[Samba] Problem with classicupgrade / ProvisioningError

[Scott Sipe]

Hello,

I'm running a Samba 4.3.3 install on FreeBSD 8.4 (ZFS) in domain mode with passdb tdb backend. The databases and config files are the current versions of an install that I think started in the 1.9.x version range back in the late 90s (I can't remember exactly--it's been a long time!) and smbpasswd days. I'm now trying to convert to an AD install using the classicupgrade tool, following the wiki instructions, and am receiving a ProvisioningError at the very end of the script.

This the error message:

ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: Could not add member 'S-1-5-21-197568832-424389326-1147915938-2604' to group 'S-1-5-21-197568832-424389326-1147915938-515' as either group or user record doesn't exist: Unable to find GUID for DN 

I can't find member S-1-5-21-197568832-424389326-1147915938-2604. It does not show up in the output of "pdbedit -Lv". Where else, or how else, should I be looking? The group (-515) is my domain machines group.

Here's my command line:

samba-tool domain classicupgrade --dbdir=/var/db/samba4.PDC/dbdir/ --use-xattrs=yes --realm=my.newrealm.com/usr/local/etc/smb4.PDC.conf 

Everything looks good until the very end:

---------------------------------
[snipped first part...]
Setting up sam.ldb rootDSE marking as synchronized
Fixing provision GUIDs
A Kerberos configuration suitable for Samba 4 has been generated at /var/db/samba4/private/krb5.conf
Setting up fake yp server settings
Once the above files are installed, your Samba4 server will be ready to use
Admin password:        a_,FVAuUobIFhEwI9%Z<!Hn2,C%97B
Server Role:           active directory domain controller
Hostname:              fileserver
NetBIOS Domain:        OLDDOMAIN
DNS Domain:            my.newrealm.com
DOMAIN SID:            S-1-5-21-197568832-424389326-1147915938
Importing WINS database
Importing Account policy
Importing idmap database
Cannot open idmap database, Ignoring: [Errno 2] No such file or directory
Adding groups
Importing groups
Group already exists sid=S-1-5-21-197568832-424389326-1147915938-512, groupname=Domain Admins existing_groupname=Domain Admins, Ignoring.
Group already exists sid=S-1-5-21-197568832-424389326-1147915938-513, groupname=Domain Users existing_groupname=Domain Users, Ignoring.
Group already exists sid=S-1-5-21-197568832-424389326-1147915938-514, groupname=Domain Guests existing_groupname=Domain Guests, Ignoring.
Group already exists sid=S-1-5-21-197568832-424389326-1147915938-515, groupname=Domain Machines existing_groupname=Domain Computers, Ignoring.
Committing 'add groups' transaction to disk
Adding users
Importing users
Committing 'add users' transaction to disk
Adding users to groups
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: Could not add member 'S-1-5-21-197568832-424389326-1147915938-2604' to group 'S-1-5-21-197568832-424389326-1147915938-515' as either group or user record doesn't exist: Unable to find GUID for DN 

 File "/usr/local/lib/python2.7/site-packages/samba/netcmd/__init__.py", line 175, in _run
   return self.run(*args, **kwargs)
 File "/usr/local/lib/python2.7/site-packages/samba/netcmd/domain.py", line 1460, in run
   useeadb=eadb, dns_backend=dns_backend, use_ntvfs=use_ntvfs)
 File "/usr/local/lib/python2.7/site-packages/samba/upgrade.py", line 828, in upgrade_from_samba3
   add_users_to_group(result.samdb, g, groupmembers[str(g.sid)], logger)
 File "/usr/local/lib/python2.7/site-packages/samba/upgrade.py", line 321, in add_users_to_group
   raise ProvisioningError("Could not add member '%s' to group '%s' as either group or user record doesn't exist: %s" % (member_sid, group.sid, emsg))
-------------------------

Thanks,
Scott