Discussion:
[Samba] FSMO Transfer fail
Anderson Hoffmann do Carmo
2016-07-07 18:57:37 UTC
Permalink
Hi for All!

I am using a Windows Server 2008R2 as primary DC and a Ubuntu Server 16.04
as secundary DC with Samba 4.3.9 (from repository/apt-get).
During a migration test of FSMO roles I received an error from Samba:

***@gteste2:~# samba-tool fsmo transfer --role=all
ERROR: Failed to delete role 'domaindns': LDAP error 50
LDAP_INSUFFICIENT_ACCESS_RIGHTS - <00002098: SecErr: DSID-0315211E,
problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
***@gteste2:~#


After this, I am getting the error below:

***@gteste2:~# samba-tool fsmo show
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 396,
in run
domaindnszonesMaster = get_fsmo_roleowner(samdb, domaindns_dn)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 43, in
get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
***@gteste2:~#


My samba config is:

***@gteste2:~# cat /etc/samba/smb.conf
# Global parameters
[global]
workgroup = TESTEAD
realm = testead.gsurfnet.com
netbios name = GTESTE2
interfaces = lo ens33
bind interfaces only = Yes
server role = active directory domain controller
dns forwarder = 8.8.8.8

[netlogon]
path = /var/lib/samba/sysvol/testead.gsurfnet.com/scripts
read only = No

[sysvol]
path = /var/lib/samba/sysvol
read only = No
***@gteste2:~#



I do not know what to do... :-(


Anderson Hoffmann
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Jason Waters
2016-07-07 19:43:59 UTC
Permalink
try
samba-tool fsmo transfer --role=all -UAdministrator

And see if that works.

On Thu, Jul 7, 2016 at 2:57 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Hi for All!
I am using a Windows Server 2008R2 as primary DC and a Ubuntu Server 16.04
as secundary DC with Samba 4.3.9 (from repository/apt-get).
ERROR: Failed to delete role 'domaindns': LDAP error 50
LDAP_INSUFFICIENT_ACCESS_RIGHTS - <00002098: SecErr: DSID-0315211E,
problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 396,
in run
domaindnszonesMaster = get_fsmo_roleowner(samdb, domaindns_dn)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 43, in
get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
# Global parameters
[global]
workgroup = TESTEAD
realm = testead.gsurfnet.com
netbios name = GTESTE2
interfaces = lo ens33
bind interfaces only = Yes
server role = active directory domain controller
dns forwarder = 8.8.8.8
[netlogon]
path = /var/lib/samba/sysvol/testead.gsurfnet.com/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
I do not know what to do... :-(
Anderson Hoffmann
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Anderson Hoffmann do Carmo
2016-07-07 19:49:08 UTC
Permalink
Fail! :-(

***@gteste2:~# samba-tool fsmo transfer --role=all -UAdministrador
FSMO transfer of 'rid' role successful
FSMO transfer of 'pdc' role successful
FSMO transfer of 'naming' role successful
FSMO transfer of 'infrastructure' role successful
FSMO transfer of 'schema' role successful
ERROR(<type 'exceptions.UnboundLocalError'>): uncaught exception - local
variable 'master_guid' referenced before assignment
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 452,
in run
transfer_dns_role(self.outf, sambaopts, credopts, "domaindns", samdb)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 76, in
transfer_dns_role
master_dns_name = '%s._msdcs.%s' % (master_guid,
***@gteste2:~#
***@gteste2:~#


​Thanks,
​Anderson Hoffmann​
Post by Jason Waters
try
samba-tool fsmo transfer --role=all -UAdministrator
And see if that works.
On Thu, Jul 7, 2016 at 2:57 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Hi for All!
I am using a Windows Server 2008R2 as primary DC and a Ubuntu Server 16.04
as secundary DC with Samba 4.3.9 (from repository/apt-get).
ERROR: Failed to delete role 'domaindns': LDAP error 50
LDAP_INSUFFICIENT_ACCESS_RIGHTS - <00002098: SecErr: DSID-0315211E,
problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 396,
in run
domaindnszonesMaster = get_fsmo_roleowner(samdb, domaindns_dn)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 43, in
get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
# Global parameters
[global]
workgroup = TESTEAD
realm = testead.gsurfnet.com
netbios name = GTESTE2
interfaces = lo ens33
bind interfaces only = Yes
server role = active directory domain controller
dns forwarder = 8.8.8.8
[netlogon]
path = /var/lib/samba/sysvol/testead.gsurfnet.com/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
I do not know what to do... :-(
Anderson Hoffmann
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Jason Waters
2016-07-07 19:50:19 UTC
Permalink
what do you get when you do samba-tool fsmo show,

also try samba-tool fsmo transfer --role=all -UAdministrator
--password=yourpassword



On Thu, Jul 7, 2016 at 3:49 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Fail! :-(
FSMO transfer of 'rid' role successful
FSMO transfer of 'pdc' role successful
FSMO transfer of 'naming' role successful
FSMO transfer of 'infrastructure' role successful
FSMO transfer of 'schema' role successful
ERROR(<type 'exceptions.UnboundLocalError'>): uncaught exception - local
variable 'master_guid' referenced before assignment
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 452,
in run
transfer_dns_role(self.outf, sambaopts, credopts, "domaindns", samdb)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 76,
in transfer_dns_role
master_dns_name = '%s._msdcs.%s' % (master_guid,
​Thanks,
​Anderson Hoffmann​
Post by Jason Waters
try
samba-tool fsmo transfer --role=all -UAdministrator
And see if that works.
On Thu, Jul 7, 2016 at 2:57 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Hi for All!
I am using a Windows Server 2008R2 as primary DC and a Ubuntu Server 16.04
as secundary DC with Samba 4.3.9 (from repository/apt-get).
ERROR: Failed to delete role 'domaindns': LDAP error 50
LDAP_INSUFFICIENT_ACCESS_RIGHTS - <00002098: SecErr: DSID-0315211E,
problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 396,
in run
domaindnszonesMaster = get_fsmo_roleowner(samdb, domaindns_dn)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 43, in
get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
# Global parameters
[global]
workgroup = TESTEAD
realm = testead.gsurfnet.com
netbios name = GTESTE2
interfaces = lo ens33
bind interfaces only = Yes
server role = active directory domain controller
dns forwarder = 8.8.8.8
[netlogon]
path = /var/lib/samba/sysvol/testead.gsurfnet.com/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
I do not know what to do... :-(
Anderson Hoffmann
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Anderson Hoffmann do Carmo
2016-07-07 20:01:48 UTC
Permalink
Hi.

***@gteste2:~#
***@gteste2:~# samba-tool fsmo transfer --role=all -UAdministrador
--password=#######
This DC already has the 'rid' FSMO role
This DC already has the 'pdc' FSMO role
This DC already has the 'naming' FSMO role
This DC already has the 'infrastructure' FSMO role
This DC already has the 'schema' FSMO role
ERROR(<type 'exceptions.UnboundLocalError'>): uncaught exception - local
variable 'master_guid' referenced before assignment
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 452,
in run
transfer_dns_role(self.outf, sambaopts, credopts, "domaindns", samdb)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 76, in
transfer_dns_role
master_dns_name = '%s._msdcs.%s' % (master_guid,
***@gteste2:~#
***@gteste2:~#




***@gteste2:~#
***@gteste2:~#
***@gteste2:~# samba-tool fsmo show
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 396,
in run
domaindnszonesMaster = get_fsmo_roleowner(samdb, domaindns_dn)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 43, in
get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
***@gteste2:~#
***@gteste2:~#



Thanks,
Anderson Hoffmann
Post by Jason Waters
what do you get when you do samba-tool fsmo show,
also try samba-tool fsmo transfer --role=all -UAdministrator
--password=yourpassword
On Thu, Jul 7, 2016 at 3:49 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Fail! :-(
FSMO transfer of 'rid' role successful
FSMO transfer of 'pdc' role successful
FSMO transfer of 'naming' role successful
FSMO transfer of 'infrastructure' role successful
FSMO transfer of 'schema' role successful
ERROR(<type 'exceptions.UnboundLocalError'>): uncaught exception - local
variable 'master_guid' referenced before assignment
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 452,
in run
transfer_dns_role(self.outf, sambaopts, credopts, "domaindns", samdb)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 76,
in transfer_dns_role
master_dns_name = '%s._msdcs.%s' % (master_guid,
​​
Post by Jason Waters
Post by Anderson Hoffmann do Carmo
​Thanks,
​Anderson Hoffmann​
Post by Jason Waters
try
samba-tool fsmo transfer --role=all -UAdministrator
And see if that works.
On Thu, Jul 7, 2016 at 2:57 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Hi for All!
I am using a Windows Server 2008R2 as primary DC and a Ubuntu Server 16.04
as secundary DC with Samba 4.3.9 (from repository/apt-get).
ERROR: Failed to delete role 'domaindns': LDAP error 50
LDAP_INSUFFICIENT_ACCESS_RIGHTS - <00002098: SecErr: DSID-0315211E,
problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 396,
in run
domaindnszonesMaster = get_fsmo_roleowner(samdb, domaindns_dn)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 43, in
get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
# Global parameters
[global]
workgroup = TESTEAD
realm = testead.gsurfnet.com
netbios name = GTESTE2
interfaces = lo ens33
bind interfaces only = Yes
server role = active directory domain controller
dns forwarder = 8.8.8.8
[netlogon]
path = /var/lib/samba/sysvol/testead.gsurfnet.com/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
I do not know what to do... :-(
Anderson Hoffmann
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Anderson Hoffmann do Carmo
2016-07-08 12:28:20 UTC
Permalink
Hi for all!
Great news!
The procedure worked properly and fix the problem. Thank you so much 'Jason
Waters' and 'Rowland Penny' for Support :-)

***@gteste2:/anderson#
****@gteste2:/anderson# ldbmodify -H /var/lib/samba/private/sam.ldb
--cross-ncs ./fsmofixdomaindns.ldif*
Modified 1 records successfully
****@gteste2:/anderson# ldbmodify -H /var/lib/samba/private/sam.ldb
--cross-ncs ./fsmofixforestdns.ldif*
Modified 1 records successfully
***@gteste2:/anderson#


***@gteste2:/anderson#
****@gteste2:/anderson# samba-tool fsmo show*
SchemaMasterRole owner: CN=NTDS
Settings,CN=GTESTE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testead,DC=gsurfnet,DC=com
InfrastructureMasterRole owner: CN=NTDS
Settings,CN=GTESTE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testead,DC=gsurfnet,DC=com
RidAllocationMasterRole owner: CN=NTDS
Settings,CN=GTESTE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testead,DC=gsurfnet,DC=com
PdcEmulationMasterRole owner: CN=NTDS
Settings,CN=GTESTE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testead,DC=gsurfnet,DC=com
DomainNamingMasterRole owner: CN=NTDS
Settings,CN=GTESTE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testead,DC=gsurfnet,DC=com
DomainDnsZonesMasterRole owner: CN=NTDS
Settings,CN=GTESTE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testead,DC=gsurfnet,DC=com
ForestDnsZonesMasterRole owner: CN=NTDS
Settings,CN=GTESTE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=testead,DC=gsurfnet,DC=com
***@gteste2:/anderson#


***@gteste2:/anderson#
****@gteste2:/anderson# samba-tool fsmo transfer --role=all
-UAdministrador --password=######*
This DC already has the 'rid' FSMO role
This DC already has the 'pdc' FSMO role
This DC already has the 'naming' FSMO role
This DC already has the 'infrastructure' FSMO role
This DC already has the 'schema' FSMO role
This DC already has the 'domaindns' FSMO role
This DC already has the 'forestdns' FSMO role
***@gteste2:/anderson#


​Thanks,​

Anderson Hoffmann
This will help
http://poster.bshellz.net/samba/Ubuntu_14.04_4.1.6_to_4.3.8_Upgrade_Notes.txt
But basically you want to do this.
Create two files, fsmofixdomaindns.ldif
# For DomainDnsZonesMasterRole
dn: CN=Infrastructure,DC=DomainDnsZones,dc=test,dc=local
changetype: modify
replace: fSMORoleOwner
fSMORoleOwner: CN=NTDS Settings,CN=SAMBA4-DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=test,DC=local
and fsmofixforestdns.ldif
# For ForestDnsZonesMasterRole
dn: CN=Infrastructure,DC=ForestDnsZones,dc=test,dc=local
changetype: modify
replace: fSMORoleOwner
fSMORoleOwner: CN=NTDS Settings,CN=SAMBA4-DC1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=test,DC=local
Then modify them with these commands
ldbmodify -H /var/lib/samba/private/sam.ldb --cross-ncs ./fsmofixdomaindns.ldif
ldbmodify -H /var/lib/samba/private/sam.ldb --cross-ncs ./fsmofixforestdns.ldif
Then run the samba-tool fsmo show and you should see them all.
On Thu, Jul 7, 2016 at 4:01 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Hi.
--password=#######
This DC already has the 'rid' FSMO role
This DC already has the 'pdc' FSMO role
This DC already has the 'naming' FSMO role
This DC already has the 'infrastructure' FSMO role
This DC already has the 'schema' FSMO role
ERROR(<type 'exceptions.UnboundLocalError'>): uncaught exception - local
variable 'master_guid' referenced before assignment
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 452,
in run
transfer_dns_role(self.outf, sambaopts, credopts, "domaindns", samdb)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 76,
in transfer_dns_role
master_dns_name = '%s._msdcs.%s' % (master_guid,
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 396,
in run
domaindnszonesMaster = get_fsmo_roleowner(samdb, domaindns_dn)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 43,
in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
Thanks,
Anderson Hoffmann
Post by Jason Waters
what do you get when you do samba-tool fsmo show,
also try samba-tool fsmo transfer --role=all -UAdministrator
--password=yourpassword
On Thu, Jul 7, 2016 at 3:49 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Fail! :-(
FSMO transfer of 'rid' role successful
FSMO transfer of 'pdc' role successful
FSMO transfer of 'naming' role successful
FSMO transfer of 'infrastructure' role successful
FSMO transfer of 'schema' role successful
ERROR(<type 'exceptions.UnboundLocalError'>): uncaught exception -
local variable 'master_guid' referenced before assignment
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line
452, in run
transfer_dns_role(self.outf, sambaopts, credopts, "domaindns", samdb)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line
76, in transfer_dns_role
master_dns_name = '%s._msdcs.%s' % (master_guid,
​​
Post by Jason Waters
Post by Anderson Hoffmann do Carmo
​Thanks,
​Anderson Hoffmann​
Post by Jason Waters
try
samba-tool fsmo transfer --role=all -UAdministrator
And see if that works.
On Thu, Jul 7, 2016 at 2:57 PM, Anderson Hoffmann do Carmo <
Post by Anderson Hoffmann do Carmo
Hi for All!
I am using a Windows Server 2008R2 as primary DC and a Ubuntu Server 16.04
as secundary DC with Samba 4.3.9 (from repository/apt-get).
ERROR: Failed to delete role 'domaindns': LDAP error 50
LDAP_INSUFFICIENT_ACCESS_RIGHTS - <00002098: SecErr: DSID-0315211E,
problem 4003 (INSUFF_ACCESS_RIGHTS), data 0
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line
175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 396,
in run
domaindnszonesMaster = get_fsmo_roleowner(samdb, domaindns_dn)
File "/usr/lib/python2.7/dist-packages/samba/netcmd/fsmo.py", line 43, in
get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
# Global parameters
[global]
workgroup = TESTEAD
realm = testead.gsurfnet.com
netbios name = GTESTE2
interfaces = lo ens33
bind interfaces only = Yes
server role = active directory domain controller
dns forwarder = 8.8.8.8
[netlogon]
path = /var/lib/samba/sysvol/testead.gsurfnet.com/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
I do not know what to do... :-(
Anderson Hoffmann
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Continue reading on narkive:
Loading...