samba - Apr 2024 - Upgrade to 4.20: Not resetting nTSecurityDescriptor

Hello to all,

After updating to samba 4.20 (from samba 4.19) on Debian 11, samba-tool
dbcheck --cross-ncs
results in:
samba-tool dbcheck --cross-ncs
Checking 4499 objects
Not resetting nTSecurityDescriptor on CN=Deleted
Objects,CN=Configuration,DC=tlk,DC=loc
Not resetting nTSecurityDescriptor on CN=Deleted
Objects,DC=DomainDnsZones,DC=tlk,DC=loc
Not resetting nTSecurityDescriptor on CN=Deleted
Objects,DC=ForestDnsZones,DC=tlk,DC=loc
Not resetting nTSecurityDescriptor on CN=Deleted Objects,DC=tlk,DC=loc

Checked 4499 objects (4 errors)
Please use 'samba-tool dbcheck --fix' to fix 4 errors

Do I have to perform samba-tool dbcheck --fix, though this server is the
second and the master still is running samba 4.19!?

Greetings
Daniel

On Fri, 2024-04-12 at 08:03 +0200, Daniel M?ller via samba
wrote:
> Hello to all,
> 
> After updating to samba 4.20 (from samba 4.19) on Debian 11, samba-tool
> dbcheck --cross-ncs
> results in:
> samba-tool dbcheck --cross-ncs
> Checking 4499 objects
> Not resetting nTSecurityDescriptor on CN=Deleted
> Objects,CN=Configuration,DC=tlk,DC=loc
> Not resetting nTSecurityDescriptor on CN=Deleted
> Objects,DC=DomainDnsZones,DC=tlk,DC=loc
> Not resetting nTSecurityDescriptor on CN=Deleted
> Objects,DC=ForestDnsZones,DC=tlk,DC=loc
> Not resetting nTSecurityDescriptor on CN=Deleted Objects,DC=tlk,DC=loc
> 
> Checked 4499 objects (4 errors)
> Please use 'samba-tool dbcheck --fix' to fix 4 errors
> 
> Do I have to perform samba-tool dbcheck --fix, though this server is the
> second and the master still is running samba 4.19!?
Yes, you can reset this SD. ?I've checked the code and we only improved
dbcheck, we didn't make a matching change to the C code.?

Andrew Bartlett

-- 
Andrew Bartlett (he/him) https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Developer, Catalyst IT https://catalyst.net.nz/services/samba