samba - Oct 2018 - Joining to a Windows 2012 R2 DC

Hi,

I'm trying to join a Samba installation (4.8.6, Debian Strech) to
existing 2012-R2 DC. Fails with the message below:

# samba-tool domain join mydomain.tld DC
-U"MYDOMAIN.TLD\Administrator"
--dns-backend=BIND9_DLZ --server=10.22.1.91

Password for [MYDOMAIN.TLD\Administrator]:
workgroup is MYDOMAIN
realm is mydomain.tld
Adding CN=DC3,OU=Domain Controllers,DC=mydomain,DC=tld
Join failed - cleaning up
ERROR(ldb): uncaught exception - LDAP error 53
LDAP_UNWILLING_TO_PERFORM -  <00002010: SvcErr: DSID-031A12D2, problem
5003 (WILL_NOT_PERFORM), data 0
> <>
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
line 176, in _run return self.run(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line
706, in run plaintext_secrets=plaintext_secrets)
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1482, in
join_DC ctx.do_join()
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1381, in
do_join ctx.join_add_objects()
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 616, in
join_add_objects ctx.samdb.add(rec)

Hi,

The problem that I mentioned above was related on Windows side
(maybe misconfigured 2nd DC). Btw, when I do a
new provision from scratch, error is gone but a new one appears:

DsAddEntry failed with status WERR_ACCESS_DENIED info (8567,
'WERR_DS_INCOMPATIBLE_VERSION')
Join failed - cleaning up

At this I point, I need a certain answer for "Is Samba 4.8.x compatible
with 2012-R2 function level for forest and domain?". Release notes say
that Samba is compatible with 2012-R2 since 4.7. So what should I do
make Samba 4.8 to join an existing 2012-R2 DC in order to benefit this
feature?

Thanks.
> Hi,
> 
> I'm trying to join a Samba installation (4.8.6, Debian Strech) to
> existing 2012-R2 DC. Fails with the message below:
> 
> # samba-tool domain join mydomain.tld DC
> -U"MYDOMAIN.TLD\Administrator" --dns-backend=BIND9_DLZ
> --server=10.22.1.91
> 
> Password for [MYDOMAIN.TLD\Administrator]:
> workgroup is MYDOMAIN
> realm is mydomain.tld
> Adding CN=DC3,OU=Domain Controllers,DC=mydomain,DC=tld
> Join failed - cleaning up
> ERROR(ldb): uncaught exception - LDAP error 53
> LDAP_UNWILLING_TO_PERFORM -  <00002010: SvcErr: DSID-031A12D2, problem
> 5003 (WILL_NOT_PERFORM), data 0
> > <>  
>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
> line 176, in _run return self.run(*args, **kwargs)
>   File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py",
line
> 706, in run plaintext_secrets=plaintext_secrets)
>   File "/usr/lib/python2.7/dist-packages/samba/join.py", line
1482, in
> join_DC ctx.do_join()
>   File "/usr/lib/python2.7/dist-packages/samba/join.py", line
1381, in
> do_join ctx.join_add_objects()
>   File "/usr/lib/python2.7/dist-packages/samba/join.py", line
616, in
> join_add_objects ctx.samdb.add(rec)

On Thu, 25 Oct 2018 15:13:39 +0300
Taner Tas via samba <samba at lists.samba.org> wrote:
> Hi,
> 
> The problem that I mentioned above was related on Windows side
> (maybe misconfigured 2nd DC). Btw, when I do a
> new provision from scratch, error is gone but a new one appears:
> 
> DsAddEntry failed with status WERR_ACCESS_DENIED info (8567,
> 'WERR_DS_INCOMPATIBLE_VERSION')
> Join failed - cleaning up
> 
> At this I point, I need a certain answer for "Is Samba 4.8.x
> compatible with 2012-R2 function level for forest and domain?".
As a DC, no, as a a Unix domain member, yes
> Release notes say that Samba is compatible with 2012-R2 since 4.7. So
Where does it say this ?
> what should I do make Samba 4.8 to join an existing 2012-R2 DC in
> order to benefit this feature?
Join as a Unix domain member.

The problem is the different schema versions, Samba AD uses 47 and 2012
use 56 or 67

Try reading this:

https://wiki.samba.org/index.php/Joining_a_Windows_Server_2012_/_2012_R2_DC_to_a_Samba_AD

Rowland