search for: repsfrom

...; outbound and inbound neighbors be reflective of the KCC connection >> objects? I would expect to find only inbound and outbound connections >> for SOLDC1. Maybe I'm completely misinterpreting the intended >> behavior. > > There's likely at least some stale entries (repsFrom). The KCC builds > the inbound connections for each DC. Then as a separate step translates > the connections to replication links. The outbound links are mostly the > other DCs problem (likely an old repsFrom pulling from SOLDC1). I've > taken quite a few steps to rid the DCs of as...

...inbound neighbors be reflective of the KCC connection > objects? I would expect to find only inbound and outbound connections > for SOLDC1. Maybe I'm completely misinterpreting the intended behavior. the job of the samba_kcc script is to create the ntdsConnection objects. Afterward the repsFrom/repsTo attribute are created in accordance with the ntdsConnection objects (you can force the creation using samba-tool drs replicate although). You can check that the process is asynchronous when you join a new DC, the INBOUND and OUTBOUND entries are coming later on after the ntdsConnection o...

On 9/24/2016 7:32 AM, Denis Cardon wrote: > > the job of the samba_kcc script is to create the ntdsConnection > objects. Afterward the repsFrom/repsTo attribute are created in > accordance with the ntdsConnection objects (you can force the creation > using samba-tool drs replicate although). You can check that the > process is asynchronous when you join a new DC, the INBOUND and > OUTBOUND entries are coming later on after...

hi, After an update to our DC4, I started to notice the error "Failed to store repsFrom - Indexed and full searches both failed!" in the logs. root at dc4:~# tail -f /var/log/samba/log.samba Copyright Andrew Tridgell and the Samba Team 1992-2023 [2023/12/05 14:09:06.191978, 0] ../../lib/util/become_daemon.c:150(daemon_status) daemon_status: daemon 'samba' : Starting...

Any thoughts? :D On Tue, Dec 5, 2023 at 4:59?PM Elias Pereira <empbilly at gmail.com> wrote: > hi, > > After an update to our DC4, I started to notice the error "Failed to store > repsFrom - Indexed and full searches both failed!" in the logs. > > root at dc4:~# tail -f /var/log/samba/log.samba > Copyright Andrew Tridgell and the Samba Team 1992-2023 > [2023/12/05 14:09:06.191978, 0] > ../../lib/util/become_daemon.c:150(daemon_status) > daemon_status: daem...

...Elias Pereira via samba wrote: > Any thoughts? :D > > On Tue, Dec 5, 2023 at 4:59?PM Elias Pereira < > empbilly at gmail.com > > wrote: > > > hi, > > > > After an update to our DC4, I started to notice the error "Failed > > to store > > repsFrom - Indexed and full searches both failed!" in the logs. > > > > root at dc4:~# tail -f /var/log/samba/log.samba > > Copyright Andrew Tridgell and the Samba Team 1992-2023 > > [2023/12/05 14:09:06.191978, 0] > > ../../lib/util/become_daemon.c:150(daemon_status)...

> > Wasn't aware of this. Thank you for the info. If I was to delete the > incorrect respsFrom/repsTo attributes, wouldn't the KCC just > regenerate them over time once the KCC check and ISTG check kicked in? As long as the topology doesn't change or DCs which are not bridgeheads do not go offline, there should be basically zero additional reps over time. How often they

...300.100. 4;32:1.2.840.113556.1.6.23;33:1.2.840.113556.1.6.18.1;34:1.2.840.113556.1.6.1 8.2;35:1.2.840.113556.1.6.13.3;36:1.2.840.113556.1.6.13.4;37:1.3.6.1.1.1.1;38 :1.3.6.1.1.1.2;39:1.3.6.1.4.1.7165.4.1;40:1.3.6.1.4.1.7165.4.2;41:MY.CU.ST.OM.OID.1;42:MY.CU.ST.OM.OID.2 replUpToDateVector:: [...] repsFrom:: [...] repsFrom:: [...] repsFrom:: [...] repsTo:: [...] repsTo:: [...] repsTo:: [...] distinguishedName: CN=Schema,CN=Configuration,DC=mydomain,DC=org,DC=uk -- "If we knew what it was we were doing, it would not be called research, would it?" - Albert Einstein

On 9/22/2016 6:31 PM, Garming Sam wrote: > On 23/09/16 00:59, lingpanda101 at gmail.com wrote: >> For clarification I'll add a few things. >> >> I initially deleted all the NTDS site links for each site and allowed >> the new KCC to create them. However it did not create them I believe >> correctly. By that I mean it defined what appeared to be a bridgehead

...s just too late. > I have just found a ugly but working solution: > From Configuration, Schema, Domaindnszones, forestdnszones and principal, I remove using ldbdel a "repsTo" binary object. > No more trouble with drs showrepl :-) Indeed, samba-tool drs showrepl show in fact the repsfrom/repsto attributes. They should be created / deleted by kcc. However I have seen lingering repsto attributes in the past too and had to ldbedit to cleanup the mess. Ldbdel'eting an entry in "CN=Deleted Object" should be done with care. In your case, you still had a repsto referencing...

On 9/28/2016 1:25 AM, garming at catalyst.net.nz wrote: >> >> Wasn't aware of this. Thank you for the info. If I was to delete the >> incorrect respsFrom/repsTo attributes, wouldn't the KCC just >> regenerate them over time once the KCC check and ISTG check kicked in? > > As long as the topology doesn't change or DCs which are not > bridgeheads do not

...40.113556.1.6.23;33:1.2.840.113556.1.6.18.1;34:1.2.840.113556.1.6.1 > 8.2;35:1.2.840.113556.1.6.13.3;36:1.2.840.113556.1.6.13.4;37:1.3.6.1.1.1.1;38 > :1.3.6.1.1.1.2;39:1.3.6.1.4.1.7165.4.1;40:1.3.6.1.4.1.7165.4.2;41:MY.CU.ST.OM.OID.1;42:MY.CU.ST.OM.OID.2 > replUpToDateVector:: [...] > repsFrom:: [...] > repsFrom:: [...] > repsFrom:: [...] > repsTo:: [...] > repsTo:: [...] > repsTo:: [...] > distinguishedName: CN=Schema,CN=Configuration,DC=mydomain,DC=org,DC=uk > > -- > "If we knew what it was we were doing, it would not be called > research, would it?...

...escription of my trouble: https://lists.samba.org/archive/samba/2015-December/196844.html KCC does not remove existing outdated kcc objects by itself (or didn't, if it has been changed in more recent versions). I had a chat with Douglas about this a while back. However it should remove your repsfrom/repsto attribute, unless you messed up the thing (I did once). I also had in the past repsfrom/repsto pointing to deleted NTDSDSA entries with the \0ADEL string. Before asking samba_kcc to buildup the connexions, you have to define the sites, put the DC in the correct site, remove the site from...

...ttacched error. > > with --debug=4 i see that it stops there before failing the join. >> DRS replication uptodate modify message: > dn: DC=mydomain,DC=net > changetype: modify > replace: > replUpToDateVector > replUpToDateVector:: [Data here too] > - > replace: > repsFrom > repsFrom:: [data here] > - > > > Replicated 402 objects (0 > linked attributes) for DC=mydomain,DC=net > > > > If i do the join while DC01 is empty of any ldap records it has no problem. > > I spent a couple of days with this problem searching and trying and i...

...e: replUpToDateVector replUpToDateVector:: AgAAAAAAAAAFAAAAAAAAALgUdhzCVXVMuxIfVOJ3GYADeAAAAAAAAACAP tXesZ0B6N0wH2ir0UWLy1PrObhn21kUAAAAAAAAAIA+1d6xnQFpTVVFfXpKT5ZoIfsOQTKriBQAAA AAAAAAgD7V3rGdAdaEZnKoXVNIkfFhZNHAvutIPgAAAAAAAACAPtXesZ0BwJM1kYDHnUaXglZY/WA t9SNJAAAAAAAAAIA+1d6xnQE= - replace: repsFrom repsFrom:: AQAAAAAAAAALAQAAAAAAADimHREDAAAAOKYdEQMAAAAAAAAA0AAAADsAAABkIEAAERE RERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERER ERERERERERERERERERERERERERERERERAAAAAEg+AAAAAAAAAAAAAAAAAABIPgAAAAAAANldZ8Vsd EBJvgyqOfTn2iPWhGZyqF1TSJHxYWTRwL7rAAAAAAAAAAAAAAAAAAAAADcAA...

...join we fail with the attacched error. with --debug=4 i see that it stops there before failing the join. > DRS replication uptodate modify message: > dn: DC=mydomain,DC=net > changetype: modify > replace: replUpToDateVector > replUpToDateVector:: [Data here too] > - > replace: repsFrom > repsFrom:: [data here] > - > > > Replicated 402 objects (0 linked attributes) for DC=mydomain,DC=net > If i do the join while DC01 is empty of any ldap records it has no problem. I spent a couple of days with this problem searching and trying and i really have no idea how to...

...yAMzBwAAAAAABUiADQMAAAB5CTJ76gkgQZ/R3EKh722VgBMAAAAAAAAAgD7V3rGdASU0K4OwPo5J hZeJgfvJkr/vEgAAAAAAAACAPtXesZ0BLNuomXXda0+AaGlWssQYqBsTAAAAAAAAAIA+1d6xnQEZJ DHD3GZdSJo5+MrbBGDCorgBAAAAAABl7p8NAwAAAMT1D+Gifk5LjnVt/upuUAYGEwAAAAAAAACAPt XesZ0BRgk653wYlUuEmrvsZMo3wyAxAwAAAAAA9Jy/DQMAAAA= - replace: repsFrom repsFrom:: AQAAAAAAAAAPAQAAAAAAAEfdxw0DAAAAR93HDQMAAAAAAAAA0AAAAD8AAAB0AAAAERE RERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERER ERERERERERERERERERERERERERERERERAAAAALkjAAAAAAAAAAAAAAAAAAC5IwAAAAAAAOwZCRo0s CtDqb1rc6O7bG3UBnA1JNVVRYN4On+wEF1BAAAAAAAAAAAAAAAAAAAAADsAA...

Thanks Rowland. In here, I can see the objects I have created using my schema extensions, but I cannot see the schema classes or attributes themselves; I don't know if that is the problem. I'm not sure if by running ldbedit on sam.ldb, this does not include the contents of CN=Schema,CN=Configuration,DC=mydomain,DC=... or if it does include this part of the AD tree and these items are

Hi, It's my first try to setup RODC using Samba 4.8. We have latest Samba 4.7 environnement with 2 DC and some file servers. Joining the DC to the domain is OK using samba-tool domain join command. The domain controller appears in the DC list (MMC) However, users cannot be authenticated. Samba is running but these ports are closed : netbios-ssn 139/tcp # NETBIOS session service

...t but what else? Deleted object are objects which are > not > in use. They have something to do perhaps with replication but they > MUST > NOT be used as valid source (or destination) for replication. So, a > bug. It just means that it has in the past replicated from this DC, as the repsFrom entry is by GUID. It is transformed into a DN at presentation time for display. > > Question 2: as previously said I don't want to have to modify the > tombstoneLifetime because this implies modifying the schema which is > not > something to perform regularly. > What if: &g...