Greetings, All!
I've added a new DC to the working AD, transferred FSMO roles (checked, all
7
are ok') and (supposedly) correctly demoted the old DC.
SchemaMasterRole owner: CN=NTDS
Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CNInfrastructureMasterRole
owner: CN=NTDS Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=S
RidAllocationMasterRole owner: CN=NTDS
Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Si
PdcEmulationMasterRole owner: CN=NTDS
Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sit
DomainNamingMasterRole owner: CN=NTDS
Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=Sit
DomainDnsZonesMasterRole owner: CN=NTDS
Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=S
ForestDnsZonesMasterRole owner: CN=NTDS
Settings,CN=DC2,CN=Servers,CN=Default-First-Site-Name,CN=S
Now, I'm unable to connect to the domain using RSAT - the error is "RPC
server
unavailable".
Tried to forecefully remove old DC from the new one, just to be sure. It did
some additional cleanup, judging by the wall of debug messages, but that did
not help in the slightest.
Googled a bug https://bugzilla.samba.org/show_bug.cgi?id=12534 and manually
removed the last DNS record.
Now the DNS check reporting only new DC, but it is still not working like it
should.
So far, I've made these checks:
I can impersonate domain users and login with SSH using domain users on
domain members, even new logins with homedir creation, but?
Domain users/groups listing works partially.
One member:
groups: cannot find name for group ID 10008
groups: cannot find name for group ID 10009
groups: cannot find name for group ID 10010
# getent group | grep -P "1\\d{4}"
domain sudoers:x:10006:
domain admins:x:10000:
domain users:x:10001:
cvs:x:10005:
Another member:
# getent group | grep -P "1\\d{4}"
domain computers:x:10003:
domain sudoers:x:10006:
domain admins:x:10000:
domain guests:x:10002:
cloud admins:x:10010:
domain users:x:10001:
remote users:x:10009:
cloud users:x:10008:
git admins:x:10007:
cvs:x:10005:
Even wbinfo lists groups/users incorrectly on different machines.
anrdaemon at pubserver64:xterm:~
$ wbinfo -g | wc -l
20
anrdaemon at hosting64:xterm:~
$ wbinfo -g | wc -l
18
anrdaemon at daemon1:screen&0:~
$ wbinfo -u | wc -l
12
anrdaemon at hosting64:xterm:~
$ wbinfo -u | wc -l
11
Domain authorization works? not.
anrdaemon at hosting64:xterm:~
$ sudo -iH
[sudo] password for anrdaemon:
Sorry, try again.
sudo: 1 incorrect password attempt
anrdaemon at pubserver64:xterm:~
$ sudo -iH
[sudo] password for anrdaemon:
Domain Controller unreachable, using cached credentials instead. Network
resources may be unavailable
At the same time LDAP works like a charm and top-level tests pass
# net ads testjoin
Join is OK
# net ads info
LDAP server: 192.168.1.19
LDAP server name: dc2.ads.darkdragon.lan
Realm: ADS.DARKDRAGON.LAN
Bind Path: dc=ADS,dc=DARKDRAGON,dc=LAN
LDAP port: 389
Server time: ??, 07 ??? 2023 18:03:26 MSK
KDC server: 192.168.1.19
Server time offset: 0
But?
# wbinfo -t
checking the trust secret for domain DARKDRAGON via RPC calls failed
wbcCheckTrustCredentials(DARKDRAGON): error code was
NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND (0xc0000233)
failed to call wbcCheckTrustCredentials: WBC_ERR_AUTH_ERROR
Could not check secret
And DC log is spammed with messages like
: [2023/05/07 18:05:49.693988, 0]
../../source4/auth/unix_token.c:95(security_token_to_unix_toke>
: Unable to convert first SID (S-1-5-21-2269650170-3990761244-2407083512-1106)
in user token to>
: [2023/05/07 18:05:49.694080, 0]
../../libcli/security/security_token.c:56(security_token_debug)
: Security token SIDs (8):
: SID[ 0]: S-1-5-21-2269650170-3990761244-2407083512-1106
: SID[ 1]: S-1-5-21-2269650170-3990761244-2407083512-515
: SID[ 2]: S-1-1-0
: SID[ 3]: S-1-5-2
: SID[ 4]: S-1-5-11
: SID[ 5]: S-1-5-64-10
: SID[ 6]: S-1-5-32-554
: SID[ 7]: S-1-5-32-545
: Privileges (0x 800000):
: Privilege[ 0]: SeChangeNotifyPrivilege
: Rights (0x 400):
: Right[ 0]: SeRemoteInteractiveLogonRight
DC smb.conf attached, if needed.
I have a full offline backup of both DC's prior to transfer and already
tried
to redo the process, but to the same effect.
So, what can I do now?
--
With best regards,
Andrey Repin
Saturday, May 6, 2023 22:22:05
Sorry for my terrible english...