[Samba] Questions about 'samba-tool dbcheck'

[Marc Muehlfeld]

Hello,

I'm having two DC in my domain. When I run
   # samba-tool dbcheck
I receive 27 errors on the first one and 49 on the second one. All 
errors are like this one:
ERROR: target DN is deleted for member in object CN=Medical 
Office,CN=Users,DC=muc,DC=medizinische-genetik,DC=de - 
<GUID=dae3b481-4ca2-49f2-b3f2-0d617d277c7d>;<SID=S-1-5-21-1362721961-1801182073-732966438-17206>;CN=mschmoelz\0ADEL:dae3b481-4ca2-49f2-b3f2-0d617d277c7d,CN=Deleted 
Objects,DC=muc,DC=medizinische-genetik,DC=de
Target GUID points at deleted DN 
CN=mschmoelz\0ADEL:dae3b481-4ca2-49f2-b3f2-0d617d277c7d,CN=Deleted 
Objects,DC=muc,DC=medizinische-genetik,DC=de


When I run
   # samba-tool dbcheck --cross-ncs
I receive only on my first DC 102 errors of this kind:
Not fixing nTSecurityDescriptor on 
DC=_ldap._tcp.pdc,DC=_msdcs.muc.medizinische-genetik.de,CN=MicrosoftDNS,DC=ForestDnsZones,DC=muc,DC=medizinische-genetik,DC=de



My questions:

1.) Why do I have a different ammount of errors on each server. Are this 
replication errors?

2.) Does Samba has to be running when doing the "--fix"? Or has it to be 
repaired offline on each DC? And is this the same when running with 
"--cross-ncs"?

3.) What had caused this two kind of errors? The user mentioned in the 
first message is one, that has been deleted during the past month.



This dbcheck I run after upgrading from 4.0.9 to 4.1.0 (I haven't run it 
before the upgrade).


Regards,
Marc