samba - Nov 2018 - Setup a Samba AD DC as an additional DC

On Sat, 24 Nov 2018 07:36:56 +0000
"Barry D. Adkins via samba" <samba at lists.samba.org> wrote:
> >>As you are are using Ubuntu 18.04, you could just install
Louis's
> >>Samba packages. They will install over and replace your existing
> >>Samba packages.
> >
> >I did this and the domain join with a Samba DC succeeded.
> 
> Well these "errors/warnings" were reported even though the
command
> succeeded:
> 
> A Kerberos configuration suitable for Samba AD has been generated
> at /var/lib/samba/private/krb5.conf Merge the contents of this file
> with your system krb5.conf or replace it with this one. Do not create
> a symlink!
> 
> I don't know why this warning because the system krb5.conf has the
> entries in that file they want to be merged.  Maybe the install
> examined the file in /usr/shar/samba/setup  ??
No, it isn't a 'warning', it is a notice. It is just telling you
that
there is a 'krb5.conf' file that you should use. This is a part of the
'provision' code that runs during the 'join' and can be ignored
in this
case, because the join wouldn't work if krb5.conf wasn't set up
correctly.
> 
> AND at the very end of a long list of things it did:
> 
> ERROR(runtime): uncaught exception - (9601,
> 'WERR_DNS_ERROR_ZONE_DOES_NOT_EXIST') File
> "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
> 177, in _run return self.run(*args, **kwargs) File
> "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line
716,
> in run backend_store=backend_store) File
> "/usr/lib/python2.7/dist-packages/samba/join.py", line 1500, in
> join_DC ctx.do_join() File
> "/usr/lib/python2.7/dist-packages/samba/join.py", line 1405, in
> do_join ctx.join_add_dns_records() File
> "/usr/lib/python2.7/dist-packages/samba/join.py", line 1164, in
> join_add_dns_records None)
> 
Very strange, it looks like it is trying to add a dns record to a zone
that doesn't exist, does the Windows DC you are using to join to the
domain run a dns server ?

Rowland

>Very strange, it looks like it is trying to add a dns record to a zone that
doesn't exist, does the Windows DC you are using to join to the domain run a
dns server ?
Yes it is.

I noticed this in the AD for Directory Partitions:
DC=ForestDnsZones,DC=daram,DC=com >> Distinguished name: 
CN=af689faa-6daa-4fa6-b958-c7da71d654c3,CN=Partitions,CN=Configuration,DC=daram,DC=com
DC=DomainDnsZones,DC=daram,DC=com >> Distinguished name: 
CN=f88d9aed-f398-4a38-8488-7b165c9cbd9d,CN=Partitions,CN=Configuration,DC=daram,DC=com

I've been searching to see if this is normal, and if not, how to
"fix" it.

Barry Adkins

>>Very strange, it looks like it is trying to add a dns record to a zone
that doesn't exist, does the Windows DC you are using to join to the domain
run a dns server ?
>
>Yes it is.
>I noticed this in the AD for Directory Partitions:
>DC=ForestDnsZones,DC=daram,DC=com >> Distinguished name: 
CN=af689faa-6daa-4fa6-b958-c7da71d654c3,CN=Partitions,CN=Configuration,DC=daram,DC=com
>DC=DomainDnsZones,DC=daram,DC=com >> Distinguished name: 
CN=f88d9aed-f398-4a38-8488-7b165c9cbd9d,CN=Partitions,CN=Configuration,DC=daram,DC=com
>
>I've been searching to see if this is normal, and if not, how to
"fix" it.
To keep the record straight.  This is absolutely how Microsoft stores AD DNS
Integration post Windows 2000.  MS DCs do not replicate this portion of the
directory.  The DNS servers subscribe to it so that only servers that need the
information get the replication traffic.  This supposedly saved traffic on GCs.

Barry Adkins
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba