similar to: Schema Change Breaks Replication

I have three S4 DCs (Sernet 4.5.2) all in happy replication, and a Windows 2008r2 DC to which the Exchange scema was added - it has failed to replication the schema/configuration ever since [yet consultants forged onwards]. It is possible to attempt to retry the replication somehow - we have since update the S4 DCs. Something like a "drs replicate --full-sync"?

I removed a DC using the DC removal tool mentioned in http://gallery.technet.microsoft.com/scriptcenter/d31f091f-2642-4ede-9f97-0e1cc4d577f3 as https://bugzilla.samba.org/show_bug.cgi?id=10734 prevents normal DC demotion. The DC was still all over in DNS, so I had to pick it out. Now replication between the remaining three DCs is broken [root at larkin26 ~]# samba-tool drs showrepl

On Mon, 19 Sep 2016 11:57:38 -0400 Adam Tauno Williams via samba <samba at lists.samba.org> wrote: > On Mon, 2016-09-19 at 16:15 +0100, Rowland Penny via samba wrote: > > On Mon, 19 Sep 2016 10:42:34 -0400 > > Adam Tauno Williams via samba <samba at lists.samba.org> wrote: > > > > On Mon, 2016-09-19 at 15:15 +0100, Rowland Penny via samba wrote: > >

On Mon, 19 Sep 2016 10:42:34 -0400 Adam Tauno Williams via samba <samba at lists.samba.org> wrote: > On Mon, 2016-09-19 at 15:15 +0100, Rowland Penny via samba wrote: > > No it shouldn't be replicated, the big hint is > > 'FLAG_ATTR_NOT_REPLICATED', it should only be on the DC that holds > > the > > RID master FSMO role, so I supposed the question is,

On 9/19/2016 1:37 PM, Rowland Penny via samba wrote: > On Mon, 19 Sep 2016 19:19:08 +0200 > Achim Gottinger via samba <samba at lists.samba.org> wrote: > >> >> Am 19.09.2016 um 19:08 schrieb Achim Gottinger via samba: >>> >>> Am 19.09.2016 um 18:21 schrieb Rowland Penny via samba: >>>> On Mon, 19 Sep 2016 11:57:38 -0400 >>>> Adam

On Mon, 2016-12-12 at 19:45 +0000, Rowland Penny via samba wrote: > You seem to be missing two FSMO roles: > > > DomainDnsZonesMasterRole > > > ForestDnsZonesMasterRole > > > Just what version of Samba are you using ? > > My Samba 4.5.2 domain also appears to be missing these roles. > > Can I simply seize these roles? > > [root at larkin27 ~]#

Am 19.09.2016 um 19:08 schrieb Achim Gottinger via samba: > > > Am 19.09.2016 um 18:21 schrieb Rowland Penny via samba: >> On Mon, 19 Sep 2016 11:57:38 -0400 >> Adam Tauno Williams via samba <samba at lists.samba.org> wrote: >> >>> On Mon, 2016-09-19 at 16:15 +0100, Rowland Penny via samba wrote: >>>> On Mon, 19 Sep 2016 10:42:34 -0400

> > Initially, it appears to have worked. ... > > It shows the same on one of the S4 DCs, but the > > DomainDnsZonesMasterRole still shows as "no current owner" on the > > third S4 DC [all Sernet 4.5.2].  Argh. > You could try checking the database on the third DC, 'samba-tool > dbcheck --help' for more info. > You could also try forcing

Adding a Windows2008RC to an SerNET S4 4.5.3 (forest level 2008R2) domain hangs at replication CN=Configuration received 1630 out of approximately 1663 objects.   Only message I can find in the event log on the 2008R2 server is -  Internal event: The local directory service received an exception from a remote procedure call (RPC) connection. Extended error information is not available.  directory

On Sun, 20 Nov 2016 16:50:34 -0500 Adam Tauno Williams <awilliam at whitemice.org> wrote: > On Sun, 2016-11-20 at 21:11 +0000, Rowland Penny via samba wrote: > > On Sun, 20 Nov 2016 15:55:08 -0500 > > Adam Tauno Williams via samba <samba at lists.samba.org> wrote: > > > And it looks like nobody is listening on port 135 - > > > [root at larkin26 ~]#

On Sun, 15 Jan 2017 20:14:12 -0500 Adam Tauno Williams via samba <samba at lists.samba.org> wrote: > On Sun, 2017-01-15 at 14:39 -0500, Adam Tauno Williams via samba > wrote: > > Adding a Windows2008RC to an SerNET S4 4.5.3 (forest level 2008R2) > > domain hangs at replication CN=Configuration received 1630 out of > > approximately 1663 objects. > > Only

I added three DCs to a single DC Samba4 AD domain. They initially replicated and came up - but replication does not appear to be ongoing. A change made to a user via MMC connected to one DC does not appear on another DC. It the logs I see bursts of the following message: [2014/08/12 15:08:08.026270, 0] ../source4/librpc/rpc/dcerpc_util.c:660(dcerpc_pipe_auth_recv) Failed to bind to uuid

On Sat, 2016-11-19 at 09:57 +1300, Andrew Bartlett wrote: > On Fri, 2016-11-18 at 09:41 -0500, Adam Tauno Williams wrote: > > On Fri, 2016-11-18 at 21:32 +1300, Andrew Bartlett wrote: > > > I believe a schema change on a Windows DC (2008rc) has > > > > > > broken > > > > sernet-samba-4.2.14-23.el6.x86_64 - the same package on all > > > >

Package: sernet-samba-4.2.14-23.el6.x86_64 These DCs were very recently upgraded from a prior version. [2016/09/19 09:32:55.168161, 0] ../source4/libcli/smb2/signing.c:116(smb2_check_signature) Bad SMB2 signature for message of size 202 [2016/09/19 09:32:55.168511, 0] ../lib/util/util.c:559(dump_data) [0000] 77 B3 94 9B 70 78 8B 21 1E 56 D0 78 E1 80 BB 5C w...px.! .V.x...\ [2016/09/19

On Sun, 20 Nov 2016 20:12:11 -0500 Adam Tauno Williams via samba <samba at lists.samba.org> wrote: > On Mon, 2016-11-21 at 13:55 +1300, Andrew Bartlett wrote: > > On Sun, 2016-11-20 at 16:50 -0500, Adam Tauno Williams via samba > > wrote: > > > On Sun, 2016-11-20 at 21:11 +0000, Rowland Penny via samba wrote: > > > > On Sun, 20 Nov 2016 15:55:08 -0500

On Sun, 20 Nov 2016 15:55:08 -0500 Adam Tauno Williams via samba <samba at lists.samba.org> wrote: > > And it looks like nobody is listening on port 135 - > > [root at larkin26 ~]# netstat --listen --inet --program --numeric > Active Internet connections (only servers) > Proto Recv-Q Send-Q Local Address Foreign > Address State PID/Program name

On Mon, 19 Sep 2016 09:56:16 -0400 Adam Tauno Williams via samba <samba at lists.samba.org> wrote: > On Mon, 2016-09-19 at 09:31 -0400, Adam Tauno Williams via samba > wrote: > > Package: sernet-samba-4.2.14-23.el6.x86_64 > > These DCs were very recently upgraded from a prior version. > > [2016/09/19 09:32:55.168161, 0] > >

On Mon, 2016-09-19 at 23:46 -0500, Andrew Bartlett via samba wrote: > On Mon, 2016-09-19 at 09:31 -0400, Adam Tauno Williams via samba > wrote: > > > > Package: sernet-samba-4.2.14-23.el6.x86_64 > > > > These DCs were very recently upgraded from a prior version. > > > > [2016/09/19 09:32:55.168161,  0] > >

> You seem to be missing two FSMO roles: > DomainDnsZonesMasterRole > ForestDnsZonesMasterRole > Just what version of Samba are you using ? My Samba 4.5.2 domain also appears to be missing these roles. Can I simply seize these roles? [root at larkin27 ~]# samba-tool fsmo show SchemaMasterRole owner: CN=NTDS Settings,CN=TEMP2008R2DC,CN=Servers,.. InfrastructureMasterRole owner:

Attempting to debug issues with replication I ldapcmd finds differences with the case of the "DC" attribute? Is this normal? LARKIN28 is Samba4 4.5.4, while WINDC1 is Windows 2008R2. [root at larkin28 samba]# samba-tool ldapcmp ldap://larkin28.micore.us ldap://windc1.micore.us -Uadministrator dnsdomain Password for [BACKBONE\administrator]: * Comparing [DNSDOMAIN] context... *