[Samba] Samba 4.16 replication of Windows AD 2019

Sat Jun 10 09:54:43 UTC 2023

To address the WERR_DS_INCOMPATIBLE_VERSION, you can use Samba git
master.

The extra step needed on 'master' is to add --option="ad dc functional
level = 2016" to the command line of the the join command, and accept
that Samba won't be fully implementing the extra features that a real
2016 DC would do.

Or demote your domain back to the 2008R2 functional level.

Andrew Bartlett

On Fri, 2023-06-09 at 07:42 -0500, Kasandra Padisha via samba wrote:
> Hi
> 
> Thanks for the answer but it is no possible to join as DC because it
> is 
> not compatible. 
> (
> https://wiki.samba.org/index.php/AD_Schema_Version_Support
> ). I get the 
> following error
> 
> DsAddEntry failed with status WERR_ACCESS_DENIED info (8567, 
> 'WERR_DS_INCOMPATIBLE_VERSION')
> 
> So I chose to do it as RODC and it seems to work.
> 
> I have also tryied with two differente users administrator and
> repdomain.
> 
> Thanks for your time
> 
> Cheers
> 
> El 8/06/23 a las 3:58 PM, Andrew Bartlett via samba escribió:
> > On Thu, 2023-06-08 at 10:22 -0500, Kasandra Padisha via samba
> > wrote:
> > > Hi
> > > I am trying to join a Samba 4.16 to an AD 2019 but i am getting a
> > > 8453 error. All the information is as follows
> > > OS: Debian 11Samba:  4.16.10AD: Windows 2019 Std
> > > I execute the command
> > > samba-tool domain join mydomain.com.co RODC
> > > -U"mydomain/repdomain" --
> > > password='XXXX' --site=nwsite
> > > And it works Ok for a while, but at the end it fails with a
> > > permission error (looks like it)
> > > ERROR(runtime): uncaught exception - (8453,
> > > 'WERR_DS_DRA_ACCESS_DENIED')
> > 
> > Perhaps try joining as a full DC, not an RODC?
> > The RODC does funny things with regard to the user who does the
> > replication.  Also try the latest version.
> > If you must do an RODC, or want to investigate further, then you
> > may
> > need to look at which user is doing the replication - the
> > administrator
> > or the machine account for example.
> > Andrew Bartlett
> > > I have already follow the instructions, without success,  from MS
> > > howto in
> > > https://learn.microsoft.com/en-US/troubleshoot/windows-server/identity/replication-error-8453
> > > 
> > > 
> > > An then I am stuck and I need some clues.
> > > Thanks in advance
> > > ----------------------- Here the whole command output ---------
> > > ----
> > > ------------
> > > root at replica-aws:~# samba-tool domain join mydomain.com.co RODC
> > > -U"mydomain/repdomain" --password='xxxxxx' --site=awsWARNING:
> > > Using
> > > password on command line is insecure. Please install the
> > > setproctitle
> > > python module.INFO 2023-06-08 09:43:13,439 pid:3334782
> > > /usr/lib/python3/dist-packages/samba/join.py #105: Finding a
> > > writeable DC for domain 'mydomain.com.co'INFO 2023-06-08
> > > 09:43:21,611
> > > pid:3334782 /usr/lib/python3/dist-packages/samba/join.py #107:
> > > Found
> > > DC GUEPARDO.mydomain.com.coINFO 2023-06-08 09:43:24,165
> > > pid:3334782
> > > /usr/lib/python3/dist-packages/samba/join.py #1508: workgroup is
> > > mydomainINFO 2023-06-08 09:43:24,165 pid:3334782
> > > /usr/lib/python3/dist-packages/samba/join.py #1511: realm is
> > > mydomain.com.coAdding CN=REPLICA-AWS,OU=Domain
> > > Controllers,DC=mydomain,DC=com,DC=coAdding CN=krbtgt_REPLICA-
> > > AWS,CN=Users,DC=mydomain,DC=com,DC=coGot
> > > krbtgt_name=krbtgt_29903Renaming CN=krbtgt_REPLICA-
> > > AWS,CN=Users,DC=mydomain,DC=com,DC=co to
> > > CN=krbtgt_29903,CN=Users,DC=mydomain,DC=com,DC=coAdding
> > > CN=REPLICA-
> > > AWS,CN=Servers,CN=aws,CN=Sites,CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =coAdding CN=NTDS Settings,CN=REPLICA-
> > > AWS,CN=Servers,CN=aws,CN=Sites,CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =coAdding CN=RODC Connection (FRS),CN=NTDS Settings,CN=REPLICA-
> > > AWS,CN=Servers,CN=aws,CN=Sites,CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =coAdding SPNs to CN=REPLICA-AWS,OU=Domain
> > > Controllers,DC=mydomain,DC=com,DC=coSetting account password for
> > > REPLICA-AWS$Enabling accountCalling bare provisionINFO 2023-06-08
> > > 09:43:29,620 pid:3334782 /usr/lib/python3/dist-
> > > packages/samba/provision/__init__.py #2108: Looking up IPv4
> > > addressesINFO 2023-06-08 09:43:29,620 pid:3334782
> > > /usr/lib/python3/dist-packages/samba/provision/__init__.py #2125:
> > > Looking up IPv6 addressesWARNING 2023-06-08 09:43:29,620
> > > pid:3334782
> > > /usr/lib/python3/dist-packages/samba/provision/__init__.py #2132:
> > > No
> > > IPv6 address will be assignedINFO 2023-06-08 09:43:29,839
> > > pid:3334782
> > > /usr/lib/python3/dist-packages/samba/provision/__init__.py #2278:
> > > Setting up secrets.ldbINFO 2023-06-08 09:43:29,856 pid:3334782
> > > /usr/lib/python3/dist-packages/samba/provision/__init__.py #2283:
> > > Setting up the registryINFO 2023-06-08 09:43:29,867 pid:3334782
> > > /usr/lib/python3/dist-packages/samba/provision/__init__.py #2286:
> > > Setting up the privileges databaseINFO 2023-06-08 09:43:29,895
> > > pid:3334782 /usr/lib/python3/dist-
> > > packages/samba/provision/__init__.py #2289: Setting up idmap
> > > dbINFO
> > > 2023-06-08 09:43:29,915 pid:3334782 /usr/lib/python3/dist-
> > > packages/samba/provision/__init__.py #2296: Setting up SAM dbINFO
> > > 2023-06-08 09:43:29,921 pid:3334782 /usr/lib/python3/dist-
> > > packages/samba/provision/__init__.py #880: Setting up sam.ldb
> > > partitions and settingsINFO 2023-06-08 09:43:29,922 pid:3334782
> > > /usr/lib/python3/dist-packages/samba/provision/__init__.py #892:
> > > Setting up sam.ldb rootDSEINFO 2023-06-08 09:43:29,926
> > > pid:3334782
> > > /usr/lib/python3/dist-packages/samba/provision/__init__.py #1305:
> > > Pre-loading the Samba 4 and AD schemaUnable to determine the
> > > DomainSID, can not enforce uniqueness constraint on local
> > > domainSIDs
> > > INFO 2023-06-08 09:43:29,953 pid:3334782 /usr/lib/python3/dist-
> > > packages/samba/provision/__init__.py #2348: A Kerberos
> > > configuration
> > > suitable for Samba AD has been generated at
> > > /var/lib/samba/private/krb5.confINFO 2023-06-08 09:43:29,953
> > > pid:3334782 /usr/lib/python3/dist-
> > > packages/samba/provision/__init__.py #2350: Merge the contents of
> > > this file with your system krb5.conf or replace it with this one.
> > > Do
> > > not create a symlink!Provision OK for domain DN
> > > DC=mydomain,DC=com,DC=coStarting replicationSchema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[402/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[804/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[1206/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[1608/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[2010/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[2412/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[2814/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[3212/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[3614/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[4016/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[4418/4046] linked_values[0/0]Schema-
> > > DN[CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[4540/4046] linked_values[0/0]Analyze and apply schema
> > > objectsPartition[CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[330/7102]
> > > linked_values[0/3745]Partition[CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =co] objects[474/7102]
> > > linked_values[0/3745]Partition[CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =co] objects[632/7102]
> > > linked_values[0/3745]Partition[CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =co] objects[795/7102]
> > > linked_values[0/3745]Partition[CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =co] objects[948/7102] linked_values[135/3745]Failed to commit
> > > objects: DOS code 0x000021bfMissing target object - retrying with
> > > DRS_GET_TGTPartition[CN=Configuration,DC=mydomain,DC=com,DC=co]
> > > objects[1059/7102]
> > > linked_values[160/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[1132/7102]
> > > linked_values[230/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[1208/7102]
> > > linked_values[302/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[1273/7102]
> > > linked_values[364/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[1343/7102]
> > > linked_values[430/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[1583/7102]
> > > linked_values[456/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[1985/7102]
> > > linked_values[456/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[2387/7102]
> > > linked_values[456/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[2738/7102]
> > > linked_values[718/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[3063/7102]
> > > linked_values[718/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[3292/7102]
> > > linked_values[718/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[3351/7102]
> > > linked_values[718/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[3498/7102]
> > > linked_values[815/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[3660/7102]
> > > linked_values[938/3745]dsdb_replicated_objects_convert: Ignoring
> > > object outside partition 12274a55-72e8-4d29-afd4-984f7e000fc2
> > > CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co:
> > > WERR_DS_ADD_REPLICA_INHIBITEDPartition[CN=Configuration,DC=mydoma
> > > in,D
> > > C=com,DC=co] objects[3791/7102]
> > > linked_values[946/3745]Partition[CN=Configuration,DC=mydomain,DC=
> > > com,
> > > DC=co] objects[3861/7102]
> > > linked_values[1815/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[3992/7102]
> > > linked_values[1989/3745]dsdb_replicated_objects_convert: Ignoring
> > > object outside partition 12274a55-72e8-4d29-afd4-984f7e000fc2
> > > CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co:
> > > WERR_DS_ADD_REPLICA_INHIBITEDPartition[CN=Configuration,DC=mydoma
> > > in,D
> > > C=com,DC=co] objects[4069/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4143/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4216/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4298/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4387/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4475/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4510/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4517/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4524/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4531/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4538/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4545/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4552/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4626/7102]
> > > linked_values[1989/3745]dsdb_replicated_objects_convert: Ignoring
> > > object outside partition 12274a55-72e8-4d29-afd4-984f7e000fc2
> > > CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co:
> > > WERR_DS_ADD_REPLICA_INHIBITEDPartition[CN=Configuration,DC=mydoma
> > > in,D
> > > C=com,DC=co] objects[4700/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4773/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4854/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[4943/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5030/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5071/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5078/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5085/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5092/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5099/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5106/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5113/7102]
> > > linked_values[1989/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5191/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5265/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5339/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5417/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5506/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5594/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5686/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5776/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5866/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[5958/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6050/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6140/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6231/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6310/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6317/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6324/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6331/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6338/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6345/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6352/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6365/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6377/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6389/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6401/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6413/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6425/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6437/7102]
> > > linked_values[2020/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6490/7102]
> > > linked_values[2454/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6570/7102]
> > > linked_values[2708/3745]Partition[CN=Configuration,DC=mydomain,DC
> > > =com
> > > ,DC=co] objects[6678/7102]
> > > linked_values[2842/3745]dsdb_replicated_objects_convert: Ignoring
> > > object outside partition 12274a55-72e8-4d29-afd4-984f7e000fc2
> > > CN=Schema,CN=Configuration,DC=mydomain,DC=com,DC=co:
> > > WERR_DS_ADD_REPLICA_INHIBITEDReplicating critical objects from
> > > the
> > > base DN of the domainPartition[DC=mydomain,DC=com,DC=co]
> > > objects[104/726]
> > > linked_values[19/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[160/726]
> > > linked_values[217/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[104/9701] linked_values[19/6426]Failed to commit objects:
> > > DOS
> > > code 0x000021bfMissing target object - retrying with
> > > DRS_GET_TGTPartition[DC=mydomain,DC=com,DC=co] objects[208/9701]
> > > linked_values[25/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[312/9701]
> > > linked_values[52/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[415/9701]
> > > linked_values[52/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[513/9701]
> > > linked_values[52/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[614/9701]
> > > linked_values[52/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[708/9701]
> > > linked_values[52/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[795/9701]
> > > linked_values[52/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[882/9701]
> > > linked_values[63/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[953/9701]
> > > linked_values[112/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1016/9701]
> > > linked_values[154/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1081/9701]
> > > linked_values[197/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1149/9701]
> > > linked_values[239/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1220/9701]
> > > linked_values[287/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1287/9701]
> > > linked_values[333/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1350/9701]
> > > linked_values[375/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1413/9701]
> > > linked_values[419/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1477/9701]
> > > linked_values[460/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1543/9701]
> > > linked_values[502/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1609/9701]
> > > linked_values[541/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1676/9701]
> > > linked_values[582/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1779/9701]
> > > linked_values[587/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1862/9701]
> > > linked_values[597/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1927/9701]
> > > linked_values[649/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[1997/9701]
> > > linked_values[702/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2062/9701]
> > > linked_values[747/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2130/9701]
> > > linked_values[787/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2201/9701]
> > > linked_values[840/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2266/9701]
> > > linked_values[892/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2332/9701]
> > > linked_values[946/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2399/9701]
> > > linked_values[995/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2463/9701]
> > > linked_values[1041/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2530/9701]
> > > linked_values[1084/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2595/9701]
> > > linked_values[1130/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2664/9701]
> > > linked_values[1181/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2731/9701]
> > > linked_values[1223/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2797/9701]
> > > linked_values[1274/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2868/9701]
> > > linked_values[1324/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[2939/9701]
> > > linked_values[1377/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3044/9701]
> > > linked_values[1378/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3152/9701]
> > > linked_values[1384/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3220/9701]
> > > linked_values[1437/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3291/9701]
> > > linked_values[1481/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3360/9701]
> > > linked_values[1536/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3427/9701]
> > > linked_values[1579/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3493/9701]
> > > linked_values[1622/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3562/9701]
> > > linked_values[1671/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3637/9701]
> > > linked_values[1724/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3706/9701]
> > > linked_values[1773/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3772/9701]
> > > linked_values[1817/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3839/9701]
> > > linked_values[1867/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3912/9701]
> > > linked_values[1919/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[3976/9701]
> > > linked_values[1964/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4044/9701]
> > > linked_values[2009/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4113/9701]
> > > linked_values[2062/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4192/9701]
> > > linked_values[2115/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4265/9701]
> > > linked_values[2158/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4344/9701]
> > > linked_values[2192/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4431/9701]
> > > linked_values[2248/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4516/9701]
> > > linked_values[2281/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4589/9701]
> > > linked_values[2342/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4664/9701]
> > > linked_values[2384/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4738/9701]
> > > linked_values[2423/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4817/9701]
> > > linked_values[2467/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4882/9701]
> > > linked_values[2506/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[4946/9701]
> > > linked_values[2552/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5024/9701]
> > > linked_values[2591/6426]dsdb_replicated_objects_convert: Ignoring
> > > object outside partition 77ec0aaf-0186-4d3b-a0e4-ac6cf635c434
> > > CN=Configuration,DC=mydomain,DC=com,DC=co:
> > > WERR_DS_ADD_REPLICA_INHIBITEDdsdb_replicated_objects_convert:
> > > Ignoring object outside partition 569db3ee-bdc5-40f6-a290-
> > > 4c7289d5a940 DC=DomainDnsZones,DC=mydomain,DC=com,DC=co:
> > > WERR_DS_ADD_REPLICA_INHIBITEDdsdb_replicated_objects_convert:
> > > Ignoring object outside partition 075cd259-c6ad-4d92-812c-
> > > c89d3d83cec5 DC=ForestDnsZones,DC=mydomain,DC=com,DC=co:
> > > WERR_DS_ADD_REPLICA_INHIBITEDPartition[DC=mydomain,DC=com,DC=co]
> > > objects[5099/9701]
> > > linked_values[2624/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5163/9701]
> > > linked_values[2678/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5236/9701]
> > > linked_values[2725/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5320/9701]
> > > linked_values[2742/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5392/9701]
> > > linked_values[2792/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5467/9701]
> > > linked_values[2843/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5537/9701]
> > > linked_values[2879/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5611/9701]
> > > linked_values[2928/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5690/9701]
> > > linked_values[2979/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5768/9701]
> > > linked_values[3037/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5835/9701]
> > > linked_values[3170/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5900/9701]
> > > linked_values[3250/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[5960/9701]
> > > linked_values[3350/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6020/9701]
> > > linked_values[3466/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6087/9701]
> > > linked_values[3544/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6153/9701]
> > > linked_values[3610/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6226/9701]
> > > linked_values[3688/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6296/9701]
> > > linked_values[3723/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6370/9701]
> > > linked_values[3770/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6423/9701]
> > > linked_values[3875/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6467/9701]
> > > linked_values[4023/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6513/9701]
> > > linked_values[4160/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6557/9701]
> > > linked_values[4311/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6640/9701]
> > > linked_values[4362/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6724/9701]
> > > linked_values[4376/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6808/9701]
> > > linked_values[4402/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6872/9701]
> > > linked_values[4465/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[6948/9701]
> > > linked_values[4470/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7027/9701]
> > > linked_values[4497/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7102/9701]
> > > linked_values[4500/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7177/9701]
> > > linked_values[4508/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7249/9701]
> > > linked_values[4508/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7322/9701]
> > > linked_values[4508/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7401/9701]
> > > linked_values[4509/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7469/9701]
> > > linked_values[4559/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7529/9701]
> > > linked_values[4630/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7608/9701]
> > > linked_values[4630/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7680/9701]
> > > linked_values[4630/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7752/9701]
> > > linked_values[4630/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7825/9701]
> > > linked_values[4631/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7904/9701]
> > > linked_values[4634/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[7975/9701]
> > > linked_values[4659/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[8057/9701]
> > > linked_values[4687/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[8134/9701]
> > > linked_values[4696/6426]Partition[DC=mydomain,DC=com,DC=co]
> > > objects[8183/9701] linked_values[4704/6426]Done with always
> > > replicated NC (base, config, schema)Replicating
> > > DC=DomainDnsZones,DC=mydomain,DC=com,DC=coJoin failed - cleaning
> > > upDeleted CN=REPLICA-AWS,OU=Domain
> > > Controllers,DC=mydomain,DC=com,DC=coDeleted
> > > CN=krbtgt_29903,CN=Users,DC=mydomain,DC=com,DC=coDeleted CN=RODC
> > > Connection (FRS),CN=NTDS Settings,CN=REPLICA-
> > > AWS,CN=Servers,CN=aws,CN=Sites,CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =coDeleted CN=NTDS Settings,CN=REPLICA-
> > > AWS,CN=Servers,CN=aws,CN=Sites,CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =coDeleted CN=REPLICA-
> > > AWS,CN=Servers,CN=aws,CN=Sites,CN=Configuration,DC=mydomain,DC=co
> > > m,DC
> > > =coERROR(runtime): uncaught exception - (8453,
> > > 'WERR_DS_DRA_ACCESS_DENIED')   File "/usr/lib/python3/dist-
> > > packages/samba/netcmd/__init__.py", line 186, in _run     return
> > > self.run(*args, **kwargs)   File "/usr/lib/python3/dist-
> > > packages/samba/netcmd/domain.py", line 711, in run
> > > join_RODC(logger=logger, server=server, creds=creds, lp=lp,
> > > domain=domain,   File "/usr/lib/python3/dist-
> > > packages/samba/join.py",
> > > line 1544, in join_RODC     ctx.do_join()   File
> > > "/usr/lib/python3/dist-packages/samba/join.py", line 1469, in
> > > do_join
> > >      ctx.join_replicate()   File "/usr/lib/python3/dist-
> > > packages/samba/join.py", line 1026, in join_replicate
> > > repl.replicate(nc, source_dsa_invocation_id,   File
> > > "/usr/lib/python3/dist-packages/samba/drs_utils.py", line 361, in
> > > replicate     (level, ctr) =
> > > self.drs.DsGetNCChanges(self.drs_handle,
> > > req_level, req)
> > > 
> 
> 
-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead                https://catalyst.net.nz/services/samba
Catalyst.Net Ltd

Proudly developing Samba for Catalyst.Net Ltd - a Catalyst IT group
company

Samba Development and Support: https://catalyst.net.nz/services/samba

Catalyst IT - Expert Open Source Solutions