[Samba] Unable to transfer ForestDns/DomainDNS

[Jason Waters]

I'm working my way off of our Windows 2003 R2 Domain Server. That machine
is called PDC, sorry really bad planning so many years ago! So my end goal
is to have two samba4 domain controllers. They are setup and joined as
DC's, dc01 and dc02. I have most of my files off of PDC but would like to
keep it up for a little longer to make sure I have everything off of there.


So I tried transferring all the roles. The first 5 worked great, the last
two, ForestDns/DomainDns fail with this error.

***@DC01:~# samba-tool fsmo transfer --role=domaindns -UAdministrator
Password for [FISHERTHOMPSON\Administrator]:
ERROR: Failed to delete role 'domaindns': LDAP error 16
LDAP_NO_SUCH_ATTRIBUTE - <00002085: AtrErr: DSID-03151B93, #1:
0: 00002085: DSID-03151B93, problem 1001 (NO_ATTRIBUTE_OR_VAL),
data 0, Att 90171 (fSMORoleOwner):len 286

<>

***@DC01:~# samba-tool fsmo transfer --role=forestdns -UAdministrator
Password for [FISHERTHOMPSON\Administrator]:
ERROR: Failed to delete role 'forestdns': LDAP error 16
LDAP_NO_SUCH_ATTRIBUTE - <00002085: AtrErr: DSID-03151B93, #1:
0: 00002085: DSID-03151B93, problem 1001 (NO_ATTRIBUTE_OR_VAL),
data 0, Att 90171 (fSMORoleOwner):len 286

<>

Ideally I would get the transfer to just work, but if I can't do that then
I have a question about the path forward. Since I would like to keep the
PDC up, do I run dcpromo on PDC(Win2003) and get it out of the domain and
then do the samba-tool fsmo seize, or the other way around? Or doesn't it
matter? My concern is the big scary messages about NEVER EVER start the
machine again that you seized the fsmo from for fear of your entire AD
blowing up and zombie apocalypse starting. But I thought once you run the
dcpromo and demote the DC active directory is gone and then it won't break
AD on the good domain.

So if you could

1. Help me resolve my issue so I can do the transfer, that would be
awesome.

2. If that doesn't work, tell me the correct order of seize and dcpromo.

Thanks for the help!

Jason
irc: jch2os


Some information about the samba dc's

Welcome to Ubuntu 14.04.4 LTS (GNU/Linux 3.13.0-88-generic x86_64)

***@DC01:~# samba-tool domain level show
Domain and forest function level for domain 'DC=fisherthompson,DC=local'

Forest function level: (Windows) 2003
Domain function level: (Windows) 2003
Lowest function level of a DC: (Windows) 2003


***@DC01:~# dpkg -l |grep samba
ii python-samba 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Python bindings for Samba
ii samba 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 SMB/CIFS file, print, and login server for Unix
ii samba-common 2:4.3.9+dfsg-0ubuntu0.14.04.3
all common files used by both the Samba server and client
ii samba-common-bin 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Samba common files used by both the server and the client
ii samba-dsdb-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Samba Directory Services Database
ii samba-libs:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Samba core libraries
ii samba-vfs-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Samba Virtual FileSystem plugins
***@DC01:~# samba-tool fsmo show
SchemaMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
InfrastructureMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
RidAllocationMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
PdcEmulationMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
DomainNamingMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
DomainDnsZonesMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
ForestDnsZonesMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local

[Jason Waters]

This is what it returned.

***@DC01:/mnt# ldbsearch --cross-ncs -H /var/lib/samba/private/sam.ldb -b
"CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local" -s base
fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local
fSMORoleOwner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,C
N=Sites,CN=Configuration,DC=fisherthompson,DC=local

# returned 1 records
# 1 entries
# 0 referrals


Looks right, right? It almost seems like it is trying to delete it from
the Windows 2003 machine, but can't. So I ran NetDOM /query FSMO on the
windows 2003 server and got this.

Schema owner PDC.fisherthompson.local
Domain role owner PDC.fisherthompson.local
PDC role PDC.fisherthompson.local
RID pool manager PDC.fisherthompson.local
Infrastructure owner PDC.fisherthompson.local
The command completed successfully.

So no DomainDNS or ForestDNS present.

Post by Jason Waters
I'm working my way off of our Windows 2003 R2 Domain Server. That machine
is called PDC, sorry really bad planning so many years ago! So my end goal
is to have two samba4 domain controllers. They are setup and joined as
DC's, dc01 and dc02. I have most of my files off of PDC but would like to
keep it up for a little longer to make sure I have everything off of there.
So I tried transferring all the roles. The first 5 worked great, the last
two, ForestDns/DomainDns fail with this error.
ERROR: Failed to delete role 'domaindns': LDAP error 16
0: 00002085: DSID-03151B93, problem 1001 (NO_ATTRIBUTE_OR_VAL),
data 0, Att 90171 (fSMORoleOwner):len 286

<>

ERROR: Failed to delete role 'forestdns': LDAP error 16
0: 00002085: DSID-03151B93, problem 1001 (NO_ATTRIBUTE_OR_VAL),
data 0, Att 90171 (fSMORoleOwner):len 286

<>

Ideally I would get the transfer to just work, but if I can't do that then
I have a question about the path forward. Since I would like to keep the
PDC up, do I run dcpromo on PDC(Win2003) and get it out of the domain and
then do the samba-tool fsmo seize, or the other way around? Or doesn't it
matter? My concern is the big scary messages about NEVER EVER start the
machine again that you seized the fsmo from for fear of your entire AD
blowing up and zombie apocalypse starting. But I thought once you run the
dcpromo and demote the DC active directory is gone and then it won't break
AD on the good domain.
So if you could
1. Help me resolve my issue so I can do the transfer, that would be
awesome.
2. If that doesn't work, tell me the correct order of seize and dcpromo.
Thanks for the help!
Jason
irc: jch2os
Some information about the samba dc's
Welcome to Ubuntu 14.04.4 LTS (GNU/Linux 3.13.0-88-generic x86_64)
Domain and forest function level for domain 'DC=fisherthompson,DC=local'
Forest function level: (Windows) 2003
Domain function level: (Windows) 2003
Lowest function level of a DC: (Windows) 2003
ii python-samba 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Python bindings for Samba
ii samba 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 SMB/CIFS file, print, and login server for Unix
ii samba-common 2:4.3.9+dfsg-0ubuntu0.14.04.3
all common files used by both the Samba server and client
ii samba-common-bin 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Samba common files used by both the server and the client
ii samba-dsdb-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Samba Directory Services Database
ii samba-libs:amd64 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Samba core libraries
ii samba-vfs-modules 2:4.3.9+dfsg-0ubuntu0.14.04.3
amd64 Samba Virtual FileSystem plugins
SchemaMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
InfrastructureMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
RidAllocationMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
PdcEmulationMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
DomainNamingMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
DomainDnsZonesMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
ForestDnsZonesMasterRole owner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local

The error seems to say it all: 'LDAP_NO_SUCH_ATTRIBUTE' at this point
fsmo.py is trying to delete the 'fsMORoleOwner' attribute and its contents,
but for some reason it is saying it isn't there.
Can you run this command on the DC you are trying to transfer the FSMO
ldbsearch --cross-ncs -H /var/lib/samba/private/sam.ldb -b
"CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local" -s base
fsmoroleowner
"CN=Infrastructure,DC=DomainDnsZones,DC=samdom,DC=example,DC=com" -s base
fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=DomainDnsZones,DC=samdom,DC=example,DC=com
fSMORoleOwner: CN=NTDS
Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,C
N=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
# returned 1 records
# 1 entries
# 0 referrals
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

I did not get SUCCESS!

***@DC01:/mnt# samba-tool ldapcmp ldap://dc01 ldap://pdc dnsdomain

* Comparing [DNSDOMAIN] context...

* Objects to be compared: 188

Comparing:
'CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local'
[ldap://dc01]
'CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local'
[ldap://pdc]
Attributes found only in ldap://dc01:
fSMORoleOwner
Difference in attribute values:
whenChanged =>
['20160622133653.0Z']
['20160621205006.0Z']
FAILED

Comparing:
'CN=MicrosoftDNS,DC=DomainDnsZones,DC=fisherthompson,DC=local' [ldap://dc01]
'CN=MicrosoftDNS,DC=DomainDnsZones,DC=fisherthompson,DC=local' [ldap://pdc]
Attributes found only in ldap://dc01:
distinguishedName
cn
objectCategory
objectClass
objectGUID
showInAdvancedViewOnly
whenCreated
whenChanged
instanceType
name
FAILED

* Result for [DNSDOMAIN]: FAILURE

SUMMARY
---------

Attributes found only in ldap://dc01:

distinguishedName
cn
objectCategory
objectClass
fSMORoleOwner
objectGUID
showInAdvancedViewOnly
whenCreated
whenChanged
instanceType
name

Attributes with different values:

whenChanged
ERROR: Compare failed: -1

Post by Jason Waters
This is what it returned.
-b "CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local" -s base
fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local
fSMORoleOwner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,C
N=Sites,CN=Configuration,DC=fisherthompson,DC=local
# returned 1 records
# 1 entries
# 0 referrals
Looks right, right? It almost seems like it is trying to delete it from
the Windows 2003 machine, but can't. So I ran NetDOM /query FSMO on the
windows 2003 server and got this.
Schema owner PDC.fisherthompson.local
Domain role owner PDC.fisherthompson.local
PDC role PDC.fisherthompson.local
RID pool manager PDC.fisherthompson.local
Infrastructure owner PDC.fisherthompson.local
The command completed successfully.
So no DomainDNS or ForestDNS present.

Unfortunately that doesn't mean anything, the windows tools only seem to
known about the five main FSMO roles (as did samba-tool up until 4.3.0)
Try this command, it should end with the word 'SUCCESS'
samba-tool ldapcmp ldap://dc01 ldap://pdc dnsdomain
Does the windows DC run a DNS server ?
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

lol...sorry!

- The windows domain controller does run a DNS server

- I joined the samba DC's to the windows DC. I used the normal command,
but did get an error about the forest and domain dns. The error is:

descriptor_sd_propagation_recursive:
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
descriptor_sd_propagation_recursive:
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local


Below is the full join output.....


START OF DOMAIN JOIN
*************************************
***@DC01:/var/lib/samba# samba-tool domain join fisherthompson.local DC
-UAdministrator
Finding a writeable DC for domain 'fisherthompson.local'
Found DC PDC.fisherthompson.local
Password for [FISHERTHOMPSON\Administrator]:
workgroup is FISHERTHOMPSON
realm is fisherthompson.local
checking sAMAccountName
Adding CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Adding
CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding CN=NTDS
Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding SPNs to CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Setting account password for DC01$
Enabling account
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
A Kerberos configuration suitable for Samba 4 has been generated at
/var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=fisherthompson,DC=local
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1376] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[402]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[804]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1206]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1608]
linked_values[18]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1629]
linked_values[10]
Replicating critical objects from the base DN of the domain
Partition[DC=fisherthompson,DC=local] objects[93] linked_values[7]
Partition[DC=fisherthompson,DC=local] objects[387] linked_values[0]
Partition[DC=fisherthompson,DC=local] objects[569] linked_values[175]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[36]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
descriptor_sd_propagation_recursive:
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
descriptor_sd_propagation_recursive:
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain FISHERTHOMPSON (SID
S-1-5-21-4059926353-2957580592-3733343930) as a DC

*************************************
END OF DOMAIN JOIN

Post by Jason Waters
I did not get SUCCESS!
* Comparing [DNSDOMAIN] context...
* Objects to be compared: 188
'CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local'
[ldap://dc01]
'CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local'
[ldap://pdc]
fSMORoleOwner
whenChanged =>
['20160622133653.0Z']
['20160621205006.0Z']
FAILED
'CN=MicrosoftDNS,DC=DomainDnsZones,DC=fisherthompson,DC=local' [ldap://dc01]
'CN=MicrosoftDNS,DC=DomainDnsZones,DC=fisherthompson,DC=local' [ldap://pdc]
distinguishedName
cn
objectCategory
objectClass
objectGUID
showInAdvancedViewOnly
whenCreated
whenChanged
instanceType
name
FAILED
* Result for [DNSDOMAIN]: FAILURE
SUMMARY
---------
distinguishedName
cn
objectCategory
objectClass
fSMORoleOwner
objectGUID
showInAdvancedViewOnly
whenCreated
whenChanged
instanceType
name
whenChanged
ERROR: Compare failed: -1
This is what it returned.
/var/lib/samba/private/sam.ldb -b
"CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local"
-s base fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=DomainDnsZones,DC=fisherthompson,DC=local
fSMORoleOwner: CN=NTDS
Settings,CN=PDC,CN=Servers,CN=Default-First-Site-Name,C
N=Sites,CN=Configuration,DC=fisherthompson,DC=local
# returned 1 records
# 1 entries
# 0 referrals
Looks right, right? It almost seems like it is trying to
delete it from the Windows 2003 machine, but can't. So I ran
NetDOM /query FSMO on the windows 2003 server and got this.
Schema owner PDC.fisherthompson.local
Domain role owner PDC.fisherthompson.local
PDC role PDC.fisherthompson.local
RID pool manager PDC.fisherthompson.local
Infrastructure owner PDC.fisherthompson.local
The command completed successfully.
So no DomainDNS or ForestDNS present.
Unfortunately that doesn't mean anything, the windows tools only
seem to known about the five main FSMO roles (as did samba-tool up
until 4.3.0)
Try this command, it should end with the word 'SUCCESS'
samba-tool ldapcmp ldap://dc01 ldap://pdc dnsdomain
Does the windows DC run a DNS server ?
Rowland
-- To unsubscribe from this list go to the following URL and read
the
instructions: https://lists.samba.org/mailman/options/samba

That sort of means you don't have dns zones on your windows DC, or at
least full ones.
Does your windows DC run a DNS server ??
How did you join the Samba DCs to the windows DC, or was it the opposite
way round, you joined the windows one to the Samba DCs, if so how.
I feel another possible re-write of fsmo.py coming on :-(
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

The built in DNS, sorry if that sounded like it was special! So do I just
seize it then? And do I do that before or after dcpromo? Thanks for the
help.

Jason

Post by Jason Waters
lol...sorry!
- The windows domain controller does run a DNS server
- I joined the samba DC's to the windows DC. I used the normal command,
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Below is the full join output.....
START OF DOMAIN JOIN
*************************************
-UAdministrator
Finding a writeable DC for domain 'fisherthompson.local'
Found DC PDC.fisherthompson.local
workgroup is FISHERTHOMPSON
realm is fisherthompson.local
checking sAMAccountName
Adding CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Adding
CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding CN=NTDS
Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding SPNs to CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Setting account password for DC01$
Enabling account
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
A Kerberos configuration suitable for Samba 4 has been generated at
/var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=fisherthompson,DC=local
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1376] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[402]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[804]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1206]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1608]
linked_values[18]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1629]
linked_values[10]
Replicating critical objects from the base DN of the domain
Partition[DC=fisherthompson,DC=local] objects[93] linked_values[7]
Partition[DC=fisherthompson,DC=local] objects[387] linked_values[0]
Partition[DC=fisherthompson,DC=local] objects[569] linked_values[175]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[36]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain FISHERTHOMPSON (SID
S-1-5-21-4059926353-2957580592-3733343930) as a DC
*************************************
END OF DOMAIN JOIN

It looks like your windows DC doesn't store its DNS zones in AD, the code
print "Done with always replicated NC (base, config, schema)"
print "Replicating %s" % (str(nc))
repl.replicate(nc, source_dsa_invocation_id,
destination_dsa_guid, rodc=ctx.RODC,
replica_flags=ctx.replica_flags)
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
I 'think' the last two lines mean nothing was replicated because there was
nothing to replicate to or from.
You say your windows DC runs a DNS server, what sort & type ?
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

This is the output of that command.

***@DC01:~# ldbsearch --cross-ncs -H ldap://pdc -b
"DC=DomainDnsZones,DC=fisherthompson,DC=local" -s sub -Uadministrator
Password for [FISHERTHOMPSON\administrator]:
search error - LDAP error 10 LDAP_REFERRAL - <0000202B: RefErr:
DSID-0310063C, data 0, 1 access points
ref 1: 'DomainDnsZones.fisherthompson.local'
<ldap://DomainDnsZones.fisherthompson.local/DC=DomainDnsZones,DC=fisherthompson,DC=local>
***@DC01:~#


wouldn't dcpromo take it out of the active directory? And then seizing it
would have the domain point to the new DC? I have some printers and things
like that that I would really like time to transfer. But if I can't I
can't....Or maybe even block with iptables any traffic from PDC to DC01 or
DC02?

Post by Jason Waters
The built in DNS, sorry if that sounded like it was special! So do I
just seize it then? And do I do that before or after dcpromo? Thanks for
the help.
Jason

I think you are going to have to, but I would try a further slight test
ldbsearch --cross-ncs -H ldap://pdc -b
"DC=DomainDnsZones,DC=fisherthompson,DC=local" -s sub -Uadministrator
This should display all your DNS records
Just double check that they don't exist.
If you then go on to seize the roles, use the '--force' option with
'samba-tool fsmo seize' , this will bypass trying to transfer the role
first.
I would transfer anything on the windows DC that you may need, then turn
it off. You should then be able to seize the roles. Do not bring the old DC
back on line unless you stop the DC software from starting, I would also
change its hostname and if possible, its ipaddress.
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

You said, "From what you posted earlier, the domain already points to the
new DC, you just need to get the DNS fsmo roles."

how so? The fsmo show, shows PDC, which is the old DC. DC01 is the new
one. Or am I missing something else?

As far as keeping it online I will just move everything I can and then
seize and shut it down. I can turn off the networking to it since it is a
VM and still see some things. Won't the new DC's(DC01,DC02) still
have replication information about PDC though? the seize command wouldn't
adjust that?

Post by Jason Waters
This is the output of that command.
"DC=DomainDnsZones,DC=fisherthompson,DC=local" -s sub -Uadministrator
DSID-0310063C, data 0, 1 access points
ref 1: 'DomainDnsZones.fisherthompson.local'
<ldap://DomainDnsZones.fisherthompson.local/DC=DomainDnsZones,DC=fisherthompson,DC=local>
wouldn't dcpromo take it out of the active directory?

I haven't a clue :-)
I have never used dcpromo, but from my dealings with microsoft, dcpromo
probably is another name for dcdelete :-D
And then seizing it would have the domain point to the new DC?
From what you posted earlier, the domain already points to the new DC, you
just need to get the DNS fsmo roles.
I have some printers and things like that that I would really like time

Post by Jason Waters
to transfer.

https://wiki.samba.org/index.php/Print_server_support
https://wiki.samba.org/index.php/Shares_with_Windows_ACLs
But if I can't I can't....Or maybe even block with iptables any traffic

Post by Jason Waters
from PDC to DC01 or DC02?

The problem with the old DC, is not so much the old DC, but with what is
in AD, if you can be sure that all references to the old DC being in charge
of anything is removed, then you probably can still use it, but there is
the problem of lack of DNS info in the old DCs AD.
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

But that wasn't till 4.4? Right? I don't have that option with my
version. I guess if I need to I could just spin up a new vm, build the
source, join as DC, and then do that to remove it and the demote the new VM
DC. Right?

Post by Jason Waters
You said, "From what you posted earlier, the domain already points to the
new DC, you just need to get the DNS fsmo roles."
how so? The fsmo show, shows PDC, which is the old DC. DC01 is the new
one. Or am I missing something else?

bad choice of words, 'you just need to get the DNS fsmo roles' should have
been 'you just need to ensure the new DC has the DNS fsmo roles'

Post by Jason Waters
As far as keeping it online I will just move everything I can and then
seize and shut it down. I can turn off the networking to it since it is a
VM and still see some things. Won't the new DC's(DC01,DC02) still have
replication information about PDC though? the seize command wouldn't
adjust that?

True, but 'samba-tool domain demote' now has a new option
'--remove-other-dead-server' which should remove all info about PDC i.e.
samba-tool domain demote --remove-other-dead-server=pdc
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

Which a quick way of doing that would be for me to cp the /var/lib/samba
directory when samba is not running, right? And my /etc/samba/ folder?

Since I have the distribution package it isn't all in /usr/local/samba
anymore.


What is the official way to move from windows 2003 server to samba? I was
thinking it was this:

transfer the roles
dcpromo on the windows box
get a beer because you have one less windows server?

Post by Jason Waters
But that wasn't till 4.4? Right? I don't have that option with my
version. I guess if I need to I could just spin up a new vm, build the
source, join as DC, and then do that to remove it and the demote the new VM
DC. Right?

Well that is one way of doing it and it should work, but as always, back
everything up first.
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

I still feel like there is something I can do to get the 2003 server to
have what I need to do a fsmo transfer instead of a seize. Doesn't that
check box say to store it inside AD?

Loading Image...
Loading Image...

I still feel like there is something I can do to get the 2003 server to
have what I need to do a fsmo transfer instead of a seize. Doesn't that
check box say to store it inside AD?

Post by Jason Waters
lol...sorry!
- The windows domain controller does run a DNS server
- I joined the samba DC's to the windows DC. I used the normal command,
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Below is the full join output.....
START OF DOMAIN JOIN
*************************************
DC -UAdministrator
Finding a writeable DC for domain 'fisherthompson.local'
Found DC PDC.fisherthompson.local
workgroup is FISHERTHOMPSON
realm is fisherthompson.local
checking sAMAccountName
Adding CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Adding
CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding CN=NTDS
Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding SPNs to CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Setting account password for DC01$
Enabling account
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
A Kerberos configuration suitable for Samba 4 has been generated at
/var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=fisherthompson,DC=local
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1376] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[402]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[804]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1206]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1608]
linked_values[18]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1629]
linked_values[10]
Replicating critical objects from the base DN of the domain
Partition[DC=fisherthompson,DC=local] objects[93] linked_values[7]
Partition[DC=fisherthompson,DC=local] objects[387] linked_values[0]
Partition[DC=fisherthompson,DC=local] objects[569] linked_values[175]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[36]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain FISHERTHOMPSON (SID
S-1-5-21-4059926353-2957580592-3733343930) as a DC
*************************************
END OF DOMAIN JOIN

It looks like your windows DC doesn't store its DNS zones in AD, the code
print "Done with always replicated NC (base, config, schema)"
print "Replicating %s" % (str(nc))
repl.replicate(nc, source_dsa_invocation_id,
destination_dsa_guid, rodc=ctx.RODC,
replica_flags=ctx.replica_flags)
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
I 'think' the last two lines mean nothing was replicated because there
was nothing to replicate to or from.
You say your windows DC runs a DNS server, what sort & type ?
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

So I setup a testing environment so I can test/break things. I think my
issue is that something is screwed up with the Partitions on the windows
2003 server. The forest and domain partitions look odd, are they?

Mine looks kind of like this...

Loading Image...

Post by Jason Waters
I still feel like there is something I can do to get the 2003 server to
have what I need to do a fsmo transfer instead of a seize. Doesn't that
check box say to store it inside AD?
http://i.imgur.com/UolzBwP.png
http://i.imgur.com/tHTmB5c.png

Post by Jason Waters
I still feel like there is something I can do to get the 2003 server to
have what I need to do a fsmo transfer instead of a seize. Doesn't that
check box say to store it inside AD?

Post by Jason Waters
lol...sorry!
- The windows domain controller does run a DNS server
- I joined the samba DC's to the windows DC. I used the normal
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Below is the full join output.....
START OF DOMAIN JOIN
*************************************
DC -UAdministrator
Finding a writeable DC for domain 'fisherthompson.local'
Found DC PDC.fisherthompson.local
workgroup is FISHERTHOMPSON
realm is fisherthompson.local
checking sAMAccountName
Adding CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Adding
CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding CN=NTDS
Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding SPNs to CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Setting account password for DC01$
Enabling account
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
A Kerberos configuration suitable for Samba 4 has been generated at
/var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=fisherthompson,DC=local
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1376] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[402]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[804]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1206]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1608]
linked_values[18]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1629]
linked_values[10]
Replicating critical objects from the base DN of the domain
Partition[DC=fisherthompson,DC=local] objects[93] linked_values[7]
Partition[DC=fisherthompson,DC=local] objects[387] linked_values[0]
Partition[DC=fisherthompson,DC=local] objects[569] linked_values[175]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[36]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain FISHERTHOMPSON (SID
S-1-5-21-4059926353-2957580592-3733343930) as a DC
*************************************
END OF DOMAIN JOIN

It looks like your windows DC doesn't store its DNS zones in AD, the
print "Done with always replicated NC (base, config, schema)"
print "Replicating %s" % (str(nc))
repl.replicate(nc, source_dsa_invocation_id,
destination_dsa_guid, rodc=ctx.RODC,
replica_flags=ctx.replica_flags)
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
I 'think' the last two lines mean nothing was replicated because there
was nothing to replicate to or from.
You say your windows DC runs a DNS server, what sort & type ?
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[l***@gmail.com]

Post by Jason Waters
So I setup a testing environment so I can test/break things. I think my
issue is that something is screwed up with the Partitions on the windows
2003 server. The forest and domain partitions look odd, are they?
Mine looks kind of like this...
http://1ask2.com/Wndows2012/Upgrade/migration09.jpg

Post by Jason Waters
I still feel like there is something I can do to get the 2003 server to
have what I need to do a fsmo transfer instead of a seize. Doesn't that
check box say to store it inside AD?
http://i.imgur.com/UolzBwP.png
http://i.imgur.com/tHTmB5c.png

Post by Jason Waters
I still feel like there is something I can do to get the 2003 server to
have what I need to do a fsmo transfer instead of a seize. Doesn't that
check box say to store it inside AD?

Post by Jason Waters
lol...sorry!
- The windows domain controller does run a DNS server
- I joined the samba DC's to the windows DC. I used the normal
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Below is the full join output.....
START OF DOMAIN JOIN
*************************************
DC -UAdministrator
Finding a writeable DC for domain 'fisherthompson.local'
Found DC PDC.fisherthompson.local
workgroup is FISHERTHOMPSON
realm is fisherthompson.local
checking sAMAccountName
Adding CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Adding
CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding CN=NTDS
Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding SPNs to CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Setting account password for DC01$
Enabling account
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
A Kerberos configuration suitable for Samba 4 has been generated at
/var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=fisherthompson,DC=local
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1376] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[402]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[804]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1206]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1608]
linked_values[18]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1629]
linked_values[10]
Replicating critical objects from the base DN of the domain
Partition[DC=fisherthompson,DC=local] objects[93] linked_values[7]
Partition[DC=fisherthompson,DC=local] objects[387] linked_values[0]
Partition[DC=fisherthompson,DC=local] objects[569] linked_values[175]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[36]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain FISHERTHOMPSON (SID
S-1-5-21-4059926353-2957580592-3733343930) as a DC
*************************************
END OF DOMAIN JOIN

It looks like your windows DC doesn't store its DNS zones in AD, the
print "Done with always replicated NC (base, config, schema)"
print "Replicating %s" % (str(nc))
repl.replicate(nc, source_dsa_invocation_id,
destination_dsa_guid, rodc=ctx.RODC,
replica_flags=ctx.replica_flags)
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
I 'think' the last two lines mean nothing was replicated because there
was nothing to replicate to or from.
You say your windows DC runs a DNS server, what sort & type ?
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

The partitions look fine from that screenshot alone.

[Jason Waters]

So I continue to struggle getting this moved away from windows 2003 to
samba. I've been working in VM's to test before doing it on production. I
think something is just wrong/broken with my windows 2003 AD. These are a
couple of the things I have tried.

- Going from Windows 2003 to Windows 2008 to Samba
- Seizing the roles and then joining another samba domain controller. But
I'm unable to move the DomainDnsZones and ForestDnsZones fsmo's to the new
samba box. Like it is coping bad data.
- Setup a new domain with samba, joined Windows 2008 and migrated
everything around fine! Another reason why I think something is wrong in
my data.


So the last thing I've been trying to figure out is why the command
ldbsearch --cross-ncs -H ldap://pdc -b
"DC=DomainDnsZones,DC=fisherthompson,DC=local" -s sub -Uadministrator

returns a referral instead of the records. On my purely stock samba domain
it works fine, so something about the windows 2003 ad?

But if I open ASDIEDIT and connect to
DC=DomainDnsZones,DC=fisherthompson,DC=local on the windows 2003 DC I see
everything like I should.....


It seems like samba and ldbtools isn't following the referrals. Or they
shouldn't be referrals? Or something else that I have no idea about!

Any other suggestions? Thanks!

Jason

Post by l***@gmail.com

Post by Jason Waters
So I setup a testing environment so I can test/break things. I think my
issue is that something is screwed up with the Partitions on the windows
2003 server. The forest and domain partitions look odd, are they?
Mine looks kind of like this...
http://1ask2.com/Wndows2012/Upgrade/migration09.jpg
I still feel like there is something I can do to get the 2003 server to

Post by Jason Waters
have what I need to do a fsmo transfer instead of a seize. Doesn't that
check box say to store it inside AD?
http://i.imgur.com/UolzBwP.png
http://i.imgur.com/tHTmB5c.png
I still feel like there is something I can do to get the 2003 server to

Post by Jason Waters
have what I need to do a fsmo transfer instead of a seize. Doesn't that
check box say to store it inside AD?

Post by Jason Waters
lol...sorry!

Post by Jason Waters
- The windows domain controller does run a DNS server
- I joined the samba DC's to the windows DC. I used the normal
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Below is the full join output.....
START OF DOMAIN JOIN
*************************************
DC -UAdministrator
Finding a writeable DC for domain 'fisherthompson.local'
Found DC PDC.fisherthompson.local
workgroup is FISHERTHOMPSON
realm is fisherthompson.local
checking sAMAccountName
Adding CN=DC01,OU=Domain Controllers,DC=fisherthompson,DC=local
Adding
CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding CN=NTDS
Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fisherthompson,DC=local
Adding SPNs to CN=DC01,OU=Domain
Controllers,DC=fisherthompson,DC=local
Setting account password for DC01$
Enabling account
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
A Kerberos configuration suitable for Samba 4 has been generated at
/var/lib/samba/private/krb5.conf
Provision OK for domain DN DC=fisherthompson,DC=local
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[402] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[804] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1206] linked_values[0]
Schema-DN[CN=Schema,CN=Configuration,DC=fisherthompson,DC=local]
objects[1376] linked_values[0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[402]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[804]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1206]
linked_values[0]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1608]
linked_values[18]
Partition[CN=Configuration,DC=fisherthompson,DC=local] objects[1629]
linked_values[10]
Replicating critical objects from the base DN of the domain
Partition[DC=fisherthompson,DC=local] objects[93] linked_values[7]
Partition[DC=fisherthompson,DC=local] objects[387] linked_values[0]
Partition[DC=fisherthompson,DC=local] objects[569] linked_values[175]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[36]
Partition[DC=fisherthompson,DC=local] objects[741] linked_values[0]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain FISHERTHOMPSON (SID
S-1-5-21-4059926353-2957580592-3733343930) as a DC
*************************************
END OF DOMAIN JOIN
It looks like your windows DC doesn't store its DNS zones in AD, the

print "Done with always replicated NC (base, config, schema)"
print "Replicating %s" % (str(nc))
repl.replicate(nc, source_dsa_invocation_id,
destination_dsa_guid,
rodc=ctx.RODC,
replica_flags=ctx.replica_flags)
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=fisherthompson,DC=local
Partition[DC=DomainDnsZones,DC=fisherthompson,DC=local] objects[191]
linked_values[0]
Replicating DC=ForestDnsZones,DC=fisherthompson,DC=local
Partition[DC=ForestDnsZones,DC=fisherthompson,DC=local] objects[33]
linked_values[0]
Committing SAM database
DC=DomainDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
DC=ForestDnsZones,DC=fisherthompson,DC=local not found under
DC=fisherthompson,DC=local
I 'think' the last two lines mean nothing was replicated because there
was nothing to replicate to or from.
You say your windows DC runs a DNS server, what sort & type ?
Rowland
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

The partitions look fine from that screenshot alone.
--
-James
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

search error - LDAP error 10 LDAP_REFERRAL - <0000202B: RefErr:
DSID-0310063C, data 0, 1 access points
ref 1: 'DomainDnsZones.fisherthompson.local'
<ldap://DomainDnsZones.fisherthompson.local/DC=DomainDnsZones,DC=fisherthompson,DC=local>

Post by Jason Waters
So I continue to struggle getting this moved away from windows 2003 to
samba. I've been working in VM's to test before doing it on production.
I
think something is just wrong/broken with my windows 2003 AD. These are a
couple of the things I have tried.
- Going from Windows 2003 to Windows 2008 to Samba
- Seizing the roles and then joining another samba domain controller. But
I'm unable to move the DomainDnsZones and ForestDnsZones fsmo's to the new
samba box. Like it is coping bad data.
- Setup a new domain with samba, joined Windows 2008 and migrated
everything around fine! Another reason why I think something is wrong in
my data.
So the last thing I've been trying to figure out is why the command
ldbsearch --cross-ncs -H ldap://pdc -b
"DC=DomainDnsZones,DC=fisherthompson,DC=local" -s sub -Uadministrator
returns a referral instead of the records. On my purely stock samba domain
it works fine, so something about the windows 2003 ad?

I think it must be, on my DC it dumps all the domain DNS records. What
does it actually return ?
Rowland

Post by Jason Waters
But if I open ASDIEDIT and connect to
DC=DomainDnsZones,DC=fisherthompson,DC=local on the windows 2003 DC I see
everything like I should.....
It seems like samba and ldbtools isn't following the referrals. Or they
shouldn't be referrals? Or something else that I have no idea about!
Any other suggestions? Thanks!
Jason

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

So I wanted to test if something was broke in my DC so I setup a "new" 2003
DC with a different domain, example.com. I do the ldbsearch against that
and I get the same error instead of it listing the dns entries....So maybe
it is a 2003 thing?

Post by Jason Waters
DSID-0310063C, data 0, 1 access points
ref 1: 'DomainDnsZones.fisherthompson.local'
<ldap://DomainDnsZones.fisherthompson.local/DC=DomainDnsZones,DC=fisherthompson,DC=local>
If you look here: https://www.ldap.com/ldap-result-code-reference
10: Referral
This indicates that the server could not process the requested operation,
but that it may succeed if attempted in another location, as specified by
the referral URIs included in the response.
Never having seen this before, all I can suggest is trying what it is
telling you to do, only problem is, I don't really recognise the ldap URL
Rowland

Post by Jason Waters
So I continue to struggle getting this moved away from windows 2003 to
samba. I've been working in VM's to test before doing it on
production. I
think something is just wrong/broken with my windows 2003 AD. These are a
couple of the things I have tried.
- Going from Windows 2003 to Windows 2008 to Samba
- Seizing the roles and then joining another samba domain controller.
But
I'm unable to move the DomainDnsZones and ForestDnsZones fsmo's to the new
samba box. Like it is coping bad data.
- Setup a new domain with samba, joined Windows 2008 and migrated
everything around fine! Another reason why I think something is wrong in
my data.
So the last thing I've been trying to figure out is why the command
ldbsearch --cross-ncs -H ldap://pdc -b
"DC=DomainDnsZones,DC=fisherthompson,DC=local" -s sub -Uadministrator
returns a referral instead of the records. On my purely stock samba domain
it works fine, so something about the windows 2003 ad?

I think it must be, on my DC it dumps all the domain DNS records. What
does it actually return ?
Rowland

Post by Jason Waters
But if I open ASDIEDIT and connect to
DC=DomainDnsZones,DC=fisherthompson,DC=local on the windows 2003 DC I see
everything like I should.....
It seems like samba and ldbtools isn't following the referrals. Or they
shouldn't be referrals? Or something else that I have no idea about!
Any other suggestions? Thanks!
Jason

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

I'm going to keep going and see if I can get samba joined and then migrated
over. Maybe I'm still focusing on the wrong thing! Ugh....

Post by Jason Waters
So I wanted to test if something was broke in my DC so I setup a "new"
2003 DC with a different domain, example.com. I do the ldbsearch against
that and I get the same error instead of it listing the dns entries....So
maybe it is a 2003 thing?

Post by Jason Waters
DSID-0310063C, data 0, 1 access points
ref 1: 'DomainDnsZones.fisherthompson.local'
<ldap://DomainDnsZones.fisherthompson.local/DC=DomainDnsZones,DC=fisherthompson,DC=local>
If you look here: https://www.ldap.com/ldap-result-code-reference
10: Referral
This indicates that the server could not process the requested operation,
but that it may succeed if attempted in another location, as specified by
the referral URIs included in the response.
Never having seen this before, all I can suggest is trying what it is
telling you to do, only problem is, I don't really recognise the ldap URL
Rowland

Post by Jason Waters
So I continue to struggle getting this moved away from windows 2003 to
samba. I've been working in VM's to test before doing it on production. I
think something is just wrong/broken with my windows 2003 AD. These are a
couple of the things I have tried.
- Going from Windows 2003 to Windows 2008 to Samba
- Seizing the roles and then joining another samba domain controller.
But
I'm unable to move the DomainDnsZones and ForestDnsZones fsmo's to the new
samba box. Like it is coping bad data.
- Setup a new domain with samba, joined Windows 2008 and migrated
everything around fine! Another reason why I think something is wrong in
my data.
So the last thing I've been trying to figure out is why the command
ldbsearch --cross-ncs -H ldap://pdc -b
"DC=DomainDnsZones,DC=fisherthompson,DC=local" -s sub -Uadministrator
returns a referral instead of the records. On my purely stock samba domain
it works fine, so something about the windows 2003 ad?

I think it must be, on my DC it dumps all the domain DNS records. What
does it actually return ?
Rowland

Post by Jason Waters
But if I open ASDIEDIT and connect to
DC=DomainDnsZones,DC=fisherthompson,DC=local on the windows 2003 DC I see
everything like I should.....
It seems like samba and ldbtools isn't following the referrals. Or they
shouldn't be referrals? Or something else that I have no idea about!
Any other suggestions? Thanks!
Jason

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Jason Waters]

So I joined with samba's internal DNS, then converted to BIND, then
tested. Seems like it was working. I forced the 2003 machine out, cleaned
up the meta data and everything seemed to be working ok. So I raised the
domain level like this

samba-tool domain level raise
samba-tool domain level raise --domain-level=2008_R2
samba-tool domain level raise --forest-level=2008_R2

everything shows as 2008_R2

so now I think I'm making progress. I spin up another linux box, get it
ready to join, starts to join, then fails

says LDAP error 16 LDAP_NO_SUCH_ATTRIBUTE - <0000200A: objectclass_attrs:
attribute 'msDS-SupportedEncryptionTypes' on entry 'CN=DC04,OU=Domain
Controllers,DC=example,DC=local' was not found in the schema

so I thought well I'm going to try having a windows 2008 r2 server join as
a DC, run dcpromo and it says I need to run /forestprep on the AD. Well I
can't do that now that it is on linux right?

Post by Jason Waters
I'm going to keep going and see if I can get samba joined and then
migrated over. Maybe I'm still focusing on the wrong thing! Ugh....

Post by Jason Waters
So I wanted to test if something was broke in my DC so I setup a "new"
2003 DC with a different domain, example.com. I do the ldbsearch
against that and I get the same error instead of it listing the dns
entries....So maybe it is a 2003 thing?

Post by Jason Waters
DSID-0310063C, data 0, 1 access points
ref 1: 'DomainDnsZones.fisherthompson.local'
<ldap://DomainDnsZones.fisherthompson.local/DC=DomainDnsZones,DC=fisherthompson,DC=local>
If you look here: <https://www.ldap.com/ldap-result-code-reference>
https://www.ldap.com/ldap-result-code-reference
10: Referral
This indicates that the server could not process the requested
operation, but that it may succeed if attempted in another location, as
specified by the referral URIs included in the response.
Never having seen this before, all I can suggest is trying what it is
telling you to do, only problem is, I don't really recognise the ldap URL
Rowland

Post by Jason Waters
So I continue to struggle getting this moved away from windows 2003 to
samba. I've been working in VM's to test before doing it on production. I
think something is just wrong/broken with my windows 2003 AD. These are a
couple of the things I have tried.
- Going from Windows 2003 to Windows 2008 to Samba
- Seizing the roles and then joining another samba domain controller.
But
I'm unable to move the DomainDnsZones and ForestDnsZones fsmo's to the new
samba box. Like it is coping bad data.
- Setup a new domain with samba, joined Windows 2008 and migrated
everything around fine! Another reason why I think something is wrong in
my data.
So the last thing I've been trying to figure out is why the command
ldbsearch --cross-ncs -H ldap://pdc -b
"DC=DomainDnsZones,DC=fisherthompson,DC=local" -s sub -Uadministrator
returns a referral instead of the records. On my purely stock samba domain
it works fine, so something about the windows 2003 ad?

I think it must be, on my DC it dumps all the domain DNS records. What
does it actually return ?
Rowland

Post by Jason Waters
But if I open ASDIEDIT and connect to
DC=DomainDnsZones,DC=fisherthompson,DC=local on the windows 2003 DC I see
everything like I should.....
It seems like samba and ldbtools isn't following the referrals. Or they
shouldn't be referrals? Or something else that I have no idea about!
Any other suggestions? Thanks!
Jason

--
To unsubscribe from this list go to the following URL and read the
instructions: <https://lists.samba.org/mailman/options/samba>
https://lists.samba.org/mailman/options/samba

Try reading this: https://support.microsoft.com/en-us/kb/304489
I have also had another thought, join the samba4 DC using the internal DNS
server, then use samba_upgradedns to upgrade to Bind9, this should create
the dns partitions etc. Not really sure if this will work, I have never had
this problem, but it worth trying in a test environment.
Rowland

[Jason Waters]

I did that, it fixed 6 errors, ran it again, 0 errors. Still not able to
join.

Post by Jason Waters
So I joined with samba's internal DNS, then converted to BIND, then
tested. Seems like it was working. I forced the 2003 machine out, cleaned
up the meta data and everything seemed to be working ok. So I raised the
domain level like this
samba-tool domain level raise
samba-tool domain level raise --domain-level=2008_R2
samba-tool domain level raise --forest-level=2008_R2
everything shows as 2008_R2
so now I think I'm making progress. I spin up another linux box, get it
ready to join, starts to join, then fails
attribute 'msDS-SupportedEncryptionTypes' on entry 'CN=DC04,OU=Domain
Controllers,DC=example,DC=local' was not found in the schema
so I thought well I'm going to try having a windows 2008 r2 server join
as a DC, run dcpromo and it says I need to run /forestprep on the AD. Well
I can't do that now that it is on linux right?

It should be there, it sounds like you have an incomplete schema, you
could try running 'samba-tool dbcheck --fix'
Rowland

[Jason Waters]

I'm pretty sure the domain level raise is failing on this system. This is
what I just tested.

Joined Samba(dc03) to windows 2003(pdc) DC.
Shut down PDC
seized all fsmo roles
did metadata cleanup
Open AD Users and Computers
I can view computers, users, etc. but it fails when trying to open Domain
Controllers.

I get this error cannot find attr[msDS-isRODC] in of schema

Now this is a VM so I restored a snapshot before I upgraded the
domain/forest level and I'm still getting that error. So I'm not sure where
to look.

I run samba-tool dbcheck --fix --cross-ncs, finds 2 errors, run it again
and fins 0.

So how to I fix my AD schema? This just seems to fail because I'm pulling
it from 2003. If I spin up a new samba domain with the same version
installed it just works...

Post by Jason Waters
I did that, it fixed 6 errors, ran it again, 0 errors. Still not able to
join.

Post by Jason Waters
So I joined with samba's internal DNS, then converted to BIND, then
tested. Seems like it was working. I forced the 2003 machine out, cleaned
up the meta data and everything seemed to be working ok. So I raised the
domain level like this
samba-tool domain level raise
samba-tool domain level raise --domain-level=2008_R2
samba-tool domain level raise --forest-level=2008_R2
everything shows as 2008_R2
so now I think I'm making progress. I spin up another linux box, get it
ready to join, starts to join, then fails
objectclass_attrs: attribute 'msDS-SupportedEncryptionTypes' on entry
'CN=DC04,OU=Domain Controllers,DC=example,DC=local' was not found in the
schema
so I thought well I'm going to try having a windows 2008 r2 server join
as a DC, run dcpromo and it says I need to run /forestprep on the AD. Well
I can't do that now that it is on linux right?

It should be there, it sounds like you have an incomplete schema, you
could try running 'samba-tool dbcheck --fix'
Rowland

Try adding '--cross-ncs'
After this, I am running out of suggestions.
Rowland

[Jason Waters]

I bumped the logging up.

samba-tool domain level raise --domain-level=2008_R2

schema_fsmo_init: we are master[yes] updates allowed[no]
schema_fsmo_init: we are master[yes] updates allowed[no]

The updates_allowed[no] concerns me?

Post by Jason Waters
I'm pretty sure the domain level raise is failing on this system. This is
what I just tested.
Joined Samba(dc03) to windows 2003(pdc) DC.
Shut down PDC
seized all fsmo roles
did metadata cleanup
Open AD Users and Computers
I can view computers, users, etc. but it fails when trying to open Domain
Controllers.
I get this error cannot find attr[msDS-isRODC] in of schema
Now this is a VM so I restored a snapshot before I upgraded the
domain/forest level and I'm still getting that error. So I'm not sure where
to look.
I run samba-tool dbcheck --fix --cross-ncs, finds 2 errors, run it again
and fins 0.
So how to I fix my AD schema? This just seems to fail because I'm pulling
it from 2003. If I spin up a new samba domain with the same version
installed it just works...

Post by Jason Waters
I did that, it fixed 6 errors, ran it again, 0 errors. Still not able to
join.

Post by Jason Waters
So I joined with samba's internal DNS, then converted to BIND, then
tested. Seems like it was working. I forced the 2003 machine out, cleaned
up the meta data and everything seemed to be working ok. So I raised the
domain level like this
samba-tool domain level raise
samba-tool domain level raise --domain-level=2008_R2
samba-tool domain level raise --forest-level=2008_R2
everything shows as 2008_R2
so now I think I'm making progress. I spin up another linux box, get
it ready to join, starts to join, then fails
objectclass_attrs: attribute 'msDS-SupportedEncryptionTypes' on entry
'CN=DC04,OU=Domain Controllers,DC=example,DC=local' was not found in the
schema
so I thought well I'm going to try having a windows 2008 r2 server join
as a DC, run dcpromo and it says I need to run /forestprep on the AD. Well
I can't do that now that it is on linux right?

It should be there, it sounds like you have an incomplete schema, you
could try running 'samba-tool dbcheck --fix'
Rowland

Try adding '--cross-ncs'
After this, I am running out of suggestions.
Rowland

[Jason Waters]

So I was finally able to get this working. Not that I like my solution!
Anyone new or not committed to using samba would have given up
days/hours/weeks ago! :)

These are my rough notes....

Machines:
PDC: Current Windows 2003 DC
DC2008: New windows 2008 R2 machine
DC03: Samba 4.3.9 Ubuntu
DC04: Samba 4.3.9 Ubuntu


1. PDC - /forestprep /rodcprep /domainprep /gpprep
2. DC2008 - dcpromo
3. DC2008 - Make sure DNS is there
4. DC2008 - changes fsmo roles to DC2008
regsvr32 schmmgmt.dll
4. PDC - Shutdown PDC(without running dcpromo because that screws things up)
5. DC2008 - Run Metatdata cleanup on DC2008, removing PDC
6. DC2008 - ADSIEDIT
DC=DomainDnsZones,DC=example,DC=local
DC=ForestDnsZones,DC=example,DC=local

Fix Infrastructure so the fSMORoleOwner is below
CN=NTDS
Settings,CN=DC2008,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=example,DC=local

6. DC2008 - Check repadmin /showrepl
7. DC2008 - Remove DNS junk, like PDC from everywhere
8. DC2008 - Reboot
9. DC03 - Join samba, make sure everything is synced
samba-tool domain join example.local DC -UAdministrator
--dns-backend=BIND_DLZ
10. DC03 - Reboot, make sure everything is working
11. DC2008 - Raise domain/forest levels
12. DC03 - Seize the roles
13. DC2008 - dcpromo /forceremoval
14. Run Metadata Cleanup and remove DC2008
15. Adjust DNS settings so only DC03 is listed
16. DC03 - Reboot
17. DC03 - Run database cleanup on AD
samba-tool dbcheck --cross-ncs --reset-well-known-acls --fix
samba-tool ntacl sysvolreset
samba-tool dbcheck --cross-ncs --fix
18. DC04 - Join domain
kinit administrator
samba-tool domain join example.local DC -UAdministrator
--dns-backend=BIND9_DLZ
19. DC04 - Setup Bind

Edit /etc/bind/named.conf.options
auth-nxdomain yes;
empty-zones-enable no;
tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";

Edit /etc/bind/named.conf
include "/var/lib/samba/private/named.conf";

chgrp bind /var/lib/samba/private/dns.keytab
chmod g+r /var/lib/samba/private/dns.keytab
20. DC04 - Reboot
21. Test fsmo role transfers, dns updates, etc...

Post by Jason Waters
I bumped the logging up.
samba-tool domain level raise --domain-level=2008_R2
schema_fsmo_init: we are master[yes] updates allowed[no]
schema_fsmo_init: we are master[yes] updates allowed[no]
The updates_allowed[no] concerns me?

Post by Jason Waters
I'm pretty sure the domain level raise is failing on this system. This
is what I just tested.
Joined Samba(dc03) to windows 2003(pdc) DC.
Shut down PDC
seized all fsmo roles
did metadata cleanup
Open AD Users and Computers
I can view computers, users, etc. but it fails when trying to open Domain
Controllers.
I get this error cannot find attr[msDS-isRODC] in of schema
Now this is a VM so I restored a snapshot before I upgraded the
domain/forest level and I'm still getting that error. So I'm not sure where
to look.
I run samba-tool dbcheck --fix --cross-ncs, finds 2 errors, run it again
and fins 0.
So how to I fix my AD schema? This just seems to fail because I'm
pulling it from 2003. If I spin up a new samba domain with the same
version installed it just works...

Post by Jason Waters
I did that, it fixed 6 errors, ran it again, 0 errors. Still not able
to join.

Post by Jason Waters
So I joined with samba's internal DNS, then converted to BIND, then
tested. Seems like it was working. I forced the 2003 machine out, cleaned
up the meta data and everything seemed to be working ok. So I raised the
domain level like this
samba-tool domain level raise
samba-tool domain level raise --domain-level=2008_R2
samba-tool domain level raise --forest-level=2008_R2
everything shows as 2008_R2
so now I think I'm making progress. I spin up another linux box, get
it ready to join, starts to join, then fails
objectclass_attrs: attribute 'msDS-SupportedEncryptionTypes' on entry
'CN=DC04,OU=Domain Controllers,DC=example,DC=local' was not found in the
schema
so I thought well I'm going to try having a windows 2008 r2 server
join as a DC, run dcpromo and it says I need to run /forestprep on the AD.
Well I can't do that now that it is on linux right?

It should be there, it sounds like you have an incomplete schema, you
could try running 'samba-tool dbcheck --fix'
Rowland

Try adding '--cross-ncs'
After this, I am running out of suggestions.
Rowland

[Jason Waters]

So you are saying samba-tool domain level raise --forest-level=2008_R2 does
nothing with the schema, just changes the value that is returned when doing
samba-tool domain level show?

If that is the case I think it would be nice to put something like that on
the wiki page about raising the functional level! I spent a ton of time
trying to go from Windows 2003 directly to samba. Granted learned a ton
about AD along the way but I think showing the clear paths to samba from
windows would make the transition easier.

So if samba at some point supports AD's 2012 schema will we need to join
2012 as a DC upgrade, move the fsmo roles to the 2012 machine running the
2008_R2 schema, upgrade the schema and then wait until the changes sync and
then move the fsmo roles back? Either that or actually upgrade the schema?

Thanks for letting me and the community know.

Jason

Post by Jason Waters
So I joined with samba's internal DNS, then converted to BIND, then
tested. Seems like it was working. I forced the 2003 machine out, cleaned
up the meta data and everything seemed to be working ok. So I raised the
domain level like this
samba-tool domain level raise
samba-tool domain level raise --domain-level=2008_R2
samba-tool domain level raise --forest-level=2008_R2
everything shows as 2008_R2
so now I think I'm making progress. I spin up another linux box, get it
ready to join, starts to join, then fails
attribute 'msDS-SupportedEncryptionTypes' on entry 'CN=DC04,OU=Domain
Controllers,DC=example,DC=local' was not found in the schema
so I thought well I'm going to try having a windows 2008 r2 server join as
a DC, run dcpromo and it says I need to run /forestprep on the AD.
Well I
can't do that now that it is on linux right?

Correct. Currently nobody has coded the magic to allow us to upgrade a
schema in Samba, and dbcheck can't help with that at the moment either.
The cleanest option would be to do it before joining Samba to the 2003
domain with the MS tools. We really should have a minimum schema level
check on the FL raise code (bugs welcome).
Sorry,
Andrew Bartlett
--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org
Samba Developer, Catalyst IT
http://catalyst.net.nz/services/samba