samba - Jun 2018 - Problem joining a samba Dc to a winbdows domain

Hi Rowland,

On Thu, 21 Jun 2018, Rowland Penny via samba wrote:
> On Thu, 21 Jun 2018 12:02:41 -0400 (EDT)
> Tom Diehl via samba <samba at lists.samba.org> wrote:
>
>> Hi,
>>
>> I am trying to join a self compiled samba 4.8.2 DC to an existing
>> Windows domain using
>>
https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory#Joining_the_Active_Directory_as_a_Domain_Controller
>> as instructions.
>>
>> The smb.conf looks like the following:
>>
>> [global]
>>      netbios name = PHT-VDC1
>>      realm = EXAMPLE.COM
>>      server role = active directory domain controller
>>      server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
>> drepl, winbindd, ntp_signd, kcc, dnsupdate workgroup = EXAMPLE
>>
>> [netlogon]
>>      path = /usr/local/samba/var/locks/sysvol/example.com/scripts
>>      read only = No
>>
>> [sysvol]
>>      path = /usr/local/samba/var/locks/sysvol
>>      read only = No
>>
>> The above was generated by the following samba-tool command line:
>> samba-tool domain join example.com DC -U"example\admin"
>> --dns-backend=BIND9_DLZ
>>
>> When I run samba-tool I get the following output:
>> (pht-vdc1 pts10) # samba-tool domain join example.com DC
>> -U"example\admin" --dns-backend=BIND9_DLZ Finding a writeable
DC for
>> domain 'example.com' Found DC PHT1.example.com
>> Password for [EXAMPLE\admin]:
>> workgroup is EXAMPLE
>> realm is example.com
>> Adding CN=PHT-VDC1,OU=Domain Controllers,DC=example,DC=com
>> Adding
>>
CN=PHT-VDC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
>> Adding CN=NTDS
>>
Settings,CN=PHT-VDC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
>> Adding SPNs to CN=PHT-VDC1,OU=Domain Controllers,DC=example,DC=com
>> Setting account password for PHT-VDC1$ Enabling account Adding DNS
>> account CN=dns-PHT-VDC1,CN=Users,DC=example,DC=com with dns/ SPN
>> Setting account password for dns-PHT-VDC1 Calling bare provision
>> Looking up IPv4 addresses
>> Looking up IPv6 addresses
>> No IPv6 address will be assigned
>> Setting up share.ldb
>> Setting up secrets.ldb
>> Setting up the registry
>> Setting up the privileges database
>> Setting up idmap db
>> Setting up SAM db
>> Setting up sam.ldb partitions and settings
>> Setting up sam.ldb rootDSE
>> Pre-loading the Samba 4 and AD schema
>> Unable to determine the DomainSID, can not enforce uniqueness
>> constraint on local domainSIDs
>>
>> A Kerberos configuration suitable for Samba AD has been generated
>> at /usr/local/samba/private/krb5.conf Merge the contents of this file
>> with your system krb5.conf or replace it with this one. Do not create
>> a symlink! Provision OK for domain DN DC=example,DC=com Starting
>> replication Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[402/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[804/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[1206/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[1608/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[2010/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[2412/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[2814/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[3216/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[3618/4383] linked_values[0/0]
>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>> objects[3735/4383] linked_values[0/0] Analyze and apply schema
>> objects Partition[CN=Configuration,DC=example,DC=com]
>> objects[402/7722] linked_values[0/355]
>> Partition[CN=Configuration,DC=example,DC=com] objects[804/7722]
>> linked_values[0/355] ...
>> Partition[CN=Configuration,DC=example,DC=com] objects[6376/7722]
>> linked_values[0/355] Partition[CN=Configuration,DC=example,DC=com]
>> objects[6510/7722] linked_values[12/355] Replicating critical objects
>> from the base DN of the domain Partition[DC=example,DC=com]
>> objects[105/156] linked_values[42/388] Partition[DC=example,DC=com]
>> objects[296/7902] linked_values[1/388] Partition[DC=example,DC=com]
>> objects[466/7902] linked_values[72/388] Failed to commit objects: DOS
>> code 0x000021bf Join failed - cleaning up
>
> This is where it seems to fail and 0x000021bf is this:
>
> The replication operation failed because the target object referenced
> by a link value is recycled.
>
> So it might be an idea to check the DC you are trying to join to.
Check it for what? If I understand correctly the error is saying that the target
object is not there. The problem is I do not understand what the target
object is or how to find it. Assuming that the error is referring to 
Partition[DC=example,DC=com] objects[466/7952] linked_values[72/388]
How do I figure out what the error is referring to?

As I said in a separate message, I can successfully join using 4.7.7.
If this is a problem with the existing MS DC, why does 4.7.7 join without
error?

To be clear I am not doubting your advice and I do appreciate it. I am just
trying to understand.

Regards,

-- 
Tom			me at tdiehl.org

On Thu, 21 Jun 2018 14:32:49 -0400 (EDT)
me at tdiehl.org wrote:
> Hi Rowland,
> 
> On Thu, 21 Jun 2018, Rowland Penny via samba wrote:
> 
> > On Thu, 21 Jun 2018 12:02:41 -0400 (EDT)
> > Tom Diehl via samba <samba at lists.samba.org> wrote:
> >
> >> Hi,
> >>
> >> I am trying to join a self compiled samba 4.8.2 DC to an existing
> >> Windows domain using
> >>
https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory#Joining_the_Active_Directory_as_a_Domain_Controller
> >> as instructions.
> >>
> >> The smb.conf looks like the following:
> >>
> >> [global]
> >>      netbios name = PHT-VDC1
> >>      realm = EXAMPLE.COM
> >>      server role = active directory domain controller
> >>      server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
> >> drepl, winbindd, ntp_signd, kcc, dnsupdate workgroup = EXAMPLE
> >>
> >> [netlogon]
> >>      path = /usr/local/samba/var/locks/sysvol/example.com/scripts
> >>      read only = No
> >>
> >> [sysvol]
> >>      path = /usr/local/samba/var/locks/sysvol
> >>      read only = No
> >>
> >> The above was generated by the following samba-tool command line:
> >> samba-tool domain join example.com DC -U"example\admin"
> >> --dns-backend=BIND9_DLZ
> >>
> >> When I run samba-tool I get the following output:
> >> (pht-vdc1 pts10) # samba-tool domain join example.com DC
> >> -U"example\admin" --dns-backend=BIND9_DLZ Finding a
writeable DC
> >> for domain 'example.com' Found DC PHT1.example.com
> >> Password for [EXAMPLE\admin]:
> >> workgroup is EXAMPLE
> >> realm is example.com
> >> Adding CN=PHT-VDC1,OU=Domain Controllers,DC=example,DC=com
> >> Adding
> >>
CN=PHT-VDC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
> >> Adding CN=NTDS
> >>
Settings,CN=PHT-VDC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
> >> Adding SPNs to CN=PHT-VDC1,OU=Domain Controllers,DC=example,DC=com
> >> Setting account password for PHT-VDC1$ Enabling account Adding DNS
> >> account CN=dns-PHT-VDC1,CN=Users,DC=example,DC=com with dns/ SPN
> >> Setting account password for dns-PHT-VDC1 Calling bare provision
> >> Looking up IPv4 addresses
> >> Looking up IPv6 addresses
> >> No IPv6 address will be assigned
> >> Setting up share.ldb
> >> Setting up secrets.ldb
> >> Setting up the registry
> >> Setting up the privileges database
> >> Setting up idmap db
> >> Setting up SAM db
> >> Setting up sam.ldb partitions and settings
> >> Setting up sam.ldb rootDSE
> >> Pre-loading the Samba 4 and AD schema
> >> Unable to determine the DomainSID, can not enforce uniqueness
> >> constraint on local domainSIDs
> >>
> >> A Kerberos configuration suitable for Samba AD has been generated
> >> at /usr/local/samba/private/krb5.conf Merge the contents of this
> >> file with your system krb5.conf or replace it with this one. Do
> >> not create a symlink! Provision OK for domain DN DC=example,DC=com
> >> Starting replication
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[402/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[804/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[1206/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[1608/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[2010/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[2412/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[2814/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[3216/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[3618/4383] linked_values[0/0]
> >> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
> >> objects[3735/4383] linked_values[0/0] Analyze and apply schema
> >> objects Partition[CN=Configuration,DC=example,DC=com]
> >> objects[402/7722] linked_values[0/355]
> >> Partition[CN=Configuration,DC=example,DC=com] objects[804/7722]
> >> linked_values[0/355] ...
> >> Partition[CN=Configuration,DC=example,DC=com] objects[6376/7722]
> >> linked_values[0/355] Partition[CN=Configuration,DC=example,DC=com]
> >> objects[6510/7722] linked_values[12/355] Replicating critical
> >> objects from the base DN of the domain
> >> Partition[DC=example,DC=com] objects[105/156]
> >> linked_values[42/388] Partition[DC=example,DC=com]
> >> objects[296/7902] linked_values[1/388]
> >> Partition[DC=example,DC=com] objects[466/7902]
> >> linked_values[72/388] Failed to commit objects: DOS code
> >> 0x000021bf Join failed - cleaning up
> >
> > This is where it seems to fail and 0x000021bf is this:
> >
> > The replication operation failed because the target object
> > referenced by a link value is recycled.
> >
> > So it might be an idea to check the DC you are trying to join to.
> 
> Check it for what? If I understand correctly the error is saying that
> the target object is not there. The problem is I do not understand
> what the target object is or how to find it. Assuming that the error
> is referring to Partition[DC=example,DC=com] objects[466/7952]
> linked_values[72/388] How do I figure out what the error is referring
> to?
> 
> As I said in a separate message, I can successfully join using 4.7.7.
> If this is a problem with the existing MS DC, why does 4.7.7 join
> without error?
> 
> To be clear I am not doubting your advice and I do appreciate it. I
> am just trying to understand.
> 
> Regards,
> 
The index mode changed at 4.8.0, this might be more picky i.e. it wont
allow things that 4.7.x would.

If this was a Samba DC, I would suggest running 'samba-tool
dbcheck' on it, but is there a windows version of this tool ?

If 4.7.7 joins and works successfully, have you considered using this
as the main DC and try joining the 4.8.2 to it ?

Rowland

On Thu, 21 Jun 2018, Rowland Penny via samba wrote:
> On Thu, 21 Jun 2018 14:32:49 -0400 (EDT)
> me at tdiehl.org wrote:
>
>> Hi Rowland,
>>
>> On Thu, 21 Jun 2018, Rowland Penny via samba wrote:
>>
>>> On Thu, 21 Jun 2018 12:02:41 -0400 (EDT)
>>> Tom Diehl via samba <samba at lists.samba.org> wrote:
>>>
>>>> Hi,
>>>>
>>>> I am trying to join a self compiled samba 4.8.2 DC to an
existing
>>>> Windows domain using
>>>>
https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory#Joining_the_Active_Directory_as_a_Domain_Controller
>>>> as instructions.
>>>>
>>>> The smb.conf looks like the following:
>>>>
>>>> [global]
>>>>      netbios name = PHT-VDC1
>>>>      realm = EXAMPLE.COM
>>>>      server role = active directory domain controller
>>>>      server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
>>>> drepl, winbindd, ntp_signd, kcc, dnsupdate workgroup = EXAMPLE
>>>>
>>>> [netlogon]
>>>>      path =
/usr/local/samba/var/locks/sysvol/example.com/scripts
>>>>      read only = No
>>>>
>>>> [sysvol]
>>>>      path = /usr/local/samba/var/locks/sysvol
>>>>      read only = No
>>>>
>>>> The above was generated by the following samba-tool command
line:
>>>> samba-tool domain join example.com DC
-U"example\admin"
>>>> --dns-backend=BIND9_DLZ
>>>>
>>>> When I run samba-tool I get the following output:
>>>> (pht-vdc1 pts10) # samba-tool domain join example.com DC
>>>> -U"example\admin" --dns-backend=BIND9_DLZ Finding a
writeable DC
>>>> for domain 'example.com' Found DC PHT1.example.com
>>>> Password for [EXAMPLE\admin]:
>>>> workgroup is EXAMPLE
>>>> realm is example.com
>>>> Adding CN=PHT-VDC1,OU=Domain Controllers,DC=example,DC=com
>>>> Adding
>>>>
CN=PHT-VDC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
>>>> Adding CN=NTDS
>>>>
Settings,CN=PHT-VDC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=com
>>>> Adding SPNs to CN=PHT-VDC1,OU=Domain
Controllers,DC=example,DC=com
>>>> Setting account password for PHT-VDC1$ Enabling account Adding
DNS
>>>> account CN=dns-PHT-VDC1,CN=Users,DC=example,DC=com with dns/
SPN
>>>> Setting account password for dns-PHT-VDC1 Calling bare
provision
>>>> Looking up IPv4 addresses
>>>> Looking up IPv6 addresses
>>>> No IPv6 address will be assigned
>>>> Setting up share.ldb
>>>> Setting up secrets.ldb
>>>> Setting up the registry
>>>> Setting up the privileges database
>>>> Setting up idmap db
>>>> Setting up SAM db
>>>> Setting up sam.ldb partitions and settings
>>>> Setting up sam.ldb rootDSE
>>>> Pre-loading the Samba 4 and AD schema
>>>> Unable to determine the DomainSID, can not enforce uniqueness
>>>> constraint on local domainSIDs
>>>>
>>>> A Kerberos configuration suitable for Samba AD has been
generated
>>>> at /usr/local/samba/private/krb5.conf Merge the contents of
this
>>>> file with your system krb5.conf or replace it with this one. Do
>>>> not create a symlink! Provision OK for domain DN
DC=example,DC=com
>>>> Starting replication
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[402/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[804/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[1206/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[1608/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[2010/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[2412/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[2814/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[3216/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[3618/4383] linked_values[0/0]
>>>> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=com]
>>>> objects[3735/4383] linked_values[0/0] Analyze and apply schema
>>>> objects Partition[CN=Configuration,DC=example,DC=com]
>>>> objects[402/7722] linked_values[0/355]
>>>> Partition[CN=Configuration,DC=example,DC=com] objects[804/7722]
>>>> linked_values[0/355] ...
>>>> Partition[CN=Configuration,DC=example,DC=com]
objects[6376/7722]
>>>> linked_values[0/355]
Partition[CN=Configuration,DC=example,DC=com]
>>>> objects[6510/7722] linked_values[12/355] Replicating critical
>>>> objects from the base DN of the domain
>>>> Partition[DC=example,DC=com] objects[105/156]
>>>> linked_values[42/388] Partition[DC=example,DC=com]
>>>> objects[296/7902] linked_values[1/388]
>>>> Partition[DC=example,DC=com] objects[466/7902]
>>>> linked_values[72/388] Failed to commit objects: DOS code
>>>> 0x000021bf Join failed - cleaning up
>>>
>>> This is where it seems to fail and 0x000021bf is this:
>>>
>>> The replication operation failed because the target object
>>> referenced by a link value is recycled.
>>>
>>> So it might be an idea to check the DC you are trying to join to.
>>
>> Check it for what? If I understand correctly the error is saying that
>> the target object is not there. The problem is I do not understand
>> what the target object is or how to find it. Assuming that the error
>> is referring to Partition[DC=example,DC=com] objects[466/7952]
>> linked_values[72/388] How do I figure out what the error is referring
>> to?
>>
>> As I said in a separate message, I can successfully join using 4.7.7.
>> If this is a problem with the existing MS DC, why does 4.7.7 join
>> without error?
>>
>> To be clear I am not doubting your advice and I do appreciate it. I
>> am just trying to understand.
>>
>> Regards,
>>
>
> The index mode changed at 4.8.0, this might be more picky i.e. it wont
> allow things that 4.7.x would.
>
> If this was a Samba DC, I would suggest running 'samba-tool
> dbcheck' on it, but is there a windows version of this tool ?
Apparently there is
http://www.rebeladmin.com/2018/03/integrity-check-detect-low-level-active-directory-database-corruption/

Huh, learn something new every day!! :-)

I am going to give that a try.
>
> If 4.7.7 joins and works successfully, have you considered using this
> as the main DC and try joining the 4.8.2 to it ?
That also sounds like a good idea.

Thanks for the help.

Regards,

-- 
Tom			me at tdiehl.org