[Samba] DsGetDomainControllerInfoW fails with level 2008+, works with 2003

[Thomas Simmons]

Hello,

I stumbled on this problem while troubleshooting a time synchronization
problem. The Windows commands "w32tm /monitor" and "nltest /dclist:domain"
appear to both use the same call to query the domain for a list of domain
controllers. When the DC is Samba4 (2003 domain & forest level) these
commands complete successfully. After raising the levels to 2008 or 2008_R2
and restarting Samba (no other changes) both commands immediately begin to
fail. Can anyone tell me if this behavior is expected? Does anyone have a
Windows Server 2008+ DC where they can test this? These commands can be
executed on any W7 domain client.

(2003)
C:\Users\Administrator.TESTDOM>w32tm /monitor
ADC1.internal.testdom.com *** PDC ***[10.10.65.254:123]:
    ICMP: 0ms delay
    NTP: +0.0000000s offset from ADC1.internal.testdom.com
        RefID: 64-132-226-3.static.twtelecom.net [64.132.226.3]
        Stratum: 2

Warning:
Reverse name resolution is best effort. It may not be
correct since RefID field in time packets differs across
NTP implementations and may not be using IP addresses.

C:\Users\Administrator.TESTDOM>nltest /dclist:testdom
Get list of DCs in domain 'testdom' from '\\ADC1'.
    ADC1.internal.testdom.com [PDC] [DS] Site: Default-First-Site-Name
The command completed successfully

(2008_R2)
C:\Users\Administrator.TESTDOM>w32tm /monitor
GetDcList failed with error code:  0x80070032.
Exiting with error 0x80070032

C:\Users\Administrator.TESTDOM>nltest /dclist:testdom
Get list of DCs in domain 'testdom' from '\\ADC1'.
Cannot call DsGetDomainControllerInfoW to testdom (\\ADC1).Status = 50 0x32
ERROR_NOT_SUPPORTED
List of DCs in Domain testdom
    \\ADC1 (PDC)
The command completed successfully