Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
[Samba] Unable to join DC to domain
509 views
Skip to first unread message
IT Admin
Mar 21, 2016, 12:30:03 AM3/21/16
to
I cannot join two new VMs to my domain, I receive the following error on
both machines:
twerks@cbadc03:~$ kinit
Administrator
Password for Admini...@CB.CLIFFBELLS.COM:
itwerks@cbadc03:~$ klist -e
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Admini...@CB.CLIFFBELLS.COM
Valid starting Expires Service principal
03/21/2016 00:19:56 03/21/2016 10:19:56 krbtgt/
CB.CLIFF...@CB.CLIFFBELLS.COM
renew until 03/22/2016 00:19:41, Etype (skey, tkt):
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
itwerks@cbadc03:~$ sudo /usr/local/samba/bin/samba-tool domain join
cb.cliffbells.com DC -Uadministrator --realm=CB.CLIFFBELLS.COM
--dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'cb.cliffbells.com'
Found DC filer.cb.cliffbells.com
Password for [WORKGROUP\administrator]:
workgroup is CB
realm is cb.cliffbells.com
checking sAMAccountName
Adding CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
Join failed - cleaning up
checking sAMAccountName
ERROR(ldb): uncaught exception - LDAP error 68 LDAP_ENTRY_ALREADY_EXISTS -
<00002071: ../lib/ldb/ldb_tdb/ldb_index.c:1216: Failed to re-index
objectSid in CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com -
../lib/ldb/ldb_tdb/ldb_index.c:1148: unique index violation on objectSid in
CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com> <>
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", line
621, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1183, in join_DC
ctx.do_join()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1086, in do_join
ctx.join_add_objects()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
536, in join_add_objects
ctx.samdb.add(rec)
itwerks@cbadc03:~$
Neither machine exists in ADUC on either of my current DCs. Neither
machine has any records in DNS. I ran ldbsearch and dumped it's output to
a text file, there are no references to either machine name in the file.
Please advise.
JS
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
both machines:
twerks@cbadc03:~$ kinit
Administrator
Password for Admini...@CB.CLIFFBELLS.COM:
itwerks@cbadc03:~$ klist -e
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Admini...@CB.CLIFFBELLS.COM
Valid starting Expires Service principal
03/21/2016 00:19:56 03/21/2016 10:19:56 krbtgt/
CB.CLIFF...@CB.CLIFFBELLS.COM
renew until 03/22/2016 00:19:41, Etype (skey, tkt):
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
itwerks@cbadc03:~$ sudo /usr/local/samba/bin/samba-tool domain join
cb.cliffbells.com DC -Uadministrator --realm=CB.CLIFFBELLS.COM
--dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'cb.cliffbells.com'
Found DC filer.cb.cliffbells.com
Password for [WORKGROUP\administrator]:
workgroup is CB
realm is cb.cliffbells.com
checking sAMAccountName
Adding CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
Join failed - cleaning up
checking sAMAccountName
ERROR(ldb): uncaught exception - LDAP error 68 LDAP_ENTRY_ALREADY_EXISTS -
<00002071: ../lib/ldb/ldb_tdb/ldb_index.c:1216: Failed to re-index
objectSid in CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com -
../lib/ldb/ldb_tdb/ldb_index.c:1148: unique index violation on objectSid in
CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com> <>
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", line
621, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1183, in join_DC
ctx.do_join()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1086, in do_join
ctx.join_add_objects()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
536, in join_add_objects
ctx.samdb.add(rec)
itwerks@cbadc03:~$
Neither machine exists in ADUC on either of my current DCs. Neither
machine has any records in DNS. I ran ldbsearch and dumped it's output to
a text file, there are no references to either machine name in the file.
Please advise.
JS
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
Denis Cardon
Mar 21, 2016, 10:20:03 AM3/21/16
to
Hi JS,
have you cleaned up the /usr/local/samba/private/ directory and
/usr/local/samba/etc/smb.conf file before trying to rejoin the domain?
HTH,
Denis
Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr
/usr/local/samba/etc/smb.conf file before trying to rejoin the domain?
HTH,
Denis
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr
IT Admin
Mar 21, 2016, 1:40:05 PM3/21/16
to
Yes, I have:
itwerks@cbadc03:~$ sudo /etc/init.d/samba4 stop
[sudo] password for itwerks:
[ ok ] Stopping samba4 (via systemctl): samba4.service
itwerks@cbadc03:~$ sudo mkdir /usr/local/samba-backups/3.21.2016 && sudo mv
/usr/local/samba/private /usr/local/samba-backups/3.21.2016/
itwerks@cbadc03:~$ ls -la /usr/local/samba/etc/
total 8
drwxr-xr-x 2 root root 4096 Mar 17 06:17 .
drwxr-xr-x 9 root root 4096 Mar 21 13:23 ..
itwerks@cbadc03:~$ kinit
CB.CLIFF...@CB.CLIFFBELLS.COM
renew until 03/22/2016 13:24:25, Etype (skey, tkt):
JS
On Mar 21, 2016 10:16 AM, "Denis Cardon" <
itwerks@cbadc03:~$ sudo /etc/init.d/samba4 stop
[sudo] password for itwerks:
[ ok ] Stopping samba4 (via systemctl): samba4.service
itwerks@cbadc03:~$ sudo mkdir /usr/local/samba-backups/3.21.2016 && sudo mv
/usr/local/samba/private /usr/local/samba-backups/3.21.2016/
itwerks@cbadc03:~$ ls -la /usr/local/samba/etc/
total 8
drwxr-xr-x 2 root root 4096 Mar 17 06:17 .
drwxr-xr-x 9 root root 4096 Mar 21 13:23 ..
itwerks@cbadc03:~$ kinit
Administrator
Password for Admini...@CB.CLIFFBELLS.COM:
itwerks@cbadc03:~$ klist
-e
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Admini...@CB.CLIFFBELLS.COM
Valid starting Expires Service principal
03/21/2016 13:24:37 03/21/2016 23:24:37 krbtgt/
Password for Admini...@CB.CLIFFBELLS.COM:
itwerks@cbadc03:~$ klist
-e
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Admini...@CB.CLIFFBELLS.COM
Valid starting Expires Service principal
CB.CLIFF...@CB.CLIFFBELLS.COM
renew until 03/22/2016 13:24:25, Etype (skey, tkt):
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
itwerks@cbadc03:~$ sudo /usr/local/samba/bin/samba-tool domain join
cb.cliffbells.com DC -Uadministrator --realm=CB.CLIFFBELLS.COM
--dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'cb.cliffbells.com'
Found DC filer.cb.cliffbells.com
Password for [WORKGROUP\administrator]:
workgroup is CB
realm is cb.cliffbells.com
checking sAMAccountName
Adding CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
Join failed - cleaning up
checking sAMAccountName
itwerks@cbadc03:~$ sudo /usr/local/samba/bin/samba-tool domain join
cb.cliffbells.com DC -Uadministrator --realm=CB.CLIFFBELLS.COM
--dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'cb.cliffbells.com'
Found DC filer.cb.cliffbells.com
Password for [WORKGROUP\administrator]:
workgroup is CB
realm is cb.cliffbells.com
checking sAMAccountName
Adding CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
Join failed - cleaning up
checking sAMAccountName
ERROR(ldb): uncaught exception - LDAP error 68 LDAP_ENTRY_ALREADY_EXISTS -
<00002071: ../lib/ldb/ldb_tdb/ldb_index.c:1216: Failed to re-index
objectSid in CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com -
../lib/ldb/ldb_tdb/ldb_index.c:1148: unique index violation on objectSid in
CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com> <>
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", line
621, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1183, in join_DC
ctx.do_join()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1086, in do_join
ctx.join_add_objects()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
536, in join_add_objects
ctx.samdb.add(rec)
itwerks@cbadc03:~$
Both cbadc02 and cbadc03 exhibit this behavior.
<00002071: ../lib/ldb/ldb_tdb/ldb_index.c:1216: Failed to re-index
objectSid in CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com -
../lib/ldb/ldb_tdb/ldb_index.c:1148: unique index violation on objectSid in
CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com> <>
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", line
621, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1183, in join_DC
ctx.do_join()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1086, in do_join
ctx.join_add_objects()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
536, in join_add_objects
ctx.samdb.add(rec)
itwerks@cbadc03:~$
JS
On Mar 21, 2016 10:16 AM, "Denis Cardon" <
Rowland penny
Mar 21, 2016, 4:00:05 PM3/21/16
to
objectsid that already exists:
unique index violation on objectSid in CN=CBADC03,OU=Domain
Controllers,DC=cb,DC=cliffbells,DC=com
Controllers,DC=cb,DC=cliffbells,DC=com' and then try joining again.
Rowland
IT Admin
Mar 21, 2016, 5:30:05 PM3/21/16
to
No dice.
Logged in to a workstation with RSAT installed. Added computer to OU
Domain Controllers, closed ADUC, attempted join again.
itwerks@cbadc03:~$ kinit
CB.CLIFF...@CB.CLIFFBELLS.COM
renew until 03/22/2016 17:21:29, Etype (skey, tkt):
Please advise.
JS
Logged in to a workstation with RSAT installed. Added computer to OU
Domain Controllers, closed ADUC, attempted join again.
itwerks@cbadc03:~$ kinit
Administrator
Password for Admini...@CB.CLIFFBELLS.COM:
itwerks@cbadc03:~$ klist
-e
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Admini...@CB.CLIFFBELLS.COM
Valid starting Expires Service principal
03/21/2016 17:21:42 03/22/2016 03:21:42 krbtgt/
Password for Admini...@CB.CLIFFBELLS.COM:
itwerks@cbadc03:~$ klist
-e
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Admini...@CB.CLIFFBELLS.COM
Valid starting Expires Service principal
CB.CLIFF...@CB.CLIFFBELLS.COM
renew until 03/22/2016 17:21:29, Etype (skey, tkt):
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
itwerks@cbadc03:~$ sudo /usr/local/samba/bin/samba-tool domain join
cb.cliffbells.com DC -Uadministrator --realm=CB.CLIFFBELLS.COM
--dns-backend=SAMBA_INTERNAL
[sudo] password for itwerks:
itwerks@cbadc03:~$ sudo /usr/local/samba/bin/samba-tool domain join
cb.cliffbells.com DC -Uadministrator --realm=CB.CLIFFBELLS.COM
--dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'cb.cliffbells.com'
Found DC filer.cb.cliffbells.com
Password for [WORKGROUP\administrator]:
workgroup is CB
realm is cb.cliffbells.com
checking sAMAccountName
Deleted CN=CBADC03,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
Found DC filer.cb.cliffbells.com
Password for [WORKGROUP\administrator]:
workgroup is CB
realm is cb.cliffbells.com
checking sAMAccountName
JS
mathias dufresne
Mar 22, 2016, 10:20:03 AM3/22/16
to
Hi JS,
You said in your firt mail you have this very same behaviour with two new
VMs you tried to join in your AD domain.
I expect you don't have just copied your VMs disks without changing VMs
hostname and FQDN. I expect you don't fully re-use smb.conf from another DC
(you can do that but you must change hostname into smb.conf).
You have disabled SELinux too.
So you have 3 systems to be AD DC:
cbaddc01 (working and running)
cbaddc02 (one of the two new VMs which refuse to be joined to AD domain
hosted on cbaddc01)
cbaddc03 (the other one new VMs which also refuses to be joined)
I found that few minutes ago speaking about LDB: http://somewoman.com/?p=261
Here two options were interesting me about your issue:
--cross-ncs to search not only in main DIT
--show-deleted to show deleted objects
In addition --show-binary switch can be used to decode base64 encoded
values when needed.
As I have no real idea about your issue I would first try to set up a new
VM with a different name, very different name, to test if your domain
refuses to add all new DC (whatever is the name) or only DC with names
already used.
You said in your firt mail you have this very same behaviour with two new
VMs you tried to join in your AD domain.
I expect you don't have just copied your VMs disks without changing VMs
hostname and FQDN. I expect you don't fully re-use smb.conf from another DC
(you can do that but you must change hostname into smb.conf).
You have disabled SELinux too.
So you have 3 systems to be AD DC:
cbaddc01 (working and running)
cbaddc02 (one of the two new VMs which refuse to be joined to AD domain
hosted on cbaddc01)
cbaddc03 (the other one new VMs which also refuses to be joined)
I found that few minutes ago speaking about LDB: http://somewoman.com/?p=261
Here two options were interesting me about your issue:
--cross-ncs to search not only in main DIT
--show-deleted to show deleted objects
In addition --show-binary switch can be used to decode base64 encoded
values when needed.
As I have no real idea about your issue I would first try to set up a new
VM with a different name, very different name, to test if your domain
refuses to add all new DC (whatever is the name) or only DC with names
already used.
IT Admin
Mar 25, 2016, 1:30:04 PM3/25/16
to
"I expect you don't have just copied your VMs disks without changing VMs
hostname and FQDN. I expect you don't fully re-use smb.conf from another DC
(you can do that but you must change hostname into smb.conf)."
1) These are new Ubuntu VMs, not cloned, built from scratch. I tried
hostname and FQDN. I expect you don't fully re-use smb.conf from another DC
(you can do that but you must change hostname into smb.conf)."
joining them with no smb.conf in /usr/local/samba/etc
You have disabled SELinux too
2) AFAIK Ubuntu uses apparmor, not selinux. I have not disabled apparmor.
3) --show-deleted reveals a single instance of cbadc02:
twerks@filer:~$ sudo /usr/local/samba/bin/ldbsearch -H
/usr/local/samba/private/sam.ldb --cross-ncs --show-deleted >
ldbsearch_cross-ncs_deleted.txt
itwerks@filer:~$ cat ldbsearch_cross-ncs_deleted.txt | grep
cbadc
dNSHostName: cbadc02.cb.cliffbells.com
dNSHostName: cbadc01.cb.cliffbells.com
dn: DC=cbadc01,DC=cb.cliffbells.com
,CN=MicrosoftDNS,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com
name: cbadc01
dc: cbadc01
distinguishedName: DC=cbadc01,DC=cb.cliffbells.com
,CN=MicrosoftDNS,DC=DomainDn
dNSHostName: cbadc01.cb.cliffbells.com
dNSHostName: cbadc01.cb.cliffbells.com
servicePrincipalName: HOST/cbadc01.cb.cliffbells.com
servicePrincipalName: GC/cbadc01.cb.cliffbells.com/cb.cliffbells.com
servicePrincipalName: HOST/cbadc01.cb.cliffbells.com/CB
servicePrincipalName: ldap/cbadc01.cb.cliffbells.com/CB
servicePrincipalName: ldap/cbadc01.cb.cliffbells.com
servicePrincipalName: HOST/cbadc01.cb.cliffbells.com/cb.cliffbells.com
servicePrincipalName: ldap/cbadc01.cb.cliffbells.com/cb.cliffbells.com
servicePrincipalName: RestrictedKrbHost/cbadc01.cb.cliffbells.com
servicePrincipalName: ldap/
cbadc01.cb.cliffbells.com/DomainDnsZones.cb.cliffbe
servicePrincipalName: ldap/
cbadc01.cb.cliffbells.com/ForestDnsZones.cb.cliffbe
dNSHostName: <http://cbadc02.cb.cliffbells.com>cbadc02.
<http://cbadc02.cb.cliffbells.com>cb.cliffbells.com
<http://cbadc02.cb.cliffbells.com>
itwerks@filer:~$
This article seems to explain how to resolve this issue from a Windows ADC:
http://social.technet.microsoft.com/wiki/contents/articles/15435.active-directory-duplicate-object-name-resolution.aspx
How could I replicate the approach in a Samba AD?
Re: spinning up a new VM, I tried that with cbadc03... I'll try again with
a radically different hostname this weekend.
JS
IT Admin
Mar 27, 2016, 12:20:03 AM3/27/16
to
Good times...
Spent hours today rolling a fresh VM.
FAIL
itwerks@testes:~$ kinit administrator
Password for admini...@CB.CLIFFBELLS.COM:
itwerks@testes:~$ klist -e
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: admini...@CB.CLIFFBELLS.COM
Valid starting Expires Service principal
03/27/2016 00:07:04 03/27/2016 10:07:04 krbtgt/
CB.CLIFF...@CB.CLIFFBELLS.COM
renew until 03/28/2016 00:06:59, Etype (skey, tkt):
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
itwerks@testes:~$ sudo /usr/local/samba/bin/samba-tool domain join
*&@$^@&$(@*$&@^$@!)($#)(^)%@*%_
Please advise.
JS
Spent hours today rolling a fresh VM.
FAIL
itwerks@testes:~$ kinit administrator
Password for admini...@CB.CLIFFBELLS.COM:
itwerks@testes:~$ klist -e
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: admini...@CB.CLIFFBELLS.COM
Valid starting Expires Service principal
CB.CLIFF...@CB.CLIFFBELLS.COM
renew until 03/28/2016 00:06:59, Etype (skey, tkt):
aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96
itwerks@testes:~$ sudo /usr/local/samba/bin/samba-tool domain join
cb.cliffbells.com DC -Uadministrator --realm=CB.CLIFFBELLS.COM
--dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'cb.cliffbells.com'
Found DC filer.cb.cliffbells.com
Password for [WORKGROUP\administrator]:
workgroup is CB
realm is cb.cliffbells.com
checking sAMAccountName
Adding CN=TESTES,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
--dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'cb.cliffbells.com'
Found DC filer.cb.cliffbells.com
Password for [WORKGROUP\administrator]:
workgroup is CB
realm is cb.cliffbells.com
checking sAMAccountName
Join failed - cleaning up
checking sAMAccountName
ERROR(ldb): uncaught exception - LDAP error 68 LDAP_ENTRY_ALREADY_EXISTS -
<00002071: ../lib/ldb/ldb_tdb/ldb_index.c:1216: Failed to re-index
objectSid in CN=TESTES,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com -
checking sAMAccountName
ERROR(ldb): uncaught exception - LDAP error 68 LDAP_ENTRY_ALREADY_EXISTS -
<00002071: ../lib/ldb/ldb_tdb/ldb_index.c:1216: Failed to re-index
../lib/ldb/ldb_tdb/ldb_index.c:1148: unique index violation on objectSid in
CN=TESTES,OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com> <>
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", line
621, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1183, in join_DC
ctx.do_join()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1086, in do_join
ctx.join_add_objects()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
536, in join_add_objects
ctx.samdb.add(rec)
sigh.
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/domain.py", line
621, in run
machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1183, in join_DC
ctx.do_join()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
1086, in do_join
ctx.join_add_objects()
File "/usr/local/samba/lib/python2.7/site-packages/samba/join.py", line
536, in join_add_objects
ctx.samdb.add(rec)
*&@$^@&$(@*$&@^$@!)($#)(^)%@*%_
Please advise.
JS
IT Admin
Mar 27, 2016, 2:40:03 AM3/27/16
to
I ran ldbsearch on my sam.ldb
I searched for CBADC02, CBADC03, and TESTES (all VMs that fail to join
domain), results are below:
CBADC02 shows up a few times:
# record 1906
dn:
CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configu$
objectClass: top
objectClass: server
instanceType: 4
whenCreated: 20160310044543.0Z
uSNCreated: 4215
objectGUID: de85228c-f92b-4d5d-9d6a-01c3f915dec9
systemFlags: 1375731712
dNSHostName: cbadc02.cb.cliffbells.com
cn:: Q0JBREMwMgpERUw6ZGU4NTIyOGMtZjkyYi00ZDVkLTlkNmEtMDFjM2Y5MTVkZWM5
isDeleted: TRUE
name:: Q0JBREMwMgpERUw6ZGU4NTIyOGMtZjkyYi00ZDVkLTlkNmEtMDFjM2Y5MTVkZWM5
lastKnownParent:
CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurati
on,DC=cb,DC=cliffbells,DC=com
isRecycled: TRUE
whenChanged: 20160319092438.0Z
uSNChanged: 4261
distinguishedName:
CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Se
rvers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbell
s,DC=com
# record 2372
dn: CN=NTDS
Settings\0ADEL:a5d3b626-e936-4a65-97bc-cade176d1b10,CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec$
objectClass: top
objectClass: applicationSettings
objectClass: nTDSDSA
instanceType: 4
whenCreated: 20160310044546.0Z
uSNCreated: 4214
objectGUID: a5d3b626-e936-4a65-97bc-cade176d1b10
systemFlags: 33554432
cn::
TlREUyBTZXR0aW5ncwpERUw6YTVkM2I2MjYtZTkzNi00YTY1LTk3YmMtY2FkZTE3NmQxYjEw
isDeleted: TRUE
name::
TlREUyBTZXR0aW5ncwpERUw6YTVkM2I2MjYtZTkzNi00YTY1LTk3YmMtY2FkZTE3NmQxYjE
w
isRecycled: TRUE
whenChanged: 20160319092438.0Z
uSNChanged: 4259
distinguishedName: CN=NTDS
Settings\0ADEL:a5d3b626-e936-4a65-97bc-cade176d1b10
,CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Servers,CN=Default-
First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
# record 3275
dn: CN=CBADC02\0ADEL:b34ccfd9-0f88-4f7b-8c00-3296ed92507d,CN=Deleted
Objects,DC=cb,DC=cliffbells,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
instanceType: 4
whenCreated: 20160321212014.0Z
uSNCreated: 4287
objectGUID: b34ccfd9-0f88-4f7b-8c00-3296ed92507d
userAccountControl: 4128
objectSid: S-1-5-21-2555112579-3841919511-698463993-1602
sAMAccountName: CBADC02$
isDeleted: TRUE
lastKnownParent: OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
isRecycled: TRUE
cn:: Q0JBREMwMgpERUw6YjM0Y2NmZDktMGY4OC00ZjdiLThjMDAtMzI5NmVkOTI1MDdk
name:: Q0JBREMwMgpERUw6YjM0Y2NmZDktMGY4OC00ZjdiLThjMDAtMzI5NmVkOTI1MDdk
whenChanged: 20160327050242.0Z
uSNChanged: 4293
distinguishedName:
CN=CBADC02\0ADEL:b34ccfd9-0f88-4f7b-8c00-3296ed92507d,CN=De
leted Objects,DC=cb,DC=cliffbells,DC=com
# record 3481
dn: CN=CBADC02\0ADEL:ec36364c-6f01-4c82-be95-8def84528d9a,CN=Deleted
Objects,DC=cb,DC=cliffbells,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
instanceType: 4
whenCreated: 20160310044542.0Z
uSNCreated: 4212
objectGUID: ec36364c-6f01-4c82-be95-8def84528d9a
userAccountControl: 532480
objectSid: S-1-5-21-2555112579-3841919511-698463993-1122
sAMAccountName: CBADC02$
dNSHostName: cbadc02.cb.cliffbells.com
cn:: Q0JBREMwMgpERUw6ZWMzNjM2NGMtNmYwMS00YzgyLWJlOTUtOGRlZjg0NTI4ZDlh
whenChanged: 20160318045619.0Z
isDeleted: TRUE
uSNChanged: 4253
name:: Q0JBREMwMgpERUw6ZWMzNjM2NGMtNmYwMS00YzgyLWJlOTUtOGRlZjg0NTI4ZDlh
lastKnownParent: OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
isRecycled: TRUE
distinguishedName:
CN=CBADC02\0ADEL:ec36364c-6f01-4c82-be95-8def84528d9a,CN=De
leted Objects,DC=cb,DC=cliffbells,DC=com
CBADC03 is there once:
# record 3431
dn:
CN=CBADC03\0ADEL:0d3362c2-c153-415e-b077-0772a61b96b5\0ADEL:0d3362c2-c153-415e-b077-0772a61b96b5,CN=Deleted
Obje$
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
instanceType: 4
whenCreated: 20160321211933.0Z
uSNCreated: 4286
objectGUID: 0d3362c2-c153-415e-b077-0772a61b96b5
userAccountControl: 4128
objectSid: S-1-5-21-2555112579-3841919511-698463993-1601
sAMAccountName: CBADC03$
isDeleted: TRUE
lastKnownParent: CN=LostAndFound,DC=cb,DC=cliffbells,DC=com
isRecycled: TRUE
cn::
Q0JBREMwMwpERUw6MGQzMzYyYzItYzE1My00MTVlLWIwNzctMDc3MmE2MWI5NmI1CkRFTDowZ
DMzNjJjMi1jMTUzLTQxNWUtYjA3Ny0wNzcyYTYxYjk2YjU=
name::
Q0JBREMwMwpERUw6MGQzMzYyYzItYzE1My00MTVlLWIwNzctMDc3MmE2MWI5NmI1CkRFTDo
wZDMzNjJjMi1jMTUzLTQxNWUtYjA3Ny0wNzcyYTYxYjk2YjU=
whenChanged: 20160327050527.0Z
uSNChanged: 4294
distinguishedName:
CN=CBADC03\0ADEL:0d3362c2-c153-415e-b077-0772a61b96b5\0ADEL
:0d3362c2-c153-415e-b077-0772a61b96b5,CN=Deleted
Objects,DC=cb,DC=cliffbells,
DC=com
TESTES is nowhere to be found and still fails due to ObjectSID. I don't
understand how that is even possible. I also manually inspected ADUC,
ADSS, ADSIEdit and DNS in RSAT for both of my live DCs (FILER & CBADC01)
and removed all references to CBADC02 & CBADC03. Replication between FILER
and CBADC01 is successful. RSync replication of sysvol from FILER to
CBADC01 is running via cron.
I am spun. I've been banging my head against Samba since 12/17/2015.
Please advise, I need to get these VMs joined to the domain so I can sieze
FSMO roles off of FILER so I don't have to keep restoring this ^&*(@^#()*&^
database every 36 hours.
JS
I searched for CBADC02, CBADC03, and TESTES (all VMs that fail to join
domain), results are below:
CBADC02 shows up a few times:
# record 1906
dn:
CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configu$
objectClass: top
objectClass: server
instanceType: 4
whenCreated: 20160310044543.0Z
uSNCreated: 4215
objectGUID: de85228c-f92b-4d5d-9d6a-01c3f915dec9
systemFlags: 1375731712
dNSHostName: cbadc02.cb.cliffbells.com
cn:: Q0JBREMwMgpERUw6ZGU4NTIyOGMtZjkyYi00ZDVkLTlkNmEtMDFjM2Y5MTVkZWM5
isDeleted: TRUE
name:: Q0JBREMwMgpERUw6ZGU4NTIyOGMtZjkyYi00ZDVkLTlkNmEtMDFjM2Y5MTVkZWM5
lastKnownParent:
CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configurati
on,DC=cb,DC=cliffbells,DC=com
isRecycled: TRUE
whenChanged: 20160319092438.0Z
uSNChanged: 4261
distinguishedName:
CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Se
rvers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbell
s,DC=com
# record 2372
dn: CN=NTDS
Settings\0ADEL:a5d3b626-e936-4a65-97bc-cade176d1b10,CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec$
objectClass: top
objectClass: applicationSettings
objectClass: nTDSDSA
instanceType: 4
whenCreated: 20160310044546.0Z
uSNCreated: 4214
objectGUID: a5d3b626-e936-4a65-97bc-cade176d1b10
systemFlags: 33554432
cn::
TlREUyBTZXR0aW5ncwpERUw6YTVkM2I2MjYtZTkzNi00YTY1LTk3YmMtY2FkZTE3NmQxYjEw
isDeleted: TRUE
name::
TlREUyBTZXR0aW5ncwpERUw6YTVkM2I2MjYtZTkzNi00YTY1LTk3YmMtY2FkZTE3NmQxYjE
w
isRecycled: TRUE
whenChanged: 20160319092438.0Z
uSNChanged: 4259
distinguishedName: CN=NTDS
Settings\0ADEL:a5d3b626-e936-4a65-97bc-cade176d1b10
,CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Servers,CN=Default-
First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
# record 3275
dn: CN=CBADC02\0ADEL:b34ccfd9-0f88-4f7b-8c00-3296ed92507d,CN=Deleted
Objects,DC=cb,DC=cliffbells,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
instanceType: 4
whenCreated: 20160321212014.0Z
uSNCreated: 4287
objectGUID: b34ccfd9-0f88-4f7b-8c00-3296ed92507d
userAccountControl: 4128
objectSid: S-1-5-21-2555112579-3841919511-698463993-1602
sAMAccountName: CBADC02$
isDeleted: TRUE
lastKnownParent: OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
isRecycled: TRUE
cn:: Q0JBREMwMgpERUw6YjM0Y2NmZDktMGY4OC00ZjdiLThjMDAtMzI5NmVkOTI1MDdk
name:: Q0JBREMwMgpERUw6YjM0Y2NmZDktMGY4OC00ZjdiLThjMDAtMzI5NmVkOTI1MDdk
whenChanged: 20160327050242.0Z
uSNChanged: 4293
distinguishedName:
CN=CBADC02\0ADEL:b34ccfd9-0f88-4f7b-8c00-3296ed92507d,CN=De
leted Objects,DC=cb,DC=cliffbells,DC=com
# record 3481
dn: CN=CBADC02\0ADEL:ec36364c-6f01-4c82-be95-8def84528d9a,CN=Deleted
Objects,DC=cb,DC=cliffbells,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
instanceType: 4
whenCreated: 20160310044542.0Z
uSNCreated: 4212
objectGUID: ec36364c-6f01-4c82-be95-8def84528d9a
userAccountControl: 532480
objectSid: S-1-5-21-2555112579-3841919511-698463993-1122
sAMAccountName: CBADC02$
dNSHostName: cbadc02.cb.cliffbells.com
cn:: Q0JBREMwMgpERUw6ZWMzNjM2NGMtNmYwMS00YzgyLWJlOTUtOGRlZjg0NTI4ZDlh
whenChanged: 20160318045619.0Z
isDeleted: TRUE
uSNChanged: 4253
name:: Q0JBREMwMgpERUw6ZWMzNjM2NGMtNmYwMS00YzgyLWJlOTUtOGRlZjg0NTI4ZDlh
lastKnownParent: OU=Domain Controllers,DC=cb,DC=cliffbells,DC=com
isRecycled: TRUE
distinguishedName:
CN=CBADC02\0ADEL:ec36364c-6f01-4c82-be95-8def84528d9a,CN=De
leted Objects,DC=cb,DC=cliffbells,DC=com
CBADC03 is there once:
# record 3431
dn:
CN=CBADC03\0ADEL:0d3362c2-c153-415e-b077-0772a61b96b5\0ADEL:0d3362c2-c153-415e-b077-0772a61b96b5,CN=Deleted
Obje$
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
instanceType: 4
whenCreated: 20160321211933.0Z
uSNCreated: 4286
objectGUID: 0d3362c2-c153-415e-b077-0772a61b96b5
userAccountControl: 4128
objectSid: S-1-5-21-2555112579-3841919511-698463993-1601
sAMAccountName: CBADC03$
isDeleted: TRUE
lastKnownParent: CN=LostAndFound,DC=cb,DC=cliffbells,DC=com
isRecycled: TRUE
cn::
Q0JBREMwMwpERUw6MGQzMzYyYzItYzE1My00MTVlLWIwNzctMDc3MmE2MWI5NmI1CkRFTDowZ
DMzNjJjMi1jMTUzLTQxNWUtYjA3Ny0wNzcyYTYxYjk2YjU=
name::
Q0JBREMwMwpERUw6MGQzMzYyYzItYzE1My00MTVlLWIwNzctMDc3MmE2MWI5NmI1CkRFTDo
wZDMzNjJjMi1jMTUzLTQxNWUtYjA3Ny0wNzcyYTYxYjk2YjU=
whenChanged: 20160327050527.0Z
uSNChanged: 4294
distinguishedName:
CN=CBADC03\0ADEL:0d3362c2-c153-415e-b077-0772a61b96b5\0ADEL
:0d3362c2-c153-415e-b077-0772a61b96b5,CN=Deleted
Objects,DC=cb,DC=cliffbells,
DC=com
TESTES is nowhere to be found and still fails due to ObjectSID. I don't
understand how that is even possible. I also manually inspected ADUC,
ADSS, ADSIEdit and DNS in RSAT for both of my live DCs (FILER & CBADC01)
and removed all references to CBADC02 & CBADC03. Replication between FILER
and CBADC01 is successful. RSync replication of sysvol from FILER to
CBADC01 is running via cron.
I am spun. I've been banging my head against Samba since 12/17/2015.
Please advise, I need to get these VMs joined to the domain so I can sieze
FSMO roles off of FILER so I don't have to keep restoring this ^&*(@^#()*&^
database every 36 hours.
JS
Rowland penny
Mar 27, 2016, 5:10:04 AM3/27/16
to
36 hours, doesn't this tell you something ?
It looks like the database you keep restoring is badly corrupted, you
should also be aware that you shouldn't restore a DC if another DC in
the domain is running.
Are 'FILER' and 'CBADC01' joined ?
If so, is 'FILER' the only database that is giving problems ?
If so, then I think your best option is to seize all the fsmo roles to
'CBADC01', turn off 'FILER' and then try to join a new DC to 'CBADC01'
IT Admin
Mar 28, 2016, 4:20:04 AM3/28/16
to
Alright... appreciate the info. Gave it a shot. Domain is still up but
shares are down because they were hosted on FILER which has now been
demoted and is no longer running any samba services.
What I did while following the wiki "Transfer/Seize FSMO Roles":
1) logged on to FILER, ran samba-tool fsmo show, verified all 7 roles were
owned by FILER.
2) logged on to CBADC01, executed samba-tool fsmo transfer --role=all -U
administrator --realm=cb.cliffbells.com which succeeded.
3) ran samba-tool fsmo show again on FILER, verified all 7 roles were now
owned by CBADC01.
4) ran samba-tool drs showrepl on FILER, replication succeded after
transferring fsmo roles.
5) ran samba-tool domain demote -Uadministrator on FILER.
6) shut down samba on FILER, removed smb.conf, removed initscript
7) followed guidelines to cleanup any remaining references to FILER, it
existed in AD Sites and Services, I removed it. I did not delete DNS
references as FILER is critical in this network and must remain accessible.
8) rebooted FILER and CBADC01
Currently AD is allowing users to login to computers, all shares are dead
because FILER isn't providing them and I can't set it up as a Domain Member
to provide the shares again because CBADC01 is missing 3 of 7 fsmoroleowner
entries. I think I have empty fSMORoleOwner attributes as discussed here:
https://lists.samba.org/archive/samba-technical/2016-January/111516.html
Here's where I'm at:
sudo /usr/local/samba/bin/samba-tool fsmo show
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
line 390, in run
infrastructureMaster = get_fsmo_roleowner(samdb, infrastructure_dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
sudo /usr/local/samba/bin/samba-tool dbcheck --fix --cross-ncs
Checking 3527 objects
ERROR: fSMORoleOwner not found for role CN=RID
Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
Sieze role CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com onto
current DC by adding fSMORoleOwner=CN=NTDS
Settings,CN=CBADC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
[y/N/all/none] y
Failed to sieze role CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
onto current DC by adding fSMORoleOwner=CN=NTDS
Settings,CN=CBADC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
: (20, 'SINGLE-VALUE attribute fSMORoleOwner on CN=RID
Manager$,CN=System,DC=cb,DC=cliffbells,DC=com specified more than once')
ERROR: fSMORoleOwner not found for role
CN=Infrastructure,DC=cb,DC=cliffbells,DC=com
Sieze role CN=Infrastructure,DC=cb,DC=cliffbells,DC=com onto current DC by
adding fSMORoleOwner=CN=NTDS
Settings,CN=CBADC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
[y/N/all/none] y
Failed to sieze role CN=Infrastructure,DC=cb,DC=cliffbells,DC=com onto
current DC by adding fSMORoleOwner=CN=NTDS
Settings,CN=CBADC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
: (20, 'SINGLE-VALUE attribute fSMORoleOwner on
CN=Infrastructure,DC=cb,DC=cliffbells,DC=com specified more than once')
Checked 3527 objects (2 errors)
itwerks@cbadc01:~$ sudo /usr/local/samba/bin/samba-tool fsmo seize
--role=rid --force -U administrator --realm=cb.cliffbells.com
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
line 353, in run
self.seize_role(role, samdb, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 255, in seize_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
sudo /usr/local/samba/bin/samba-tool fsmo seize --role=infrastructure
--force -U administrator --realm=cb.cliffbells.com
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
line 353, in run
self.seize_role(role, samdb, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 255, in seize_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
sudo /usr/local/samba/bin/samba-tool fsmo seize --role=domaindns --force
-U administrator --realm=cb.cliffbells.com
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
line 351, in run
versionopts, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 301, in seize_dns_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
sudo /usr/local/samba/bin/samba-tool fsmo seize --role=forestdns --force -U
administrator --realm=cb.cliffbells.com
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
line 351, in run
versionopts, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 301, in seize_dns_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
I guess I need ldiffs for these, client will be down on a Monday.
JS
shares are down because they were hosted on FILER which has now been
demoted and is no longer running any samba services.
What I did while following the wiki "Transfer/Seize FSMO Roles":
1) logged on to FILER, ran samba-tool fsmo show, verified all 7 roles were
owned by FILER.
2) logged on to CBADC01, executed samba-tool fsmo transfer --role=all -U
administrator --realm=cb.cliffbells.com which succeeded.
3) ran samba-tool fsmo show again on FILER, verified all 7 roles were now
owned by CBADC01.
4) ran samba-tool drs showrepl on FILER, replication succeded after
transferring fsmo roles.
5) ran samba-tool domain demote -Uadministrator on FILER.
6) shut down samba on FILER, removed smb.conf, removed initscript
7) followed guidelines to cleanup any remaining references to FILER, it
existed in AD Sites and Services, I removed it. I did not delete DNS
references as FILER is critical in this network and must remain accessible.
8) rebooted FILER and CBADC01
Currently AD is allowing users to login to computers, all shares are dead
because FILER isn't providing them and I can't set it up as a Domain Member
to provide the shares again because CBADC01 is missing 3 of 7 fsmoroleowner
entries. I think I have empty fSMORoleOwner attributes as discussed here:
https://lists.samba.org/archive/samba-technical/2016-January/111516.html
Here's where I'm at:
sudo /usr/local/samba/bin/samba-tool fsmo show
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
line 390, in run
infrastructureMaster = get_fsmo_roleowner(samdb, infrastructure_dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
sudo /usr/local/samba/bin/samba-tool dbcheck --fix --cross-ncs
Checking 3527 objects
ERROR: fSMORoleOwner not found for role CN=RID
Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
Sieze role CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com onto
current DC by adding fSMORoleOwner=CN=NTDS
Settings,CN=CBADC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
[y/N/all/none] y
Failed to sieze role CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
onto current DC by adding fSMORoleOwner=CN=NTDS
Settings,CN=CBADC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
: (20, 'SINGLE-VALUE attribute fSMORoleOwner on CN=RID
Manager$,CN=System,DC=cb,DC=cliffbells,DC=com specified more than once')
ERROR: fSMORoleOwner not found for role
CN=Infrastructure,DC=cb,DC=cliffbells,DC=com
Sieze role CN=Infrastructure,DC=cb,DC=cliffbells,DC=com onto current DC by
adding fSMORoleOwner=CN=NTDS
Settings,CN=CBADC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
[y/N/all/none] y
Failed to sieze role CN=Infrastructure,DC=cb,DC=cliffbells,DC=com onto
current DC by adding fSMORoleOwner=CN=NTDS
Settings,CN=CBADC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=cb,DC=cliffbells,DC=com
: (20, 'SINGLE-VALUE attribute fSMORoleOwner on
CN=Infrastructure,DC=cb,DC=cliffbells,DC=com specified more than once')
Checked 3527 objects (2 errors)
itwerks@cbadc01:~$ sudo /usr/local/samba/bin/samba-tool fsmo seize
--role=rid --force -U administrator --realm=cb.cliffbells.com
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
line 353, in run
self.seize_role(role, samdb, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 255, in seize_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
sudo /usr/local/samba/bin/samba-tool fsmo seize --role=infrastructure
--force -U administrator --realm=cb.cliffbells.com
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
line 353, in run
self.seize_role(role, samdb, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 255, in seize_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
sudo /usr/local/samba/bin/samba-tool fsmo seize --role=domaindns --force
-U administrator --realm=cb.cliffbells.com
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
line 351, in run
versionopts, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 301, in seize_dns_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
sudo /usr/local/samba/bin/samba-tool fsmo seize --role=forestdns --force -U
administrator --realm=cb.cliffbells.com
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
line 351, in run
versionopts, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 301, in seize_dns_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
I guess I need ldiffs for these, client will be down on a Monday.
JS
Rowland penny
Mar 28, 2016, 4:50:04 AM3/28/16
to
On 28/03/16 09:09, IT Admin wrote:
> Alright... appreciate the info. Gave it a shot. Domain is still up
> but shares are down because they were hosted on FILER which has now
> been demoted and is no longer running any samba services.
>
> What I did while following the wiki "Transfer/Seize FSMO Roles":
>
> 1) logged on to FILER, ran samba-tool fsmo show, verified all 7 roles
> were owned by FILER.
>
> 2) logged on to CBADC01, executed samba-tool fsmo transfer --role=all
> -U administrator --realm=cb.cliffbells.com <http://cb.cliffbells.com>
> Alright... appreciate the info. Gave it a shot. Domain is still up
> but shares are down because they were hosted on FILER which has now
> been demoted and is no longer running any samba services.
>
> What I did while following the wiki "Transfer/Seize FSMO Roles":
>
> 1) logged on to FILER, ran samba-tool fsmo show, verified all 7 roles
> were owned by FILER.
>
> 2) logged on to CBADC01, executed samba-tool fsmo transfer --role=all
> which succeeded.
>
> 3) ran samba-tool fsmo show again on FILER, verified all 7 roles were
> now owned by CBADC01.
>
> 4) ran samba-tool drs showrepl on FILER, replication succeded after
> transferring fsmo roles.
>
> 5) ran samba-tool domain demote -Uadministrator on FILER.
>
> 6) shut down samba on FILER, removed smb.conf, removed initscript
>
> 7) followed guidelines to cleanup any remaining references to FILER,
> it existed in AD Sites and Services, I removed it. I did not delete
> DNS references as FILER is critical in this network and must remain
> accessible.
>
> 8) rebooted FILER and CBADC01
>
>
> Currently AD is allowing users to login to computers, all shares are
> dead because FILER isn't providing them and I can't set it up as a
> Domain Member to provide the shares again because CBADC01 is missing 3
> of 7 fsmoroleowner entries. I think I have empty fSMORoleOwner
> attributes//as discussed here:
>
> 3) ran samba-tool fsmo show again on FILER, verified all 7 roles were
> now owned by CBADC01.
>
> 4) ran samba-tool drs showrepl on FILER, replication succeded after
> transferring fsmo roles.
>
> 5) ran samba-tool domain demote -Uadministrator on FILER.
>
> 6) shut down samba on FILER, removed smb.conf, removed initscript
>
> 7) followed guidelines to cleanup any remaining references to FILER,
> it existed in AD Sites and Services, I removed it. I did not delete
> DNS references as FILER is critical in this network and must remain
> accessible.
>
> 8) rebooted FILER and CBADC01
>
>
> Currently AD is allowing users to login to computers, all shares are
> dead because FILER isn't providing them and I can't set it up as a
> Domain Member to provide the shares again because CBADC01 is missing 3
> of 7 fsmoroleowner entries. I think I have empty fSMORoleOwner
> ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such
> element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 353, in run
> self.seize_role(role, samdb, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 255, in seize_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=infrastructure
> --force -U administrator --realm=cb.cliffbells.com
> <http://cb.cliffbells.com>
> element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 353, in run
> self.seize_role(role, samdb, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 255, in seize_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=infrastructure
> --force -U administrator --realm=cb.cliffbells.com
> ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such
> element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 353, in run
> self.seize_role(role, samdb, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 255, in seize_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=domaindns
> --force -U administrator --realm=cb.cliffbells.com
> <http://cb.cliffbells.com>
> element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 353, in run
> self.seize_role(role, samdb, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 255, in seize_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=domaindns
> --force -U administrator --realm=cb.cliffbells.com
> ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such
> element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 351, in run
> versionopts, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 301, in seize_dns_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=forestdns
> --force -U administrator --realm=cb.cliffbells.com
> <http://cb.cliffbells.com>
> element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 351, in run
> versionopts, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 301, in seize_dns_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
> line 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=forestdns
> --force -U administrator --realm=cb.cliffbells.com
running this:
ldbsearch --cross-ncs -H /var/lib/samba/private/sam.ldb
'(fsmoroleowner=*)' | grep 'dn:' | sed 's|dn: ||'
This should show all the DNs that have a 'fSMORoleOwner' attribute.
Have you tried running
'samba-tool fsmo seize --force --role=all -UAdministrator
--password=ADMINISTRATORPASSWORD'
on the DC
IT Admin
Mar 28, 2016, 5:10:04 AM3/28/16
to
Sorry, I meant to include the command you sent in my last message, I had
executed it while troubleshooting...
:~$ sudo /usr/local/samba/bin/ldbsearch --cross-ncs -H
/usr/local/samba/private/sam.ldb '(fsmoroleowner=*)' | grep 'dn:' | sed
's|dn: ||'
CN=Schema,CN=Configuration,DC=cb,DC=cliffbells,DC=com
CN=Partitions,CN=Configuration,DC=cb,DC=cliffbells,DC=com
CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com
CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com
CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
DC=cb,DC=cliffbells,DC=com
CN=Infrastructure,DC=cb,DC=cliffbells,DC=com
I have tried to seize role=all --force...
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 339, in run
self.seize_role("rid", samdb, force)
http://www.spinics.net/lists/samba/msg131164.html
I'm in a bit over my head, any help is greatly appreciated.
JS
executed it while troubleshooting...
:~$ sudo /usr/local/samba/bin/ldbsearch --cross-ncs -H
/usr/local/samba/private/sam.ldb '(fsmoroleowner=*)' | grep 'dn:' | sed
's|dn: ||'
CN=Schema,CN=Configuration,DC=cb,DC=cliffbells,DC=com
CN=Partitions,CN=Configuration,DC=cb,DC=cliffbells,DC=com
CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com
CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com
CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
DC=cb,DC=cliffbells,DC=com
CN=Infrastructure,DC=cb,DC=cliffbells,DC=com
I have tried to seize role=all --force...
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
self.seize_role("rid", samdb, force)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 255, in seize_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
I found another thread about the issue:
line 255, in seize_role
master_owner = get_fsmo_roleowner(samdb, m.dn)
File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py",
line 42, in get_fsmo_roleowner
master_owner = res[0]["fSMORoleOwner"][0]
http://www.spinics.net/lists/samba/msg131164.html
I'm in a bit over my head, any help is greatly appreciated.
JS
On Mar 28, 2016 4:46 AM, "Rowland penny" <rpe...@samba.org> wrote:
> On 28/03/16 09:09, IT Admin wrote:
>
> Alright... appreciate the info. Gave it a shot. Domain is still up but
> shares are down because they were hosted on FILER which has now been
> demoted and is no longer running any samba services.
>
> What I did while following the wiki "Transfer/Seize FSMO Roles":
>
> 1) logged on to FILER, ran samba-tool fsmo show, verified all 7 roles were
> owned by FILER.
>
> 2) logged on to CBADC01, executed samba-tool fsmo transfer --role=all -U
> administrator --realm=cb.cliffbells.com which succeeded.
> On 28/03/16 09:09, IT Admin wrote:
>
> Alright... appreciate the info. Gave it a shot. Domain is still up but
> shares are down because they were hosted on FILER which has now been
> demoted and is no longer running any samba services.
>
> What I did while following the wiki "Transfer/Seize FSMO Roles":
>
> 1) logged on to FILER, ran samba-tool fsmo show, verified all 7 roles were
> owned by FILER.
>
> 2) logged on to CBADC01, executed samba-tool fsmo transfer --role=all -U
>
> 3) ran samba-tool fsmo show again on FILER, verified all 7 roles were now
> owned by CBADC01.
>
> 4) ran samba-tool drs showrepl on FILER, replication succeded after
> transferring fsmo roles.
>
> 5) ran samba-tool domain demote -Uadministrator on FILER.
>
> 6) shut down samba on FILER, removed smb.conf, removed initscript
>
> 7) followed guidelines to cleanup any remaining references to FILER, it
> existed in AD Sites and Services, I removed it. I did not delete DNS
> references as FILER is critical in this network and must remain accessible.
>
> 8) rebooted FILER and CBADC01
>
>
> Currently AD is allowing users to login to computers, all shares are dead
> because FILER isn't providing them and I can't set it up as a Domain Member
> to provide the shares again because CBADC01 is missing 3 of 7 fsmoroleowner
> entries. I think I have empty fSMORoleOwner attributes as discussed
> 3) ran samba-tool fsmo show again on FILER, verified all 7 roles were now
> owned by CBADC01.
>
> 4) ran samba-tool drs showrepl on FILER, replication succeded after
> transferring fsmo roles.
>
> 5) ran samba-tool domain demote -Uadministrator on FILER.
>
> 6) shut down samba on FILER, removed smb.conf, removed initscript
>
> 7) followed guidelines to cleanup any remaining references to FILER, it
> existed in AD Sites and Services, I removed it. I did not delete DNS
> references as FILER is critical in this network and must remain accessible.
>
> 8) rebooted FILER and CBADC01
>
>
> Currently AD is allowing users to login to computers, all shares are dead
> because FILER isn't providing them and I can't set it up as a Domain Member
> to provide the shares again because CBADC01 is missing 3 of 7 fsmoroleowner
> ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 353, in run
> self.seize_role(role, samdb, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 255, in seize_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=infrastructure
> --force -U administrator --realm=cb.cliffbells.com
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 353, in run
> self.seize_role(role, samdb, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 255, in seize_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=infrastructure
> --force -U administrator --realm=cb.cliffbells.com
> ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 353, in run
> self.seize_role(role, samdb, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 255, in seize_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=domaindns --force
> -U administrator --realm=cb.cliffbells.com
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 353, in run
> self.seize_role(role, samdb, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 255, in seize_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=domaindns --force
> -U administrator --realm=cb.cliffbells.com
> ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 351, in run
> versionopts, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 301, in seize_dns_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=forestdns --force
> -U administrator --realm=cb.cliffbells.com
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 351, in run
> versionopts, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 301, in seize_dns_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> sudo /usr/local/samba/bin/samba-tool fsmo seize --role=forestdns --force
> -U administrator --realm=cb.cliffbells.com
> ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such element'
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 351, in run
> versionopts, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 301, in seize_dns_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> I guess I need ldiffs for these, client will be down on a Monday.
>
>
> JS
>
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/__init__.py",
> line 175, in _run
> return self.run(*args, **kwargs)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 351, in run
> versionopts, force)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 301, in seize_dns_role
> master_owner = get_fsmo_roleowner(samdb, m.dn)
> File
> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/fsmo.py", line
> 42, in get_fsmo_roleowner
> master_owner = res[0]["fSMORoleOwner"][0]
>
>
> I guess I need ldiffs for these, client will be down on a Monday.
>
>
> JS
>
> On Sun, Mar 27, 2016 at 5:02 AM, Rowland penny <rpe...@samba.org> wrote:
>
>> On 27/03/16 07:25, IT Admin wrote:
>>
>>> I ran ldbsearch on my sam.ldb
>>> I searched for CBADC02, CBADC03, and TESTES (all VMs that fail to join
>>> domain), results are below:
>>>
>>>
>>> CBADC02 shows up a few times:
>>>
>>> # record 1906
>>> dn:
>>>
>>> CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configu$
>>> objectClass: top
>>> objectClass: server
>>> instanceType: 4
>>> whenCreated: 20160310044543.0Z
>>> uSNCreated: 4215
>>> objectGUID: de85228c-f92b-4d5d-9d6a-01c3f915dec9
>>> systemFlags: 1375731712
>>> dNSHostName: cbadc02.cb.cliffbells.com
>
>> On 27/03/16 07:25, IT Admin wrote:
>>
>>> I ran ldbsearch on my sam.ldb
>>> I searched for CBADC02, CBADC03, and TESTES (all VMs that fail to join
>>> domain), results are below:
>>>
>>>
>>> CBADC02 shows up a few times:
>>>
>>> # record 1906
>>> dn:
>>>
>>> CN=CBADC02\0ADEL:de85228c-f92b-4d5d-9d6a-01c3f915dec9,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configu$
>>> objectClass: top
>>> objectClass: server
>>> instanceType: 4
>>> whenCreated: 20160310044543.0Z
>>> uSNCreated: 4215
>>> objectGUID: de85228c-f92b-4d5d-9d6a-01c3f915dec9
>>> systemFlags: 1375731712
>>> dNSHostName: cbadc02.cb.cliffbells.com
Rowland penny
Mar 28, 2016, 6:40:03 AM3/28/16
to
ridmaster fsmo role, what does this return:
ldbsearch -H /var/lib/samba/private/sam.ldb -b
'CN=System,DC=cb,DC=cliffbells,DC=com' -s sub
'(&(objectclass=rIDManager)(cn=RID Manager$))' fSMORoleOwner
On my system:
# record 1
dn: CN=RID Manager$,CN=System,DC=samdom,DC=example,DC=com
fSMORoleOwner: CN=NTDS
Settings,CN=DC1,CN=Servers,CN=Default-First-Site-Name,C
N=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
Rowland penny
Mar 28, 2016, 2:00:03 PM3/28/16
to
On 28/03/16 18:46, IT Admin wrote:
>
> Hi Rowland,
>
> I had run those queries during troubleshooting last night as well,
> apologies if I get ahead of myself, here are all of my missing roles,
> they only have dn entries, the second line containing fsmoowner is blank:
>
> itwerks@cbadc01:~$ sudo /usr/local/samba/bin/ldbsearch -H
> /usr/local/samba/private/sam.ldb -b
> dn: CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
>
> # returned 1 records
> # 1 entries
> # 0 referrals
>
> itwerks@cbadc01:~$ !284
> sudo /usr/local/samba/bin/ldbsearch --cross-ncs -H
> /usr/local/samba/private/sam.ldb -b
> "CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com" -s
> base fsmoroleowner
> # record 1
> dn: CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com
>
> # returned 1 records
> # 1 entries
> # 0 referrals
>
> itwerks@cbadc01:~$ !285 sudo /usr/local/samba/bin/ldbsearch
> --cross-ncs -H /usr/local/samba/private/sam.ldb -b
> "CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com" -s
> base fsmoroleowner
> # record 1
> dn: CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com
>
> # returned 1 records
> # 1 entries
> # 0 referrals
>
> itwerks@cbadc01:~$ !286 sudo /usr/local/samba/bin/ldbsearch
> --cross-ncs -H /usr/local/samba/private/sam.ldb -b
> "CN=Infrastructure,DC=cb,DC=cliffbells,DC=com" -s base fsmoroleowner
> # record 1
> dn: CN=Infrastructure,DC=cb,DC=cliffbells,DC=com
>
> # returned 1 records
> # 1 entries
> # 0 referrals
> itwerks@cbadc01:~$
>
> JS
>
OK, there appears to be a bug in the fsmo.py code, can you bear with me
whilst I try to sort it and also come up with something to possibly fix
your problem.
The bug has nothing to do with your main problem, it has to do with the
error i.e. it shouldn't.
>
> Hi Rowland,
>
> I had run those queries during troubleshooting last night as well,
> apologies if I get ahead of myself, here are all of my missing roles,
> they only have dn entries, the second line containing fsmoowner is blank:
>
> itwerks@cbadc01:~$ sudo /usr/local/samba/bin/ldbsearch -H
> /usr/local/samba/private/sam.ldb -b
> 'CN=System,DC=cb,DC=cliffbells,DC=com' -s sub
> '(&(objectclass=rIDManager)(cn=RID Manager$))' fSMORoleOwner
> # record 1
> '(&(objectclass=rIDManager)(cn=RID Manager$))' fSMORoleOwner
> dn: CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
>
> # returned 1 records
> # 1 entries
> # 0 referrals
>
> itwerks@cbadc01:~$ !284
> sudo /usr/local/samba/bin/ldbsearch --cross-ncs -H
> /usr/local/samba/private/sam.ldb -b
> "CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com" -s
> base fsmoroleowner
> # record 1
> dn: CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com
>
> # returned 1 records
> # 1 entries
> # 0 referrals
>
> itwerks@cbadc01:~$ !285 sudo /usr/local/samba/bin/ldbsearch
> --cross-ncs -H /usr/local/samba/private/sam.ldb -b
> "CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com" -s
> base fsmoroleowner
> # record 1
> dn: CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com
>
> # returned 1 records
> # 1 entries
> # 0 referrals
>
> itwerks@cbadc01:~$ !286 sudo /usr/local/samba/bin/ldbsearch
> --cross-ncs -H /usr/local/samba/private/sam.ldb -b
> "CN=Infrastructure,DC=cb,DC=cliffbells,DC=com" -s base fsmoroleowner
> # record 1
> dn: CN=Infrastructure,DC=cb,DC=cliffbells,DC=com
>
> # returned 1 records
> # 1 entries
> # 0 referrals
> itwerks@cbadc01:~$
>
> JS
>
OK, there appears to be a bug in the fsmo.py code, can you bear with me
whilst I try to sort it and also come up with something to possibly fix
your problem.
The bug has nothing to do with your main problem, it has to do with the
error i.e. it shouldn't.
IT Admin
Mar 28, 2016, 2:00:04 PM3/28/16
to
Hi Rowland,
I had run those queries during troubleshooting last night as well,
apologies if I get ahead of myself, here are all of my missing roles, they
only have dn entries, the second line containing fsmoowner is blank:
itwerks@cbadc01:~$ sudo /usr/local/samba/bin/ldbsearch -H
I had run those queries during troubleshooting last night as well,
apologies if I get ahead of myself, here are all of my missing roles, they
only have dn entries, the second line containing fsmoowner is blank:
/usr/local/samba/private/sam.ldb -b 'CN=System,DC=cb,DC=cliffbells,DC=com'
-s sub '(&(objectclass=rIDManager)(cn=RID Manager$))' fSMORoleOwner
# record 1
dn: CN=RID Manager$,CN=System,DC=cb,DC=cliffbells,DC=com
# returned 1 records
# 1 entries
# 0 referrals
itwerks@cbadc01:~$ !284
sudo /usr/local/samba/bin/ldbsearch --cross-ncs -H
# returned 1 records
# 1 entries
# 0 referrals
itwerks@cbadc01:~$ !284
/usr/local/samba/private/sam.ldb -b
"CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com" -s base
fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com
# returned 1 records
# 1 entries
# 0 referrals
itwerks@cbadc01:~$
!285
sudo /usr/local/samba/bin/ldbsearch --cross-ncs -H
"CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com" -s base
fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=DomainDnsZones,DC=cb,DC=cliffbells,DC=com
# returned 1 records
# 1 entries
# 0 referrals
itwerks@cbadc01:~$
!285
/usr/local/samba/private/sam.ldb -b
"CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com" -s base
fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com
# returned 1 records
# 1 entries
# 0 referrals
itwerks@cbadc01:~$
!286
sudo /usr/local/samba/bin/ldbsearch --cross-ncs -H
"CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com" -s base
fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=ForestDnsZones,DC=cb,DC=cliffbells,DC=com
# returned 1 records
# 1 entries
# 0 referrals
itwerks@cbadc01:~$
!286
/usr/local/samba/private/sam.ldb -b
"CN=Infrastructure,DC=cb,DC=cliffbells,DC=com" -s base fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=cb,DC=cliffbells,DC=com
# returned 1 records
# 1 entries
# 0 referrals
itwerks@cbadc01:~$
JS
"CN=Infrastructure,DC=cb,DC=cliffbells,DC=com" -s base fsmoroleowner
# record 1
dn: CN=Infrastructure,DC=cb,DC=cliffbells,DC=com
# returned 1 records
# 1 entries
# 0 referrals
itwerks@cbadc01:~$
JS
mathias dufresne
Mar 29, 2016, 5:10:03 AM3/29/16
to
Hi JS,
Rowland was right about restoring, which I didn't spotted, you must always
have only one DC running when you restore: the DC you are restoring. All
others must obviously stopped as they run the old DB, the broken one and
you don't want the restored DB collide with the broken ones hosted one on
old DCs.
Regarding deleted objects: if you want to get rid of deleted objects you
can modify tombstoneLifeTime which is a configuration item.
Here are information about changing that parameter:
https://www.petri.com/changing_the_tombstone_lifetime_windows_ad
Why changing that parameter? You have deleted objects, they could be what
blocks you (I'm arriving at work and I don't fully read all your mails, not
carefully enough at least). Changing that parameter to 1 (days) and waiting
for 1 day long, your deleted objects will be really deleted, or I missed
something about that parameter.
Regarding missing FSMO: I would try to seize them (with --force at least)
on each FSMO, one by one.
If that does not work you can try to force them manually.
Here are my own FSMO:
ldbsearch --cross-ncs -H $sam fsmoroleowner=* dn fSMORoleOwner
# record 1
dn: CN=Schema,CN=Configuration,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 2
dn: CN=Partitions,CN=Configuration,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 3
dn: CN=Infrastructure,DC=DomainDnsZones,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 4
dn: CN=Infrastructure,DC=ForestDnsZones,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 5
dn: CN=Infrastructure,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 6
dn: DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 7
dn: CN=RID Manager$,CN=System,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
You could try to use some LDIF files to add fSMORoleOwner attribute to FSMO
roles:
---------------------
dn: DC=samba,DC=domain,DC=tld
changetype: modify
add: fSMORoleOwner
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
---------------------------------
Before using that LDIF:
- you must verify the object declared as new fSMORoleOwner is existing.
- you must chose CN=NTDS Settings,CN=<YOUR_WORKING_DC>,...............
- you should try to add only one role and verify the role is well set
before trying to add others roles
- you MUST take note of what you do, to rollback these tries in case they
don't work (which I have no idea).
Rowland was right about restoring, which I didn't spotted, you must always
have only one DC running when you restore: the DC you are restoring. All
others must obviously stopped as they run the old DB, the broken one and
you don't want the restored DB collide with the broken ones hosted one on
old DCs.
Regarding deleted objects: if you want to get rid of deleted objects you
can modify tombstoneLifeTime which is a configuration item.
Here are information about changing that parameter:
https://www.petri.com/changing_the_tombstone_lifetime_windows_ad
Why changing that parameter? You have deleted objects, they could be what
blocks you (I'm arriving at work and I don't fully read all your mails, not
carefully enough at least). Changing that parameter to 1 (days) and waiting
for 1 day long, your deleted objects will be really deleted, or I missed
something about that parameter.
Regarding missing FSMO: I would try to seize them (with --force at least)
on each FSMO, one by one.
If that does not work you can try to force them manually.
Here are my own FSMO:
ldbsearch --cross-ncs -H $sam fsmoroleowner=* dn fSMORoleOwner
# record 1
dn: CN=Schema,CN=Configuration,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 2
dn: CN=Partitions,CN=Configuration,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 3
dn: CN=Infrastructure,DC=DomainDnsZones,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 4
dn: CN=Infrastructure,DC=ForestDnsZones,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 5
dn: CN=Infrastructure,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 6
dn: DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
# record 7
dn: CN=RID Manager$,CN=System,DC=samba,DC=domain,DC=tld
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
You could try to use some LDIF files to add fSMORoleOwner attribute to FSMO
roles:
---------------------
dn: DC=samba,DC=domain,DC=tld
changetype: modify
add: fSMORoleOwner
fSMORoleOwner: CN=NTDS
Settings,CN=DC200,CN=Servers,CN=Autres,CN=Sites,CN=Conf
iguration,DC=samba,DC=domain,DC=tld
---------------------------------
Before using that LDIF:
- you must verify the object declared as new fSMORoleOwner is existing.
- you must chose CN=NTDS Settings,CN=<YOUR_WORKING_DC>,...............
- you should try to add only one role and verify the role is well set
before trying to add others roles
- you MUST take note of what you do, to rollback these tries in case they
don't work (which I have no idea).
0 new messages