samba - Jul 2019 - Samba4 - global catalog (GC) cannot be contacted using Windows 7 RSAT

Hi Rowland,

Currently using Samba 4.8.5
2 x DCs running on CentOS 6.10 (Final)
Configured 1 DC via classic upgrade, and the latter DC join AD forest.
Would it be alright if I were to redo the classic upgrade?
Hope to hear from you soon.

Thanks and Regards


On Fri, Jul 19, 2019 at 7:06 PM Rowland penny via samba <
samba at lists.samba.org> wrote:
> On 19/07/2019 11:13, Alfonso Conner via samba wrote:
> > Hi Samba Team,
> >
> > Have recently followed Samba guide and successfully migrate from PDC
to
> AD
> > and from BDC to join AD forest.
> > Need some advice here as I encountered global catalog (GC) cannot be
> > contacted issue when using RSAT.
> > This message pops up when I click "member of" tab while
viewing user
> > properties although it will display correctly after I acknowledged the
> > error.
> > Another similar message related to GC will also pop up when I click to
> the
> > next step while creating new user account, whereby I am aware my newly
> > created user might encounter login issues.
> >
> > After done some research and with reference to previous posts, i
noticed
> it
> > has to do with port 3268/tcp and 3269/tcp to be enabled and available.
> > After tried various methods to verify but no avail.
> >
> What OS is the DC running on ?
>
> What version of Samba ?
>
> Things like this used to happen, but they do not occur for myself using
> Win10 against Samba 4.9.6 on Devuan 2 (aka Debian 9)
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On 22/07/2019 01:21, Alfonso Conner wrote:
> Hi Rowland,
>
> Currently using Samba 4.8.5
> 2 x DCs running on CentOS 6.10 (Final)
> Configured 1 DC via classic upgrade, and the latter DC join AD forest.
> Would it be alright if I were to redo the classic upgrade?
You can if you want to, but I feel that your problem may have nothing to 
do with Samba.

Your first problem is your choice of OS, Centos 6 is as good as EOL, it 
is in maintenance mode and as such, the various packages may just be too 
old.

you ran 'netstat -plaunt | egrep "ntp|bind|named|samba|?mbd"'

Amongst your output was this:

tcp??????? 0????? 0 :::3268???????????????????? :::* LISTEN 2578/samba
tcp??????? 0????? 0 :::3269???????????????????? :::* LISTEN 2578/samba

Now I am no network expert, but doesn't ':::' mean IPv6 ?

When I run the same command, I get:

tcp??????? 0????? 0 0.0.0.0:3268? 0.0.0.0:* LISTEN 14227/samba: task[l
tcp6?????? 0????? 0 :::3268?????? :::*????? LISTEN 14227/samba: task[l

tcp??????? 0????? 0 0.0.0.0:3269? 0.0.0.0:* LISTEN 14227/samba: task[l
tcp6?????? 0????? 0 :::3269?????? :::*????? LISTEN 14227/samba: task[l

As you can 'tcp6' uses ':::3268'

Rowland

Hi Rowland,

In fact currently in my test environment using the same version of OS 6.10
and Samba 4.8.5.
I ran 'netstat -plaunt | egrep "ntp|bind|named|samba|?mbd"', I
have
:::3268, :::3269, I do not see 0.0.0.0:3268 and 0.0.0.03269.
While I use a Windows PC join to my test domain, I have no issues with GC.

Not sure how the GC problem can happen but seems to me it looks like a
sometimes thing.
Would the chances of getting be lower if were to use a higher version of OS
and Samba? =)

Now that I have quite a number of Windows PC under this AD, hope you can
correct me if I were to use the below steps:
I referred from Samba wiki
Example to remove DC1 from AD
1) Transfer FSMO to DC2
2) Demote DC1
3) stop DC1 samba service
4) Disconnect DC1 IP
5) Configure new_DC1 IP
6) Join new_DC1 to AD
7) Transfer FSMO from DC2 to the new_DC1

I am considering to use CentOS 7.6.1810 with Samba 4.10.6 for my new_DC1.
Prefer to use back the same hostname and IP address.
Thanks for your advice.

Thanks and Regards

On Mon, Jul 22, 2019 at 3:05 PM Rowland penny via samba <
samba at lists.samba.org> wrote:
> On 22/07/2019 01:21, Alfonso Conner wrote:
> > Hi Rowland,
> >
> > Currently using Samba 4.8.5
> > 2 x DCs running on CentOS 6.10 (Final)
> > Configured 1 DC via classic upgrade, and the latter DC join AD forest.
> > Would it be alright if I were to redo the classic upgrade?
>
> You can if you want to, but I feel that your problem may have nothing to
> do with Samba.
>
> Your first problem is your choice of OS, Centos 6 is as good as EOL, it
> is in maintenance mode and as such, the various packages may just be too
> old.
>
> you ran 'netstat -plaunt | egrep
"ntp|bind|named|samba|?mbd"'
>
> Amongst your output was this:
>
> tcp        0      0 :::3268                     :::* LISTEN 2578/samba
> tcp        0      0 :::3269                     :::* LISTEN 2578/samba
>
> Now I am no network expert, but doesn't ':::' mean IPv6 ?
>
> When I run the same command, I get:
>
> tcp        0      0 0.0.0.0:3268  0.0.0.0:* LISTEN 14227/samba: task[l
> tcp6       0      0 :::3268       :::*      LISTEN 14227/samba: task[l
>
> tcp        0      0 0.0.0.0:3269  0.0.0.0:* LISTEN 14227/samba: task[l
> tcp6       0      0 :::3269       :::*      LISTEN 14227/samba: task[l
>
> As you can 'tcp6' uses ':::3268'
>
> Rowland
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>