>
> (1) Promoto Win2K3R2 Enterprise host to first DC.
> (2) Join self-built Samba 4.3.0 to the domain.
> (3) Run 'samba-tool fsmo transfer --role=all'
>
> root at jessie64-1:~# samba-tool fsmo transfer --role=all
> FSMO transfer of 'rid' role successful
> FSMO transfer of 'pdc' role successful
> FSMO transfer of 'naming' role successful
> FSMO transfer of 'infrastructure' role successful
> FSMO transfer of 'schema' role successful
> ERROR: Failed to delete role 'domaindns': LDAP error 50   
LDAP_INSUFFICIENT_ACCESS_RIGHTS -  <00002098: SecErr: DSID-03151D80, problem
4003 (INSUFF_ACCESS_RIGHTS), data 0> <>
>
> Any suggestions will be much appreciated.
>
Well, you could run 'samba-tool fsmo transfer --help' and read the last 
line!

Rowland

Hello,
> On 07/10/15 00:33, TAKAHASHI Motonobu/高橋 基信 wrote:
> > Hello,
> >
> > I tested to transfer all 7 FSMOs from Windows Server 2003 Enterprise
> > to Samba 4.3.0 DC. (I think some users still use Win2K3 and want to
> > migrate.) But unfortunately is failed.
> >
> > To reproduce,
> >
> > (1) Promoto Win2K3R2 Enterprise host to first DC.
> > (2) Join self-built Samba 4.3.0 to the domain.
> > (3) Run 'samba-tool fsmo transfer --role=all'
> >
> > root at jessie64-1:~# samba-tool fsmo transfer --role=all
> > FSMO transfer of 'rid' role successful
> > FSMO transfer of 'pdc' role successful
> > FSMO transfer of 'naming' role successful
> > FSMO transfer of 'infrastructure' role successful
> > FSMO transfer of 'schema' role successful
> > ERROR: Failed to delete role 'domaindns': LDAP error 50   
LDAP_INSUFFICIENT_ACCESS_RIGHTS -  <00002098: SecErr: DSID-03151D80, problem
4003 (INSUFF_ACCESS_RIGHTS), data 0> <>
> >
> > Any suggestions will be much appreciated.
> 
> Well, you could run 'samba-tool fsmo transfer --help' and read the
last
> line!
Hello, do you mean "You must provide an Admin user and password"?
I tried and still is failed with another error:

root at jessie64-1:~# samba-tool fsmo transfer --role=all -U
Administrator%password
FSMO transfer of 'rid' role successful
FSMO transfer of 'pdc' role successful
FSMO transfer of 'naming' role successful
FSMO transfer of 'infrastructure' role successful
FSMO transfer of 'schema' role successful
ERROR: Failed to add role 'domaindns': LDAP error 53
LDAP_UNWILLING_TO_PERFORM -  <000020AE: SvcErr: DSID-031524F4, problem 5003
(WILL_NOT_PERFORM), data 0
> <>
The first DC is Win2K3R2 host which is newly promoted.

The password is valid. If I tried with wrong password, it is failed 
with another error message:
Failed to bind - LDAP error 49 LDAP_INVALID_CREDENTIALS -  <8009030C:
LdapErr: DSID-0C09043E, comment: AcceptSecurityContext error, data 0, vece>
<>