[Samba] Replicating failing after installing RODC

[Michael Brown]

We've joined an RODC to the domain (Windows 2008R2 running a W2003 
FFL/DFL AD) but are getting these errors on first startup.

It was joined with:

samba-tool domain join main.adlab.netdirect.ca RODC 
--realm=main.adlab.netdirect.ca 
--username=administrator at main.adlab.netdirect.ca --dns-backend=BIND9_DLZ

but we get these errors right after startup:
Nov 28 12:35:27 sles-bree samba[3939]: [2013/11/28 12:35:27.824986, 0] 
../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
Nov 28 12:35:27 sles-bree samba[3939]: Failed to apply records: Conflict 
adding object 
'DC=6b51956f-604c-41a4-8366-6fb31664f468,DC=_msdcs.main.adlab.netdirect.ca,CN=MicrosoftDNS,DC=ForestDnsZones,DC=main,DC=adlab,DC=netdirect,DC=ca' 
from incoming replication as we are read only for the partition.
Nov 28 12:35:27 sles-bree samba[3939]: - We must fail the operation 
until a master for this partition resolves the conflict: Entry already 
exists
Nov 28 12:35:27 sles-bree samba[3939]: [2013/11/28 12:35:27.825496, 0] 
../source4/dsdb/repl/drepl_out_helpers.c:725(dreplsrv_op_pull_source_apply_changes_trigger)
Nov 28 12:35:27 sles-bree samba[3939]: Failed to commit objects: 
WERR_GENERAL_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE
Nov 28 12:35:27 sles-bree samba[3939]: [2013/11/28 12:35:27.994815, 0] 
../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
Nov 28 12:35:27 sles-bree samba[3939]: Failed to apply records: Conflict 
adding object 
'DC=6b51956f-604c-41a4-8366-6fb31664f468,DC=_msdcs.main.adlab.netdirect.ca,CN=MicrosoftDNS,DC=ForestDnsZones,DC=main,DC=adlab,DC=netdirect,DC=ca' 
from incoming replication as we are read only for the partition.
Nov 28 12:35:27 sles-bree samba[3939]: - We must fail the operation 
until a master for this partition resolves the conflict: Entry already 
exists
Nov 28 12:35:27 sles-bree samba[3939]: [2013/11/28 12:35:27.995340, 0] 
../source4/dsdb/repl/drepl_out_helpers.c:725(dreplsrv_op_pull_source_apply_changes_trigger)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to commit objects: 
WERR_GENERAL_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE
Nov 28 12:35:28 sles-bree samba[3939]: [2013/11/28 12:35:28.042643, 0] 
../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to apply records: Conflict 
adding object 
'DC=_kerberos._tcp.Shire._sites,DC=main.adlab.netdirect.ca,CN=MicrosoftDNS,DC=DomainDnsZones,DC=main,DC=adlab,DC=netdirect,DC=ca' 
from incoming replication as we are read only for the partition.
Nov 28 12:35:28 sles-bree samba[3939]: - We must fail the operation 
until a master for this partition resolves the conflict: Entry already 
exists
Nov 28 12:35:28 sles-bree samba[3939]: [2013/11/28 12:35:28.043116, 0] 
../source4/dsdb/repl/drepl_out_helpers.c:725(dreplsrv_op_pull_source_apply_changes_trigger)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to commit objects: 
WERR_GENERAL_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE
Nov 28 12:35:28 sles-bree samba[3939]: [2013/11/28 12:35:28.139010, 0] 
../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to apply records: Conflict 
adding object 
'DC=_kerberos._tcp.Shire._sites,DC=main.adlab.netdirect.ca,CN=MicrosoftDNS,DC=DomainDnsZones,DC=main,DC=adlab,DC=netdirect,DC=ca' 
from incoming replication as we are read only for the partition.
Nov 28 12:35:28 sles-bree samba[3939]: - We must fail the operation 
until a master for this partition resolves the conflict: Entry already 
exists
Nov 28 12:35:28 sles-bree samba[3939]: [2013/11/28 12:35:28.139343, 0] 
../source4/dsdb/repl/drepl_out_helpers.c:725(dreplsrv_op_pull_source_apply_changes_trigger)
Nov 28 12:35:28 sles-bree samba[3939]: Failed to commit objects: 
WERR_GENERAL_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE

Any idea what to do about this?

-- 
Michael Brown               | `One of the main causes of the fall of
Systems Consultant          | the Roman Empire was that, lacking zero,
Net Direct Inc.             | they had no way to indicate successful
☎: +1 519 883 1172 x5106    | termination of their C programs.' - Firth