[Samba] migrating NT-style domain SID-error

Rowland Penny rpenny at samba.org
Tue May 15 19:01:06 UTC 2018

On Tue, 15 May 2018 20:37:34 +0200
Stefan Kania via samba <samba at lists.samba.org> wrote:

> Hi Rowland,
> after we solved the puzzle today here is what we found:
> The Samba PDC with tdbsam backend was installed a loooooong time ago.
> Many updates and distributions later, the Samba PDC was still running
> with with the same databases and the same smb.conf. The only thing
> that someone sometime changed was the hostname and the NetBIOS-Name in
> smb.conf. BUT in secrets.tdb was still the old name. Then they used
> the iso-8859-15 codepage and  there were som "fullname"-entries wit
> "ä" "ö" and "ü". Then there were some local users in passwd-file with
> the same ID an name as AD-BUILDIN-Accounts. So with all these funny
> things it was hard to get things running. After we saw the
> errormessage from "samba-tool dbcheck" I try to let samba-tool fix
> the problem, but it didn't worked. Then I try to rebuild the
> index-dbs and that was the point where we found the users with "ä"
> "ö" and"ü". Because of the character translation there was a lot of
> garbage inside the AD-database. So we had set up a new samba-PDC with
> the original name, so we got a new clean secrets.tdb. Then we copied
> the backup from all *.tdb-files to the new PDC. So that we had an
> clean running PDC. Then we changed the "fullname"-entries with
> "pdbedit" copied alle files to the first AD and did the
> classicupgrade. The we found out, that the sysvol-share had the wrong
> group set. I went to all the Objects and I found out, that the group
> "BUILDIN\administrators" had a ObjectClass PosixAccount and a
> GidNumber. With ldbedit I removed the ObjectClass and the GidNumber.
> Did a "net chache flush" reseted the permissions and everything was
> fine. Now we had a nice running first ADDC, then we installed and
> joined the second ADDC, and replication is working and we are happy.
> And YES we are using Louis 4.7 packages. HELLLLOOOOOOOO
> LOOOUUUIIISSSS thanks for the work :-)
> Stefan
> Am 15.05.2018 um 09:39 schrieb Rowland Penny via samba:
> > It looks like it is falling over whilst trying to 'normalise' an
> > entry in AD, could this be a 'locale' problem ??

Glad you got it sorted and you found what I thought was the problem.
Being English, I never have this problem, we don't have these accent
thingies ;-)

You can safely remove any and all posix objectclasses, they are not
required because they are auxiliary objectclasses, you can still use
their attributes without them.


More information about the samba mailing list