samba - Aug 2018 - Samba4 DC JOIN in renamed domain exception WERR_DS_DIFFERENT_REPL_EPOCHS

Hi all,

I am trying to join a Samba 4.8.3 server running on CentOS7 as RODC to a W2008r2
domain that has been renamed in the past, thus having the flag
ms-DS-ReplicationEpoch set to 1, but I am getting this error:

[user at machine ~]# samba-tool domain join example.com RODC
-U"EXAMPLE\administrator" --dns-backend=SAMBA_INTERNAL
...
Join failed - cleaning up
...
ERROR(runtime): uncaught exception - (8593,
'WERR_DS_DIFFERENT_REPL_EPOCHS')
  File "/usr/lib64/python2.7/site-packages/samba/netcmd/__init__.py",
line 176, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib64/python2.7/site-packages/samba/netcmd/domain.py",
line 706, in run
    plaintext_secrets=plaintext_secrets)
  File "/usr/lib64/python2.7/site-packages/samba/join.py", line 1482,
in join_DC
    ctx.do_join()
  File "/usr/lib64/python2.7/site-packages/samba/join.py", line 1383,
in do_join
    ctx.join_replicate()
  File "/usr/lib64/python2.7/site-packages/samba/join.py", line 927,
in join_replicate
    replica_flags=ctx.replica_flags)
  File "/usr/lib64/python2.7/site-packages/samba/drs_utils.py", line
313, in replicate
    (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level, req)

Tried joining the domain as DC but same error.

Is joining to renamed domains not supported or am I doing something wrong?

Andrea Veroni
______________________
GRAF S.p.A.
Via Galilei, 32/36
41015 Nonantola (MO), Italy
Tel. +39 059545111
Fax +39 059541272
web: http://www.grafspa.it

Looks like: 
https://bugzilla.samba.org/show_bug.cgi?id=9500 
>From the source code: 
WERR_DS_DIFFERENT_REPL_EPOCHS = 
The directory service cannot perform the requested operation because the servers
involved
are of different replication epochs (which is usually related to a domain rename
that is in progress

So yes, you did hit a nice bug, this is one why i never ever ever ever change
domainnames/servers after the domain is setup.
How to fix this, i really dont know. (sorry)

Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Andrea Veroni via samba
> Verzonden: donderdag 2 augustus 2018 12:01
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] Samba4 DC JOIN in renamed domain exception 
> WERR_DS_DIFFERENT_REPL_EPOCHS
> 
> Hi all,
> 
> I am trying to join a Samba 4.8.3 server running on CentOS7 
> as RODC to a W2008r2 domain that has been renamed in the 
> past, thus having the flag ms-DS-ReplicationEpoch set to 1, 
> but I am getting this error:
> 
> [user at machine ~]# samba-tool domain join example.com RODC 
> -U"EXAMPLE\administrator" --dns-backend=SAMBA_INTERNAL
> ...
> Join failed - cleaning up
> ...
> ERROR(runtime): uncaught exception - (8593, 
> 'WERR_DS_DIFFERENT_REPL_EPOCHS')
>   File 
> "/usr/lib64/python2.7/site-packages/samba/netcmd/__init__.py",
>  line 176, in _run
>     return self.run(*args, **kwargs)
>   File 
> "/usr/lib64/python2.7/site-packages/samba/netcmd/domain.py", 
> line 706, in run
>     plaintext_secrets=plaintext_secrets)
>   File "/usr/lib64/python2.7/site-packages/samba/join.py", 
> line 1482, in join_DC
>     ctx.do_join()
>   File "/usr/lib64/python2.7/site-packages/samba/join.py", 
> line 1383, in do_join
>     ctx.join_replicate()
>   File "/usr/lib64/python2.7/site-packages/samba/join.py", 
> line 927, in join_replicate
>     replica_flags=ctx.replica_flags)
>   File 
> "/usr/lib64/python2.7/site-packages/samba/drs_utils.py", line 
> 313, in replicate
>     (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, 
> req_level, req)
> 
> Tried joining the domain as DC but same error.
> 
> Is joining to renamed domains not supported or am I doing 
> something wrong?
> 
> Andrea Veroni
> ______________________
> GRAF S.p.A.
> Via Galilei, 32/36
> 41015 Nonantola (MO), Italy
> Tel. +39 059545111
> Fax +39 059541272
> web: http://www.grafspa.it
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>