[Samba] DC site replication issue ?

[lingpanda101]

On 3/6/2017 9:56 AM, Mircea Husz via samba wrote:
> All,
>
> I'm migrating a samba3 domain to a new samba4 AD version 4.5.5. Did a fair amount of testing on isolated vlans including two sites and replication between two domain controllers.
>
> I'm now rolling out DCs intended to become production shortly. One is in Chicago, the other in NY, and each is configured in its own timezone with NTP synching up.
>
> I am looking at a potential replication issue and want to know if the message from 'samba-tool drs showrepl' is indicative of trouble.
>
> The 'Inbound neighbors' list looks correct on both CH and NY DCs. The 'Outbound neighbors' list on both DCs shows 'Last attempt @ NTTIME(0) was successful'. I listed the full output at the bottom of this post.
>
> The logs don't have overt error messages, although I admit I don't understand everything that gets logged. I looked at levels 3, 5, and 10.
>
> I tested replication by adding a DNS entry, adding an account, then deleting the test account, and all that gets replicated to the other DC. So it seems to work fine.
>
> Also I used the ldapcmp tool, which came back with the only difference being the uppercase vs lowercase bug between cn and CN, dc and DC as per this report:
> https://bugzilla.samba.org/show_bug.cgi?id=12399
>
> Forcing replication returns with success: 'Replicate from CH1-AD-V01 to NY4-AD-V01 was successful.'
>
> So my questions are:
> 1 - Do others with DCs in multiple sites get an actual time entry in the Outbound neighbors list instead of '@ NTTIME(0)' ?
>
> 2 - Is replication used in production with three or more sites and timezones and is it reliable ? I'd like to know if going to production with such a setup is generally recommended based on real-life deployments.
>
> Thank you for all input.
>
> The output from 'samba-tool drs showrepl':
>
> CH1\CH1-AD-V01
> DSA Options: 0x00000001
> DSA object GUID: ae57ed96-5b4a-4d86-befd-027711adfe26
> DSA invocationId: cf59ac10-c027-4a45-8df5-218c88433fdd
>
> ==== INBOUND NEIGHBORS ====
>
> DC=ForestDnsZones,DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ Fri Mar  3 11:23:46 2017 CST was successful
> 0 consecutive failure(s).
> Last success @ Fri Mar  3 11:23:46 2017 CST
>
> DC=DomainDnsZones,DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ Fri Mar  3 11:23:46 2017 CST was successful
> 0 consecutive failure(s).
> Last success @ Fri Mar  3 11:23:46 2017 CST
>
> DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ Fri Mar  3 11:23:46 2017 CST was successful
> 0 consecutive failure(s).
> Last success @ Fri Mar  3 11:23:46 2017 CST
>
> CN=Schema,CN=Configuration,DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ Fri Mar  3 11:23:47 2017 CST was successful
> 0 consecutive failure(s).
> Last success @ Fri Mar  3 11:23:47 2017 CST
>
> CN=Configuration,DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ Fri Mar  3 11:23:47 2017 CST was successful
> 0 consecutive failure(s).
> Last success @ Fri Mar  3 11:23:47 2017 CST
>
> ==== OUTBOUND NEIGHBORS ====
>
> DC=ForestDnsZones,DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ NTTIME(0) was successful
> 0 consecutive failure(s).
> Last success @ NTTIME(0)
>
> DC=DomainDnsZones,DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ NTTIME(0) was successful
> 0 consecutive failure(s).
> Last success @ NTTIME(0)
>
> DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ NTTIME(0) was successful
> 0 consecutive failure(s).
> Last success @ NTTIME(0)
>
> CN=Schema,CN=Configuration,DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ NTTIME(0) was successful
> 0 consecutive failure(s).
> Last success @ NTTIME(0)
>
> CN=Configuration,DC=ad,DC=corp,DC=com
> NY4\NY4-AD-V01 via RPC
> DSA object GUID: b7aea0b6-f0fa-477c-a44d-96a8b005450d
> Last attempt @ NTTIME(0) was successful
> 0 consecutive failure(s).
> Last success @ NTTIME(0)
>
> ==== KCC CONNECTION OBJECTS ====
>
> Connection --
> Connection name: 2ab1b199-31a6-48d9-a87e-4aa10e8a2594
> Enabled        : TRUE
> Server DNS name : ny4-ad-v01.ad.corp.com
> Server DN name  : CN=NTDS Settings,CN=NY4-AD-V01,CN=Servers,CN=NY4,CN=Sites,CN=Configuration,DC=ad,DC=corp,DC=com
> TransportType: RPC
> options: 0x00000001
> Warning: No NC replicated for Connection!
>
> Thanks,
> -Mike
>

I can only answer number 1.  I have the same behavior with no reporting 
of the time stamp on Outbound Neighbors.

-- 
- James