[Samba] Error running samba-tool dbtool --reset-well-known-acls

Achim Gottinger achim at ag-web.biz
Sun Jul 28 08:14:16 MDT 2013


I updated my two samba DC's from 4.0.3 to serner 4.0.7. Both servers run 
debian wheezy and the add was created at the beginning of the year with 
an classic upgrade to version 4.0.0.
Recent release notes do not provide information about required upgrade 
tasks. So i ran.
samba-tool dbcheck --reset-well-known-acls. On the first DC it found a 
few errors about missong members in computer groups whom where fixable 
with samba-tool dbcheck --reset-well-known-acls --fix.
On my second DC however one issue remains.

 >samba-tool dbcheck --reset-well-known-acls
Checking 336 objects
Not fixing nTSecurityDescriptor on CN=RID Set,CN=DC1,OU=Domain 
Please use --fix to fix these errors
Checked 336 objects (1 errors)

 >samba-tool dbcheck --reset-well-known-acls --fix
Checking 336 objects
Fix nTSecurityDescriptor on CN=RID Set,CN=DC1,OU=Domain 
Controllers,DC=domain,DC=local? [y/N/all/none] y
Failed to fix attribute nTSecurityDescriptor : (65, "objectclass_attrs: 
at least one mandatory attribute ('rIDNextRID') on entry 'CN=RID 
Set,CN=DC1,OU=Domain Controllers,DC=domain,DC=local' wasn't specified!")
Checked 336 objects (1 errors)

This is the global section of my smb.conf on DC1. Only netbios name and 
dns forwarder are different on DC2.

# Global parameters
workgroup = DOMAIN
realm = domain.local
netbios name = DC1
server role = active directory domain controller
dns forwarder =
idmap_ldb:use rfc2307 = yes
log level = 1
strict allocate = yes
template shell = /bin/bash
wins support = Yes
deadtime = 10
ea support = yes
store dos attributes = yes
map readonly = no
map archive = no
map system = no
map hidden = no

I connected to both DC's with ADSI and checked rIDNextRID

CN=RID Set,CN=DC1,OU=Domain Controllers,DC=domain,DC=local => 6247
CN=RID Set,CN=DC2,OU=Domain Controllers,DC=domain,DC=local => 0

CN=RID Set,CN=DC1,OU=Domain Controllers,DC=domain,DC=local => not 
defined (german Nicht Festgelegt)
CN=RID Set,CN=DC2,OU=Domain Controllers,DC=domain,DC=local => 6714

Unfortunately i was not able to change that attribute from undefined to 
0 on DC2. I want to avoid editing ldb files by guess so i'd appreciate 

Thanks in advance

More information about the samba mailing list