[Samba] Horrible BIND9_DLZ DNS breakage after DC replaced and samba-tool domain demote --remove-other-dead-server

[Rowland Penny]

On Sun, 14 Aug 2016 19:18:41 +0100
Alex Crow via samba <samba at lists.samba.org> wrote:

> 
> >
> > Ok, lets just run through this:
> > You have an NT4-style PDC
> Correct.
> > You classicupgrade this to a DC
> Yes, with BIND9_DLZ DNS backend.
> 
> > You join another computer as a DC
> >
> > At this point, have you checked that all DNS records etc are
> > correct ?
> 
> Yes, I followed the procedure on the Wiki at:
> 
> https://wiki.samba.org/index.php/Check_and_fix_DNS_entries_on_DC_joins
> 
> I setup bind as documented and start it as soon as the domain is
> joined. It works fine at this point.
> 
> In addition even after this I find essential DNS records missing, eg
> the A record for the domain only exists for the initial server, not
> the newly joined one. The same with all the SRV records.

I am going to fix this in the wiki, after you join a new DC, you need
to start and then restart Samba, this will then run 'samba_dnsupdate' &
'samba_spnupdate'

> 
> So I issue this command to add them:
> 
> samba_dnsupdate --verbose
> 
> 
> > Is Bind9 running on both DCs at this point.
> > Is everything working as expected ?
> 
> Yes.
> 
> > You now turn off the first DC
> > You now seize all FSMO roles to the remaining DC
> 
> I've tried this in two different ways:
> 
> 1. Turn off the first DC, fsmo seize then 
> --remove-other-dead-server=<original DC name>
> 
> 2. Try to demote the first DC, fails to complete. then carry on as
> above

You can only demote a DC by running the demote command on the DC you
want to demote, that's why '--remove-other-dead-server' was written.
This is run on any DC to remove another DC, hence the 'other' part in
the argument name ;-)
  
> > Are you turning Bind9 off on the remaining DC at this point ?
> 
> After this point I've shut down the original DC.

No, are you stopping Bind that is running on the remaining DC, not the
one you have turned off.

> >
> > You run the demote command and then Bind9 will not start ?
> 
> In either of these scenarios bind9 will not start as it claims there
> are no records for my realm's domains.

Have you checked that the DNS records exist after the first DC is
removed from AD, but before you turn bind off on the remaining DC.

Rowland