[Samba] samba-tool domain demote - current DC is still the owner of 2 role(s)
Petr MOTEJLEK
petr.motejlek at inventix.cz
Mon Jul 21 13:14:49 MDT 2014
Hey guys,
I had recently setup a new DC (called dc0) (in accordance with the wiki) and now I would like to demote the old DC (called pdc0 :)). I followed the wiki again, but I ran into the following issue. When trying to demote the old DC, I get this error message:
pdc0 # samba-tool domain demote
ERROR: Current DC is still the owner of 2 role(s), use the role command to transfer roles to another DC
It's not very verbose - I have no idea what the role(s) might be. I did run the samba-tool fsmo transfer -role=all command on the new DC prior to trying to demote command the old DC.
pdc0 # samba-tool fsmo show
InfrastructureMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
RidAllocationMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
PdcEmulationMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
DomainNamingMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
SchemaMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
pdc0 # samba-tool drs showrepl
Default-First-Site-Name\PDC0
DSA Options: 0x00000001
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
DSA invocationId: e5aad444-67dc-4b35-8fc2-42b5fd8cd140
==== INBOUND NEIGHBORS ====
DC=ForestDnsZones,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ Mon Jul 21 21:05:20 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:05:20 2014 CEST
DC=DomainDnsZones,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ Mon Jul 21 21:05:21 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:05:21 2014 CEST
DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ Mon Jul 21 21:05:22 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:05:22 2014 CEST
CN=Schema,CN=Configuration,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ Mon Jul 21 21:05:23 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:05:23 2014 CEST
CN=Configuration,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ Mon Jul 21 21:05:24 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:05:24 2014 CEST
==== OUTBOUND NEIGHBORS ====
DC=ForestDnsZones,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
DC=DomainDnsZones,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
CN=Schema,CN=Configuration,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
CN=Configuration,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\DC0 via RPC
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
==== KCC CONNECTION OBJECTS ====
Connection --
Connection name: 10178e90-e3e4-4dcf-9165-5d363d8dd6ae
Enabled : TRUE
Server DNS name : DC0.ad.m-k.cz
Server DN name : CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
TransportType: RPC
options: 0x00000001
Warning: No NC replicated for Connection!
dc0 # samba-tool fsmo show
InfrastructureMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
RidAllocationMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
PdcEmulationMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
DomainNamingMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
SchemaMasterRole owner: CN=NTDS Settings,CN=DC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
dc0 # samba-tool drs showrepl
Default-First-Site-Name\DC0
DSA Options: 0x00000001
DSA object GUID: 9215ee10-7dce-4968-af6c-c015229a7be9
DSA invocationId: 4413329c-1e75-4d95-935a-2d9af6926255
==== INBOUND NEIGHBORS ====
CN=Schema,CN=Configuration,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ Mon Jul 21 21:06:54 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:06:54 2014 CEST
DC=ForestDnsZones,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ Mon Jul 21 21:06:53 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:06:53 2014 CEST
CN=Configuration,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ Mon Jul 21 21:06:55 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:06:55 2014 CEST
DC=DomainDnsZones,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ Mon Jul 21 21:06:54 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:06:54 2014 CEST
DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ Mon Jul 21 21:06:55 2014 CEST was successful
0 consecutive failure(s).
Last success @ Mon Jul 21 21:06:55 2014 CEST
==== OUTBOUND NEIGHBORS ====
CN=Schema,CN=Configuration,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
DC=ForestDnsZones,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
CN=Configuration,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
DC=DomainDnsZones,DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
DC=ad,DC=m-k,DC=cz
Default-First-Site-Name\PDC0 via RPC
DSA object GUID: 0bdca96b-bb1a-42ed-bd78-b4486e64f609
Last attempt @ NTTIME(0) was successful
0 consecutive failure(s).
Last success @ NTTIME(0)
==== KCC CONNECTION OBJECTS ====
Connection --
Connection name: bef32bac-a445-4672-bfb2-61b525842526
Enabled : TRUE
Server DNS name : pdc0.ad.m-k.cz
Server DN name : CN=NTDS Settings,CN=PDC0,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=ad,DC=m-k,DC=cz
TransportType: RPC
options: 0x00000001
Warning: No NC replicated for Connection!
I am not an expert, but it seems like everything is working as it should, just the old DC is probably holding on to some role(s) that samba-tool fsmo does not care bout, but samba-tool domain demote does...
Just before sending this email, I realized that the DNS records could be of importance too (since AD tends to store a lot information there). Here goes. Additionally I am using BIND9 as backend.
pdc0 # dig @127.0.0.1 ad.m-k.cz AXFR
ad.m-k.cz. 3600 IN SOA pdc0.ad.m-k.cz. hostmaster.ad.m-k.cz. 36 900 600 86400 0
ad.m-k.cz. 900 IN NS pdc0.ad.m-k.cz.
ad.m-k.cz. 900 IN A 192.168.1.3
ad.m-k.cz. 900 IN A 192.168.1.14
dc0.ad.m-k.cz. 900 IN A 192.168.1.14
pdc0.ad.m-k.cz. 900 IN A 192.168.1.3
apolo.ad.m-k.cz. 1200 IN A 192.168.1.22
sirene.ad.m-k.cz. 900 IN A 192.168.3.1
_msdcs.ad.m-k.cz. 900 IN NS pdc0.ad.m-k.cz.
_gc._tcp.ad.m-k.cz. 900 IN SRV 0 100 3268 pdc0.ad.m-k.cz.
_gc._tcp.ad.m-k.cz. 900 IN SRV 0 100 3268 dc0.ad.m-k.cz.
_ldap._tcp.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_ldap._tcp.ad.m-k.cz. 900 IN SRV 0 100 389 dc0.ad.m-k.cz.
_kpasswd._udp.ad.m-k.cz. 900 IN SRV 0 100 464 pdc0.ad.m-k.cz.
_kpasswd._udp.ad.m-k.cz. 900 IN SRV 0 100 464 dc0.ad.m-k.cz.
_kpasswd._tcp.ad.m-k.cz. 900 IN SRV 0 100 464 pdc0.ad.m-k.cz.
_kpasswd._tcp.ad.m-k.cz. 900 IN SRV 0 100 464 dc0.ad.m-k.cz.
_kerberos._udp.ad.m-k.cz. 900 IN SRV 0 100 88 pdc0.ad.m-k.cz.
_kerberos._udp.ad.m-k.cz. 900 IN SRV 0 100 88 dc0.ad.m-k.cz.
_kerberos._tcp.ad.m-k.cz. 900 IN SRV 0 100 88 pdc0.ad.m-k.cz.
_kerberos._tcp.ad.m-k.cz. 900 IN SRV 0 100 88 dc0.ad.m-k.cz.
ForestDnsZones.ad.m-k.cz. 900 IN A 192.168.1.3
DomainDnsZones.ad.m-k.cz. 900 IN A 192.168.1.3
_ldap._tcp.ForestDnsZones.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_ldap._tcp.DomainDnsZones.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_gc._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 3268 pdc0.ad.m-k.cz.
_gc._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 3268 dc0.ad.m-k.cz.
_ldap._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_ldap._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 389 dc0.ad.m-k.cz.
_kerberos._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 88 pdc0.ad.m-k.cz.
_kerberos._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 88 dc0.ad.m-k.cz.
dc0\010CNF:61d132ad-c503-4c74-b7f7-5b77808f1a55.ad.m-k.cz. 900 IN A 192.168.1.14
_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
ad.m-k.cz. 3600 IN SOA pdc0.ad.m-k.cz. hostmaster.ad.m-k.cz. 36 900 600 86400 0
dc0 # dig @127.0.0.1 ad.m-k.cz AXFR
ad.m-k.cz. 3600 IN SOA dc0.ad.m-k.cz. hostmaster.ad.m-k.cz. 36 900 600 86400 0
ad.m-k.cz. 900 IN NS pdc0.ad.m-k.cz.
ad.m-k.cz. 900 IN A 192.168.1.3
ad.m-k.cz. 900 IN A 192.168.1.14
dc0.ad.m-k.cz. 900 IN A 192.168.1.14
pdc0.ad.m-k.cz. 900 IN A 192.168.1.3
apolo.ad.m-k.cz. 1200 IN A 192.168.1.22
sirene.ad.m-k.cz. 900 IN A 192.168.3.1
_msdcs.ad.m-k.cz. 900 IN NS pdc0.ad.m-k.cz.
_gc._tcp.ad.m-k.cz. 900 IN SRV 0 100 3268 pdc0.ad.m-k.cz.
_gc._tcp.ad.m-k.cz. 900 IN SRV 0 100 3268 dc0.ad.m-k.cz.
_ldap._tcp.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_ldap._tcp.ad.m-k.cz. 900 IN SRV 0 100 389 dc0.ad.m-k.cz.
_kpasswd._udp.ad.m-k.cz. 900 IN SRV 0 100 464 pdc0.ad.m-k.cz.
_kpasswd._udp.ad.m-k.cz. 900 IN SRV 0 100 464 dc0.ad.m-k.cz.
_kpasswd._tcp.ad.m-k.cz. 900 IN SRV 0 100 464 pdc0.ad.m-k.cz.
_kpasswd._tcp.ad.m-k.cz. 900 IN SRV 0 100 464 dc0.ad.m-k.cz.
_kerberos._udp.ad.m-k.cz. 900 IN SRV 0 100 88 pdc0.ad.m-k.cz.
_kerberos._udp.ad.m-k.cz. 900 IN SRV 0 100 88 dc0.ad.m-k.cz.
_kerberos._tcp.ad.m-k.cz. 900 IN SRV 0 100 88 pdc0.ad.m-k.cz.
_kerberos._tcp.ad.m-k.cz. 900 IN SRV 0 100 88 dc0.ad.m-k.cz.
ForestDnsZones.ad.m-k.cz. 900 IN A 192.168.1.3
DomainDnsZones.ad.m-k.cz. 900 IN A 192.168.1.3
_ldap._tcp.ForestDnsZones.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_ldap._tcp.DomainDnsZones.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_gc._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 3268 pdc0.ad.m-k.cz.
_gc._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 3268 dc0.ad.m-k.cz.
_ldap._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_ldap._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 389 dc0.ad.m-k.cz.
_kerberos._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 88 pdc0.ad.m-k.cz.
_kerberos._tcp.Default-First-Site-Name._sites.ad.m-k.cz. 900 IN SRV 0 100 88 dc0.ad.m-k.cz.
dc0\010CNF:61d132ad-c503-4c74-b7f7-5b77808f1a55.ad.m-k.cz. 900 IN A 192.168.1.14
_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.ad.m-k.cz. 900 IN SRV 0 100 389 pdc0.ad.m-k.cz.
ad.m-k.cz. 3600 IN SOA dc0.ad.m-k.cz. hostmaster.ad.m-k.cz. 36 900 600 86400 0
Thanks a lot in advance for any pointers :)
Petr MOTEJLEK
More information about the samba
mailing list