samba - Nov 2018 - samba-tool domain backup online errors

Hello,

Attempting to run

samba-tool domain backup online --server=pfdc1.domain.local 
--targetdir=/backups/ -U administrator

gives the following errors.

Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness constraint 
on local domainSIDs

Partition[DC=domain,DC=local] objects[1716/1738] linked_values[0/839]
../lib/ldb/ldb_tdb/ldb_index.c:2352: duplicate attribute value in 
CN=MRLENOVO-1,OU=Computers,OU=Records,OU=SITEA,DC=domain,DC=local for 
index on servicePrincipalName, duplicate of objectGUID 
6f7a7d42-5a8e-4329-a6ff-083ff10a9d2b in 
@INDEX:SERVICEPRINCIPALNAME:TERMSRV/MRLENOVO-1.domain.LOCAL

Cloned domain DOMAIN (SID S-1-5-21-940051827-2291820289-3341758437)
ERROR(runtime): uncaught exception - (3221225506, '{Access Denied} A 
process has requested access to an object but has not been granted those 
access rights.')
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 177, in _run
     return self.run(*args, **kwargs)
   File 
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain_backup.py",
line 242, in run
     backup_online(smb_conn, sysvol_tar, remote_sam.get_domain_sid())
   File
"/usr/local/samba/lib/python2.7/site-packages/samba/ntacls.py",
line 499, in backup_online
     ntacl_sddl_str = smb_helper.get_acl(r_name, as_sddl=True)
   File
"/usr/local/samba/lib/python2.7/site-packages/samba/ntacls.py",
line 322, in get_acl
     smb_path, SECURITY_SECINFO_FLAGS, SECURITY_SEC_FLAGS)


I am running this command from the DC I wish to make the backup of. 
Should I be running this from a remote DC? Thanks.

On 6/11/18 7:14 AM, James Atwell via samba wrote:
> I am running this command from the DC I wish to make the backup of.
> Should I be running this from a remote DC? Thanks.
Hi,

If running in online mode, then ideally, yes (on a host without any
Samba config files because that might affect the backup). If it's still
happening, then a normal join might actually be broken (possibly by this
bug https://bugzilla.samba.org/show_bug.cgi?id=8929).

Cheers,

Garming

Hi,

we have a network-hosted app for windows that is being executed from smb
share. The app worked well with Windows up to 7.

Now, after upgrading clients to Windows 10, the app suddenly crashes
after some 1-2 hours of use (or idle). The vendor indicates, that the
problem may relate to reading the app's DLLs.

The interesting thing is, that the problem only appears when the share
is hosted on Samba 4.5(.12) or Windows 2016 server.

We don't see the problem on Samba 4.2 or Windows 2008R2 server. However,
due to security and infrastructure reasons we don't see possibility to
keep these systems for too long.

We would like to migrate the app to Samba 4.5. I feel, that the culprit
must be some new SMB functionality that appeared both on Windows 10,
Windows 2016 and Samba 4.5, that makes the difference against the older
Windows and Samba systems. Some kind of caching, locking, or something
like that. Maybe related to SMB v3? Theoretically, the code might even
have been present in older Samba too, but may have been enabled only
later by changing some default between versions.

If I could switch the feature back to the old way in config, it may
workaround the problem. I just don't know, which one could it be. Does
anyone have a clue?