<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Hi Matthieu<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I tried reproducing the scenario by provisioning Windows 2k8 R2 as external DNS server, Windows 2k8 R2 as Primary Domain Controller (PDC) and Windows 2k3 Sp2 as 2nd Domain Controller and didn’t observe additional DRSAddEntry packets
flowing from 2nd Domain Controller to PDC, capture enclosed. I also replayed TTT trace and
<b><u>seems 2nd Domain controller is receiving LDAP ADD Request packets triggering</u></b> it to invoke these additional DRSAddEntry packets.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal">I also created a local repro with SAMBA server as PDC build dated (5<sup>th</sup> Nov’11) and didn’t observe any additional DRSAddEntry packets, listed below are the steps I performed to add the 2nd domain controller. However, it would
be helpful if you can share the network trace of entire scenario (hopefully LDAP packets will be unencrypted) so that I can analyze it in parallel.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">Steps to Add 2nd Domain Controller:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">1) Machine was not joined to the existing PDC (test.com)<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">2) Selected option “Additional domain controller for an existing domain”.<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">3) Entered the full DNS name of existing domain controller. (test.com)<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks<o:p></o:p></p>
<p class="MsoPlainText">Tarun.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: Matthieu Patou [mailto:mat@samba.org] <br>
Sent: Tuesday, November 22, 2011 2:17 PM<br>
To: Tarun Chopra<br>
Cc: MSSolve Case Email; cifs-protocol@samba.org; pfif@tridgell.net<br>
Subject: Re: [REG: 111111580301298 ] DNS partition creation</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Hello Tarun,<o:p></o:p></p>
<p class="MsoPlainText">On 22/11/2011 22:42, Tarun Chopra wrote:<o:p></o:p></p>
<p class="MsoPlainText">> Hi Matthieu - On windows box, I can also see ADDEntry request from 2nd domain controller to 1st domain controller during DCPROMO. By below statement, is it that you are seeing this packet during DCPROMO or after DCPROMO completes and
machine restarts ?<o:p></o:p></p>
<p class="MsoPlainText">You'll see the DsAddEntry during DC promo to create some objects needed for the replication, but my point is for after DCPROMO and not for object related to the to be promoted DC but for the container for DNS<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> 3) Scenario when windows DC w/o DNS is trying to create these partitions. Is it during domain join or replication or something else ?<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> So after the DC promo, I see DsAddEntry packet from the second DC to the first one.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">So is it "normal" that a 2nd DC tries to create the DNS containers after
<o:p></o:p></p>
<p class="MsoPlainText">joining a domain where DNS zones are not stored in the AD ?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Matthieu.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Thanks.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Tarun<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: Tarun Chopra<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Saturday, November 19, 2011 1:42 AM<o:p></o:p></p>
<p class="MsoPlainText">> To: 'mat@samba.org'<o:p></o:p></p>
<p class="MsoPlainText">> Cc: MSSolve Case Email<o:p></o:p></p>
<p class="MsoPlainText">> Subject: RE: [REG: 111111580301298 ] DNS partition creation<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Thanks Matthieu, I am able to load previously shared TTT traces. Will update you as soon as I am done with investigation.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-- <o:p></o:p></p>
<p class="MsoPlainText">Matthieu Patou<o:p></o:p></p>
<p class="MsoPlainText">Samba Team<o:p></o:p></p>
<p class="MsoPlainText"><a href="http://samba.org"><span style="color:windowtext;text-decoration:none">http://samba.org</span></a><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
</div>
</body>
</html>