similar to: samba 4.7.0 replication errors

Executing the following with nsupdate seems to have fixed replication. update add 28f7281f-3955-4885-8a7d-42a36ee87590._msdcs.mediture.dom. 900 A 192.168.222.5 show send update add 8b750a53-3d39-4bc0-8fe9-9bffa9e413aa._msdcs.mediture.dom. 900 A 172.16.1.106 show send update add fe066b13-6f9e-4f3c-beb4-37df1292b8cb._msdcs.mediture.dom. 900 A 192.168.168.65 show send New DNS records I create

Did you check that these groups were actually consistent before you upgraded (have you got a backup to look at the old groups)? The consistency checking definitely got stricter in 4.7, but there may still be a bug here. Cheers, Garming On 29/09/17 10:02, Arthur Ramsey via samba wrote: > I fixed this with the following process. > > 1. Identify affected groups with "samba-tool

I increased the debug level to 10 and found this dreplsrv_notify: Failed to send DsReplicaSync to fe066b13-6f9e-4f3c-beb4-37df1292b8cb._msdcs.mediture.dom for DC=DomainDnsZones,DC=mediture,DC=dom - NT_STATUS_OBJECT_NAME_NOT_FOUND : WERR_BADFILE. I manually created the DNS entry, but it doesn't resolve. Other DNS records supplied by BIND_DLZ are working. I tried adding a host file

[2017/09/28 03:46:51.256663, 1] ../source4/dsdb/kcc/kcc_topology.c:2730(kcctpl_get_spanning_tree_edges) ../source4/dsdb/kcc/kcc_topology.c:2730: failed to run Kruskal's algorithm: NT_STATUS_INVALID_PARAMETER [2017/09/28 03:46:51.256953, 1] ../source4/dsdb/kcc/kcc_topology.c:3283(kcctpl_create_connections) ../source4/dsdb/kcc/kcc_topology.c:3283: failed get spanning tree edges:

That bug is reported? Do you have a link? You're saying it is just an issue with the logging or am I correct that this indicates an outbound replication isn't trying. On 03/13/2017 01:45 PM, lingpanda101 via samba wrote: > On 3/13/2017 2:15 PM, Arthur Ramsey via samba wrote: >> Upgraded to 4.6.0 on all nodes. Still seeing the same issue. >> >> If I create an

Upgraded to 4.6.0 on all nodes. Still seeing the same issue. If I create an object on vsc-dc02, epo-dc01 or aws-dc01 DCs it doesn't replicate. If I create it on vsc-dc01 (PDC emulator) then it does replicate. On 03/13/2017 12:13 PM, Arthur Ramsey wrote: > > I believe the problem is a lack of outbound replication for non PDC > emulator DCs. You'll notice isn't even

The errors went away, but replication still isn't working properly. There are objects missing on all DCs, but it isn't consistent at all. showrepl: http://pastebin.com/bYfCZcNG Thanks, Arthur On 10/17/2016 12:32 PM, Arthur Ramsey wrote: > This fixed DNS issues. > > samba_upgradedns --dns-backend=BIND9_DLZ > /usr/local/samba/bin/samba-tool domain exportkeytab >

Replication has been running smoothly until I upgraded to 4.5.0. I had various errors with all BDCs and a force sync didn't resolve it. I shutdown all BDCs, demoted them with --remove-other-dead-server then joined new BDCs with new names. At first replication was intermittently failing (consecutive failures counter kept resetting), but it seemed OK, just slow if anything. Now they all

I seem to be having the same issue as https://lists.samba.org/archive/samba/2012-December/170426.html. I don't see that he ever reached a solution. Nov 20 16:02:58 appdb01-qa sshd[31622]: debug1: Unspecified GSS failure. Minor code may provide more information\nNo key table entry found matching host/appdb01-qa.mediture.dom@\n Nov 20 16:02:58 appdb01-qa sshd[31623]: debug1:

Yeah, I'm trying to setup the Indentikey server on Windows instead so it uses the Windows API instead of LDAP rather than setup a Windows 2008 R2 domain controller for LDAP w/ SASL DIGEST-MD5 authentication. It seems silly for them to use DIGEST-MD5, but that's what I stuck with for now. If samba4 could support DIGEST-MD5 that would be great. Thanks, Arthur On 07/10/2015 03:29 PM,

On 10/19/2016 5:42 PM, Arthur Ramsey via samba wrote: > The errors went away, but replication still isn't working properly. > There are objects missing on all DCs, but it isn't consistent at all. > > showrepl: http://pastebin.com/bYfCZcNG > > Thanks, > Arthur > > On 10/17/2016 12:32 PM, Arthur Ramsey wrote: >> This fixed DNS issues. >> >>

I'm having the same issue as the person here <http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CCcQFjAA&url=http%3A%2F%2Fforum.zentyal.org%2Findex.php%3Ftopic%3D18368.0&ei=fZ8WU4KCJLH_yQH6poDIBg&usg=AFQjCNG2y_hN3Ct-WGP9gwobz8Yrl_DKrA&sig2=jiDkFilv4DCZw50Ay5QV1w&bvm=bv.62286460,d.aWc>. I'm using Samba-4.1.5 as PDC with 3

I believe the problem is a lack of outbound replication for non PDC emulator DCs. You'll notice isn't even trying because last successful was epoch (never) yet there are no errors. Inbound replication for this DC seems fine. [root at vsc-dc02 ~]# samba-tool drs showrepl [...]==== OUTBOUND NEIGHBORS ==== DC=DomainDnsZones,DC=mediture,DC=dom aws\AWS-DC01 via RPC DSA object GUID:

I upgraded Samba from 4.2.0 to 4.3.1 on my domain controllers. Now on 2 of 4 I get the following. Oct 22 15:07:38 dc01 sshd[1372]: pam_winbind(sshd:auth): getting password (0x00000250) Oct 22 15:07:38 dc01 sshd[1372]: pam_winbind(sshd:auth): pam_get_item returned a password Oct 22 15:07:38 dc01 sshd[1372]: pam_winbind(sshd:auth): could not lookup name: #

Hello, I believe there may be a bug with accounts getting erroneously locked in v4.4.5+. I've checked at all the Internet facing services to find the source of account lockout and I've done packet captures at the DCs, but I cannot find the source of lockout. I've got several accounts locking out for seemingly no reason including some service accounts where the passwords

Hello, I'm seeing a huge performance regression with Samba 4.7.3 DLZ and BIND 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.4.  If I remove DLZ external DNS requests are a few ms.  If it is enabled then internal and external DNS requests are a 1-3 seconds or timeout.  Downgrading BIND had no effect. I reverted just the DLZ modules back to 4.7.0 and performance is back to normal: # cp

Error joining Linux member to Samba 4.5.0 DC. /usr/bin/net join -w MEDITURE -S dc01.mediture.dom -U Administrator Enter Administrator's password: Failed to join domain: failed to lookup DC info for domain 'MEDITURE.DOM' over rpc: Indicates the SID structure is not valid. ADS join did not work, falling back to RPC... Thanks, Arthur This e-mail and any attachments may contain

I had the same issue with 4.5.1 vanilla. I was able to reverse the fixes from 11520 against 4.5.1. You can see the resulting patch here: http://pastebin.com/4wTQdLKL. A 4.5.1 build with that patch applied is working fine for me. Thanks, Arthur This e-mail and any attachments may contain CONFIDENTIAL information, including PROTECTED HEALTH INFORMATION. If you are not the intended

Well vsc-dc01 is actually dc01 for the host name, sorry I forgot about that. This e-mail and any attachments may contain CONFIDENTIAL information, including PROTECTED HEALTH INFORMATION. If you are not the intended recipient, any use or disclosure of this information is STRICTLY PROHIBITED; you are requested to delete this e-mail and any attachments, notify the sender immediately, and notify the

I've had this problem as well. We created a domain with two 4.4.4 DCs and everything worked. Sometime after we upgraded the DCs to 4.5.0, the machine joins and some user logons displayed the invalid SID message. We tried recreating the domain from scratch with 4.5.0, but had the same problem. We recreated everything with 4.4.4 , and did not have problems so far. Em 20/10/2016 18:47,