search for: rwdcs

Hello, Recently I started using RODC servers on my environment and noticed a few issues with it: - lack of LDAP SPNs - "samba_dnsupdate" not working with "insufficient access rights" (it works from RWDCs) - "samba-tool dbcheck" changes instancetype of basically all objects from 4 to 0. New replicated objects continues being created with instancetype 4 and dbcheck continues to change them - "samba-tool drs showrepl" exiting with WERR_DS_DRA_ACCESS_DENIED - "samba-tool domain...

...wrote: > > > Hello, > > > > Recently I started using RODC servers on my environment and noticed a > > few issues with it: > > - lack of LDAP SPNs > > - "samba_dnsupdate" not working with "insufficient access rights" (it > > works from RWDCs) > > Probably because you cannot write to an RODC > Yes! That's the idea! But if these records are not automatically registered, means admin always have to add them manually. This should be documented so... > > > - "samba-tool dbcheck" changes instancetype of basic...

...gt; > Recently I started using RODC servers on my environment and > > > > noticed a few issues with it: > > > > - lack of LDAP SPNs > > > > - "samba_dnsupdate" not working with "insufficient access > > > > rights" (it works from RWDCs) > > > > > > Probably because you cannot write to an RODC > > > > > > > Yes! That's the idea! But if these records are not automatically > > registered, means admin always have to add them manually. This should > > be documented so... > >...

...gt; > > > > > Recently I started using RODC servers on my environment and > > > noticed a few issues with it: > > > - lack of LDAP SPNs > > > - "samba_dnsupdate" not working with "insufficient access > > > rights" (it works from RWDCs) > > > > Probably because you cannot write to an RODC > > > > Yes! That's the idea! But if these records are not automatically > registered, means admin always have to add them manually. This should > be documented so... In the Samba world, working RODC's...

...ything. > > Do you really need an RODC ? Hi Rowland, yes we do, for a remote site where we need authorization. I know that e.g. the computer account during join cannot be created on an RODC, we circumvent that by temporarily opening the firewall so that the server can communicate with the RWDCs during join. We also created a separate site with the RODC, associated the local network with it, in the expectation that the computer then will use this DC after the join. But this part does not work. As there is a description for an RODC join on the samba wiki, I suppose there is a way to ach...

...amba <samba at lists.samba.org> wrote: > Hello, > > Recently I started using RODC servers on my environment and noticed a > few issues with it: > - lack of LDAP SPNs > - "samba_dnsupdate" not working with "insufficient access rights" (it > works from RWDCs) Probably because you cannot write to an RODC > - "samba-tool dbcheck" changes instancetype of basically all objects > from 4 to 0. '4' means 'The object is writeable on this directory.', well it isn't on an RODC, so '0' is probably correct. > New...

...> Recently I started using RODC servers on my environment and >>>>> noticed a few issues with it: >>>>> - lack of LDAP SPNs >>>>> - "samba_dnsupdate" not working with "insufficient access >>>>> rights" (it works from RWDCs) >>>> >>>> Probably because you cannot write to an RODC >>>> >>> >>> Yes! That's the idea! But if these records are not automatically >>> registered, means admin always have to add them manually. This should >>> be document...

On Wed, 24 Jan 2024 15:54:38 +0100 Jakob Curdes via samba <samba at lists.samba.org> wrote: > Hello, we have setup a SAMBA4 RODC in our setup where we have two > exisitng RW Samba4 DC's. > > The RODC is joined correctly and can preload user accounts etc. It > also can resolve its own name and the name of other DC's, also the > SRV records needed. > We created