[Samba] DomainDnsZones inbound replication issue

[Donaldson Jeff]

Greetings,


I am having a problem with one of my DCs (DC3) replicating DomainDnsZones. On DC3 replication is successful on both Inbound and Outbound with both of my other DCs. On both of my other DCs (DC1 & DC2) I only get a failure with Inbound replication for DomainDnsZones from DC3 with a result 8442 (WERR_DS_DRA_INTERNAL_ERROR).


If I try to force replication to DC3 from DC1 using samba-tool drs replicate DC3 DC1 DC=DomainDnsZones,DC=our,DC=domain,DC=com --full-sync, I get the following:


ldb_wrap open of secrets.ldb
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Using binding ncacn_ip_tcp:ncsauth3[,seal]
resolve_lmhosts: Attempting lmhosts lookup for name ncsauth3<0x20>
resolve_lmhosts: Attempting lmhosts lookup for name ncsauth3<0x20>
resolve_lmhosts: Attempting lmhosts lookup for name ncsauth3<0x20>
Failed to bind - LDAP error 8 LDAP_STRONG_AUTH_REQUIRED -  <SASL:[GSS-SPNEGO]: Sign or Seal are required.> <>
Failed to connect to 'ldap://ncsauth3' with backend 'ldap': (null)
ERROR(ldb): LDAP connection to ncsauth3 failed - None
  File "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/drs.py", line 48, in samdb_connect
    credentials=ctx.creds, lp=ctx.lp)
  File "/usr/local/samba/lib/python2.7/site-packages/samba/samdb.py", line 56, in __init__
    options=options)
  File "/usr/local/samba/lib/python2.7/site-packages/samba/__init__.py", line 114, in __init__
    self.connect(url, flags, options)
  File "/usr/local/samba/lib/python2.7/site-packages/samba/samdb.py", line 71, in connect
    options=options)


I didn't have any replication issues prior to upgrading Samba to 4.4.4 and the server to Ubuntu 14.04.4. After upgrading I ran samba-tool dbcheck --cross-ncs --fix. Not sure how to proceed to resolve the issue. Would the best solution be to demote the affected DC, wipe out all of private, then join as a DC again? Any help or suggestions are greatly appreciated.

Regards,
Jeff

Jeff Donaldson
Technology Director
Newark Charter School
jeff.donaldson at ncs.k12.de.us
(302) 369-2001 ext: 625