[Samba] AD replication problem "WERR_DS_DRA_ACCESS_DENIED" - need help debugging

Heinz Hölzl
Tue, 16 Jan 2018 15:31:50 -0000

on DC2 in the log i found:

./source4/dsdb/common/util.c:4807: Failed to find account dn
(serverReference) for CN=SAMBA3,CN=Servers,CN=Default-First-Site-
Name,CN=Sites,CN=Configuration,DC=test,DC=net, parent of DSA with
objectGUID c01a335e-1794-4997-9c7e-553be77fba04, sid S-1-5-21-
1608159440-4144762864-1017073214-18962
../source4/rpc_server/drsuapi/updaterefs.c:374: Refusing
DsReplicaUpdateRefs for sid S-1-5-21-1608159440-4144762864-1017073214-
18962 with GUID c01a335e-1794-4997-9c7e-553be77fba04


then i did the following test:

samba-tool ldapcmp ldap://DC1 ldap://DC2 -Uadministrator --
filter=CN,DC,member CONFIGURATION

* Comparing [CONFIGURATION] context...

* Objects to be compared: 1622

Comparing:
'CN=SAMBA3,CN=Servers,CN=Default-First-Site-
Name,CN=Sites,CN=Configuration,DC=test,DC=net' [ldap://DC1]
'CN=SAMBA3,CN=Servers,CN=Default-First-Site-
Name,CN=Sites,CN=Configuration,DC=test,DC=net' [ldap://DC2]
    Attributes found only in ldap://DC1:
        serverReference
    FAILED

* Result for [CONFIGURATION]: FAILURE

SUMMARY
---------

Attributes found only in ldap://DC1:

    serverReference
ERROR: Compare failed: -1




after a full sync from dc1 to dc2 (samba-tool drs replicate dc2 dc1
dc=gvcc,dc=net --full-sync --local) same result, serverReference on
CN=SAMBA3,CN=Servers,CN=Default-First-Site-
name,CN=Sites,CN=Configuration,DC=test,DC=net exists only on DC1


how can i fix this?



Am Dienstag, den 16.01.2018, 14:54 +0000 schrieb Heinz Hölzl via
samba:
> Hi,
>
> there is no firewall, all DCs are in the same subnet.
>
> here ist the output of a test, you can see, the CNAME guid entries in
> the _msdcs can be resolved on any DC: (DC1 and DC2 are the first and
> second DCs, SAMBA3 was added at last.
>
> ldbsearch -H /srv/samba/private/sam.ldb '(invocationId=*)' --cross-
> ncs
> objectguid
> # record 1
> dn: CN=NTDS Settings,CN=DC2,CN=Servers,CN=Default-First-Site-
> Name,CN=Sites,CN=Configuration,DC=test,DC=net
> objectGUID: 9e4b0aa7-629b-4535-b1d4-9cb5bf20cb7f
>
> # record 2
> dn: CN=NTDS Settings,CN=DC1,CN=Servers,CN=Default-First-Site-
> Name,CN=Sites,CN=Configuration,DC=test,DC=net
> objectGUID: 9ec652b4-146c-4ff1-babe-5abe291325be
>
> # record 3
> dn: CN=NTDS Settings,CN=SAMBA3,CN=Servers,CN=Default-First-Site-
> Name,CN=Sites,CN=Configuration,DC=test,DC=net
> objectGUID: c01a335e-1794-4997-9c7e-553be77fba04
>
> # returned 3 records
> # 3 entries
> # 0 referrals
>
> host -t CNAME 9e4b0aa7-629b-4535-b1d4-9cb5bf20cb7f._msdcs.test.net
> DC1
> 9e4b0aa7-629b-4535-b1d4-9cb5bf20cb7f._msdcs.test.net is an alias for
> dc2.test.net.
>
> host -t CNAME 9e4b0aa7-629b-4535-b1d4-9cb5bf20cb7f._msdcs.test.net
> DC2
> 9e4b0aa7-629b-4535-b1d4-9cb5bf20cb7f._msdcs.test.net is an alias for
> dc2.test.net.
>
> host -t CNAME 9e4b0aa7-629b-4535-b1d4-9cb5bf20cb7f._msdcs.test.net
> SAMBA3
> 9e4b0aa7-629b-4535-b1d4-9cb5bf20cb7f._msdcs.test.net is an alias for
> dc2.test.net.
>
> host -t CNAME 9ec652b4-146c-4ff1-babe-5abe291325be._msdcs.test.net
> DC1
> 9ec652b4-146c-4ff1-babe-5abe291325be._msdcs.test.net is an alias for
> dc1.test.net.
>
> host -t CNAME 9ec652b4-146c-4ff1-babe-5abe291325be._msdcs.test.net
> DC2
> 9ec652b4-146c-4ff1-babe-5abe291325be._msdcs.test.net is an alias for
> dc1.test.net.
>
> host -t CNAME 9ec652b4-146c-4ff1-babe-5abe291325be._msdcs.test.net
> SAMBA3
> 9ec652b4-146c-4ff1-babe-5abe291325be._msdcs.test.net is an alias for
> dc1.test.net.
>
> host -t CNAME c01a335e-1794-4997-9c7e-553be77fba04._msdcs.test.net
> DC1
> c01a335e-1794-4997-9c7e-553be77fba04._msdcs.test.net is an alias for
> SAMBA3.test.net.
>
> host -t CNAME c01a335e-1794-4997-9c7e-553be77fba04._msdcs.test.net
> DC2
> c01a335e-1794-4997-9c7e-553be77fba04._msdcs.test.net is an alias for
> SAMBA3.test.net.
>
> host -t CNAME c01a335e-1794-4997-9c7e-553be77fba04._msdcs.test.net
> SAMBA3
> c01a335e-1794-4997-9c7e-553be77fba04._msdcs.test.net is an alias for
> SAMBA3.test.net.
>
>
> Am Dienstag, den 16.01.2018, 12:10 +0100 schrieb Denis Cardon:
> > Hi Heinz,
> >
> > > i have the same problem on samba 4.7.3 and 4.7.4.
> > > I start with 2 DCs and the sync works fine. After the join of a
> > > third
> > > DC mostly i get the WERR_DS_DRA_ACCESS_DENIED. I tested it for 10
> > > times.
> > >
> > > in my case i have:
> > > DC1 (with any FSMO Roles)
> > > DC2
> > >
> > > new join as DC:
> > > DC3
> > >
> > > After the join, the sync from DC2 to DC3 fails.
> > >
> > > samba-tool drs replicate dc2 dc1 dc=gvcc,dc=net : OK
> > > samba-tool drs replicate dc1 dc2 dc=gvcc,dc=net : OK
> > > samba-tool drs replicate dc2 dc3 dc=gvcc,dc=net : OK
> > > samba-tool drs replicate dc1 dc3 dc=gvcc,dc=net : OK
> > > samba-tool drs replicate dc3 dc1 dc=gvcc,dc=net : OK
> > > samba-tool drs replicate dc3 dc2 dc=gvcc,dc=net : NOT OK
> >
> > like Rowland pointed you earlier, it is often an issue with missing
> > DNS
> > entries. Be sure to check that samba_dnsupdate on both servers is
> > happy,
> > especially with the CNAME guid entries in the _msdcs zone.
> >
> > Another case I saw was that firewall had not been disable (or at
> > least
> > the port opening was not done right).
> >
> > Cheers,
> >
> > Denis
> >
> > >
> > >
> > >
> > > p.s. DC3 is a new server witch newer was member in the ADS.
> > >
> > >
> > > regards,
> > > heinz
> > >
> > > Am Mittwoch, den 27.12.2017, 14:44 +0100 schrieb Dr. Johannes-
> > > Ulrich
> > > Menzebach via samba:
> > > > Rowland,
> > > >
> > > > - the DN "CN=DCNH1,..." exists on all 3 DCs
(pointing the Sites
> > > > and
> > > > Services console to each of them).
> > > > - I also checked that "samba-tool dbcheck"
completes w/o
> > > > showing
> > > > errors.
> > > > - the objectGUID DNS aliases of all DCs are resolvable
against
> > > > all 3
> > > > DCs' builtin DNS
> > > > - I forced a full sync from the FSMO holder (dcge1) to the 2
> > > > other
> > > > DCs
> > > > which finished w/o errors.
> > > > - after that, sync and also full sync dcdo1-->dcnh1
failed
> > > > exactly
> > > > as
> > > > earlier.
> > > >
> > > > I'm wondering whether this is related to
> > > > https://bugzilla.samba.org/show_bug.cgi?id=12972 , however
I'm
> > > > running
> > > > 4.7.4 and the domain had been created under 4.7.3 (based on
the
> > > > Samba
> > > > Wiki). Apart from the sync issue I'm VERY happy with
Samba4/AD.
> > > >
> > > > Many thanks,
> > > >
> > > > Uli
> > > >
> > > >
> > > >
> > > > On 12/27/2017 01:29 PM, Rowland Penny via samba wrote:
> > > > > On Wed, 27 Dec 2017 13:00:05 +0100
> > > > > "Dr. Johannes-Ulrich Menzebach via samba"
<samba at lists.samba.
> > > > > or
> > > > > g>
> > > > > wrote:
> > > > >
> > > > > > There is additional info in the logs of the source
DC
> > > > > > (dcdo1,
> > > > > > log
> > > > > > level 2, manually triggered another replication):
> > > > > > ===================> > > > > >
[2017/12/27 12:31:29.695121,  2]
> > > > > >
../source4/rpc_server/drsuapi/getncchanges.c:1731(getncchan
> > > > > > ge
> > > > > > s_co
> > > > > > llect_objects)
> > > > > >
../source4/rpc_server/drsuapi/getncchanges.c:1731:
> > > > > > getncchanges on
> > > > > > DC=ad,DC=kdu,DC=com using filter
(uSNChanged>=5415)
> > > > > > [2017/12/27 12:31:29.698828,  2]
> > > > > >
../source4/rpc_server/drsuapi/getncchanges.c:3006(dcesrv_dr
> > > > > > su
> > > > > > api_
> > > > > > DsGetNCChanges)
> > > > > >     DsGetNCChanges with uSNChanged >= 5415
flags 0x80000064
> > > > > > on
> > > > > >
<GUID=141bbe37-5eda-42b8-b904-0b75e26b1e2d>;<SID=S-1-5-21-
> > > > > >
454945863-777199239-1595221609>;DC=ad,DC=kdu,DC=com
> > > > > > gave 0 objects (done 0/0) 0 links (done 0/0 (as
> > > > > > S-1-5-21-454945863-777199239-1595221609-1112))
> > > > > > [2017/12/27 12:31:29.733157,  1]
> > > > > >
../source4/dsdb/common/util.c:4807(dsdb_validate_dsa_guid)
> > > > > >     ../source4/dsdb/common/util.c:4807: Failed to
find
> > > > > > account dn
> > > > > > (serverReference) for
> > > > > > CN=DCNH1,CN=Servers,CN=Default-First-Site-
> > > > > >
Name,CN=Sites,CN=Configuration,DC=ad,DC=kdu,DC=com,
> > > > > > parent of DSA with objectGUID
0acce4bc-1193-4609-8e4d-
> > > > > > a0771bb6fb76,
> > > > > > sid S-1-5-21-454945863-777199239-1595221609-1112
> > > > > > [2017/12/27 12:31:29.733198,  0]
> > > > > >
../source4/rpc_server/drsuapi/updaterefs.c:374(dcesrv_drsua
> > > > > > pi
> > > > > > _DsR
> > > > > > eplicaUpdateRefs)
> > > > > >
../source4/rpc_server/drsuapi/updaterefs.c:374:
> > > > > > Refusing
> > > > > > DsReplicaUpdateRefs for sid
> > > > > > S-1-5-21-454945863-777199239-1595221609-1112 with
GUID
> > > > > > 0acce4bc-1193-4609-8e4d-a0771bb6fb76
> > > > > >
> > > > > > According to what I see in the "Sites and
Services" RSAT
> > > > > > console
> > > > > > the
> > > > > > DN for