search for: whenchang

Hi all, I have just updated our dc's from sernet 4.1.11 to sernet 4.1.12. And suddenly since that update, we're getting many ldapcmp failures on the attribute 'whenChanged'. In 4.1.11 life was good, and ldapcmp reported no differences at all. Here is a sample: (dc2 <-> dc3) Comparing: 'CN=podcast,CN=Users,DC=samba,DC=company,DC=com' [ldap://dc2] 'CN=podcast,CN=Users,DC=samba,DC=company,DC=com' [ldap://dc3] Difference in attribute v...

Hi Mourik, whenChanged was replicated in my test once I did replicate in both way, so it seems to me it is supposed to be replicated... Then the fact it is not always replicated seems to me an issue. Perhaps a bug report for these two issue (whenChanged not always replicated and ldapcmp hanging once DB is too much fil...

...main.tld --domain=domain --adminpass=Passw0rd Backup DC is joined using: samba-tool domain join domain.tld dc -Uadministrator --realm=domain.tld --domain-critical-only I expect I didn't waited enough for database was fully synchronized as the following command was complaining about some "whenChanged" attribute on different objects. samba-tool ldapcmp ldap://deb2.domain.tld ldap://deb1.domain.tld domain To solve these little differences I first ran: samba-tool drs replicate deb2 deb1 'dc=domain,dc=tld' --sync-all --full-sync --sync-forced This solved most of "whenChanged&q...

Thank you Rowland for these info. So no more issue with 4.2.3 and auto-replication : ) Cheers 2015-09-03 11:52 GMT+02:00 Rowland Penny <rowlandpenny241155 at gmail.com>: > On 03/09/15 09:59, mathias dufresne wrote: > >> Hi Mourik, >> >> whenChanged was replicated in my test once I did replicate in both way, so >> it seems to me it is supposed to be replicated... Then the fact it is not >> always replicated seems to me an issue. >> >> Perhaps a bug report for these two issue (whenChanged not always >> replicated...

...003 ~]# samba-tool drs replicate BPCTASRVSDC003 SRVSMB4-PDC DC=bp,DC=net Replicate from SRVSMB4-PDC to BPCTASRVSDC003 was successful. Looking for one problematic workstation... none [root at BPCTASRVSDC003 ~]# ldbsearch -H /var/lib/samba/private/sam.ldb dNSHostName=CTA1ETTIC018615.bp.net | grep ^whenChanged [root at BPCTASRVSDC003 ~]# Other DC: [root at SRVSMB4-PDC ~]# ldbsearch -H /var/lib/samba/private/sam.ldb dNSHostName=CTA1ETTIC018615.bp.net | grep ^whenChanged whenChanged: 20150902153005.0Z [root at SRVSMB4-PDC ~]# [root at SRVSMB4-PDC ~]# samba-tool ldapcmp ldap://SRVSMB4-PDC ldap://BPCTAS...

...e results for both Domain and Configuration. Similar to the following Comparing: 'CN=Incoming Forest Trust Builders,CN=Builtin,DC=domain,DC=local' [ldap://dc1] 'CN=Incoming Forest Trust Builders,CN=Builtin,DC=domain,DC=local' [ldap://dc2] Difference in attribute values: whenChanged => ['20150216131956.0Z'] ['20150216132002.0Z'] FAILED Comparing: 'CN=Users,CN=Builtin,DC=domain,DC=local' [ldap://dc1] 'CN=Users,CN=Builtin,DC=domain,DC=local' [ldap://dc2] Difference in attribute values: whenChanged => ['20140210152406....

...ended LDIF # # LDAPv3 # base <ou=SUDOers,dc=teemu,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # reima, SUDOers, teemu.local dn: CN=reima,OU=SUDOers,DC=teemu,DC=local objectClass: top objectClass: sudoRole cn: reima instanceType: 4 whenCreated: 20140625194650.0Z whenChanged: 20140625194650.0Z uSNCreated: 3799 uSNChanged: 3799 name: reima objectGUID:: U1paZdVOSke2zmInSenFTg== objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,DC=teemu,DC=local sudoUser: reima sudoHost: ALL sudoCommand: ALL distinguishedName: CN=reima,OU=SUDOers,DC=teemu,DC=local # SUDOers, teemu...

...ended LDIF # # LDAPv3 # base <ou=SUDOers,dc=teemu,dc=local> with scope subtree # filter: (objectclass=*) # requesting: ALL # # reima, SUDOers, teemu.local dn: CN=reima,OU=SUDOers,DC=teemu,DC=local objectClass: top objectClass: sudoRole cn: reima instanceType: 4 whenCreated: 20140625194650.0Z whenChanged: 20140625194650.0Z uSNCreated: 3799 uSNChanged: 3799 name: reima objectGUID:: U1paZdVOSke2zmInSenFTg== objectCategory: CN=sudoRole,CN=Schema,CN=Configuration,DC=teemu,DC=local sudoUser: reima sudoHost: ALL sudoCommand: ALL distinguishedName: CN=reima,OU=SUDOers,DC=teemu,DC=local # SUDOers, teemu...

...s: samba-tool ldapcmp ldap: // DC1 ldap: // DC2 -Uadministrator domain --filter = msDS-NcType, ServerState Comparing: 'CN=Users,CN=Builtin,DC=mydomain,DC=com,DC=br' [ldap://DC1] 'CN=Users,CN=Builtin,DC=mydomain,DC=com,DC=br' [ldap://DC2] Difference in attribute values: whenChanged => ['20150720230414.0Z'] ['20150722233158.0Z'] FAILED Comparing: 'CN=Windows Authorization Access Group,CN=Builtin,DC=mydomain,DC=com,DC=br' [ldap://DC1] 'CN=Windows Authorization Access Group,CN=Builtin,DC=mydomain,DC=com,DC=br' [ldap://DC2] Difference...

...d: 188 Comparing: 'CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local' [ldap://dc01] 'CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local' [ldap://pdc] Attributes found only in ldap://dc01: fSMORoleOwner Difference in attribute values: whenChanged => ['20160622133653.0Z'] ['20160621205006.0Z'] FAILED Comparing: 'CN=MicrosoftDNS,DC=DomainDnsZones,DC=fisherthompson,DC=local' [ldap://dc01] 'CN=MicrosoftDNS,DC=DomainDnsZones,DC=fisherthompson,DC=local' [ldap://pdc] Attributes found only in ldap://dc0...

Hi Mathias, I am under the impression that whenChanged is one of the fields that do not replicate. Therefore we run ldapcmp like: samba-tool ldapcmp ldap://dcX ldap://dcY --filter=whenChanged Hope that helps, MJ On 09/01/2015 02:45 PM, mathias dufresne wrote: > Hi all, > > It seems "samba-tool ldapcmp" does not support too mu...

...Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=knockinc,DC=loc > objectGUID: 98b9225b-a5b9-4351-84f8-253762772cc3 > > # returned 3 records > # 3 entries > # 0 referrals > > ---- > > The only other curiosity I have right now is, why are all the > "whenChanged" attributes off between the DCs? Is that normal after a > certain version of Samba, post v4.1.6? > > I can help you with that as well, find ldapcmp.py on your system, open it in your favourite editor, find this line: # "whenChanged", # This is implicit...

...,CN=ypServ30,CN=RpcServices,CN=System,DC=adtest,DC=int,DC=example,DC=net # record 1 dn: CN=bydefaults,CN=ypservers,CN=ypServ30,CN=RpcServices,CN=System,DC=adtest,DC=int,DC=example,DC=net objectClass: top objectClass: msSFU30NISMapConfig cn: bydefaults instanceType: 4 whenCreated: 20140618075513.0Z whenChanged: 20140618075513.0Z uSNCreated: 3767 uSNChanged: 3767 showInAdvancedViewOnly: TRUE name: bydefaults objectGUID: ac691710-e588-403f-93ed-6840fad3d7de objectCategory: CN=msSFU-30-NIS-Map-Config,CN=Schema,CN=Configuration,DC=adtes t,DC=int,DC=example,DC=net msSFU30KeyAttributes: msSFU30Name msSFU3...

.... When I run the following command, I get inconsistencies errors: # samba-tool ldapcmp ldap://srv14 ldap://srv15 -Uadministrator # samba-tool ldapcmp ldap://srv14 ldap://srv15 -Uadministrator ... * Result for [CONFIGURATION]: FAILURE SUMMARY --------- Attributes with different values: whenChanged * Comparing [SCHEMA] context... * Objects to be compared: 1739 * Result for [SCHEMA]: SUCCESS * Comparing [DNSDOMAIN] context... * Objects to be compared: 243 * Result for [DNSDOMAIN]: SUCCESS * Comparing [DNSFOREST] context... * Objects to be compared: 25 * Result for [DNSFOREST]: SUCC...

...ches for items in the domain section: * Comparing [DOMAIN] context... * Objects to be compared: 625 Comparing: 'CN=AdminRole,OU=Group,OU=Postgres,DC=ourdomain' [ldap://DC1] 'CN=AdminRole,OU=Group,OU=Postgres,DC=ourdomain' [ldap://DC2] Difference in attribute values: whenChanged => ['20160111045058.0Z'] ['20160111045103.0Z'] This is repeated for all other entries in the section, although the timestamps differ. All other sections match perfectly. Is this something to be concerned about or can it be safely ignored? regards, John

...ZGU4NTIyOGMtZjkyYi00ZDVkLTlkNmEtMDFjM2Y5MTVkZWM5 > isDeleted: TRUE > name:: Q0JBREMwMgpERUw6ZGU4NTIyOGMtZjkyYi00ZDVkLTlkNmEtMDFjM2Y5MTVkZWM5 > lastKnownParent: > CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurati > on,DC=cb,DC=cliffbells,DC=com > isRecycled: TRUE > whenChanged: 20160319092438.0Z > uSNChanged: 4261 > distinguishedName: > CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Se > rvers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbell > s,DC=com > > > # record 2372 > dn: CN=NTDS > Settings\0ADE...

...ture,DC=DomainDnsZones,DC=fisherthompson,DC=local' > [ldap://dc01] > 'CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local' > [ldap://pdc] > Attributes found only in ldap://dc01: > fSMORoleOwner > Difference in attribute values: > whenChanged => > ['20160622133653.0Z'] > ['20160621205006.0Z'] > FAILED > > Comparing: > 'CN=MicrosoftDNS,DC=DomainDnsZones,DC=fisherthompson,DC=local' > [ldap://dc01] > 'CN=MicrosoftDNS,DC=DomainDnsZones,DC=fisherthompson,DC=local' > [ldap:...

...00000 primaryGroupID: 513 objectSid: S-1-5-21-1143642306-2581635645-836595807-1605 accountExpires: 9223372036854775807 sAMAccountName: testswi sAMAccountType: 805306368 userPrincipalName: testswi at swi.local objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=swi,DC=local loginShell: /bin/bash whenChanged: 20140605153458.0Z uSNChanged: 13969 distinguishedName: CN=testswi,OU=Benutzer,OU=SWI,DC=swi,DC=local ---------------------------------------------------------------------------------------------------------------------------- nothing changed always /bin/false when i use getent passwd ... 2. i...

...> 4.11 van-belle repo. ) # update 4.10 to 4.11 sed 's/410/411/g'? /etc/apt/sources.list.d/van-belle.list apt update apt dist-upgrade --autoremove --purge apt --fix-broken install apt dist-upgrade --autoremove --purge And its done. ? When running :? samba-tool ldapcmp --filter="whenChanged,dc,DC,cn,CN" ldap://dc1.fqdn ?ldap://dc2.fqdn This works fine, untill i remove the filter.. ? samba-tool ldapcmp? ldap://dc1.fqdn ?ldap://dc2.fqdn This errors out with : * Comparing [DOMAIN] context... ? * Objects to be compared: 845 ERROR(<class 'KeyError'>): uncaught excep...

...cliffbells.com cn:: Q0JBREMwMgpERUw6ZGU4NTIyOGMtZjkyYi00ZDVkLTlkNmEtMDFjM2Y5MTVkZWM5 isDeleted: TRUE name:: Q0JBREMwMgpERUw6ZGU4NTIyOGMtZjkyYi00ZDVkLTlkNmEtMDFjM2Y5MTVkZWM5 lastKnownParent: CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurati on,DC=cb,DC=cliffbells,DC=com isRecycled: TRUE whenChanged: 20160319092438.0Z uSNChanged: 4261 distinguishedName: CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Se rvers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbell s,DC=com # record 2372 dn: CN=NTDS Settings\0ADEL:a5d3b626-e936-4a65-97bc-cade176d1b10,CN=CBADC02\0...