[Samba] `samba-tool dbcheck --cross-ncs --fix` fails: governsID already exists as an attributeId or governsId

[Rowland penny]

On 04/07/2019 14:45, Sven Schwedas via samba wrote:
> On 03.07.19 18:04, Rowland penny via samba wrote:
>>>>> How do I get rid of these bogus Schema entries, and how do I fix the
>>>>> user account?
>>>> I do not think you can remove anything from the schema, but I believe
>>>> you can deactivate schema objects, try reading this:
>>>>
>>>> https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc773309(v=ws.10)
>>>>
>>> They already are disabled.
>> Have you extended the schema to use 'taouser' ?
> Yes.
>
>> I ask this because (from what you posted) it uses the same X500 OID as
>> 'ucsUser', another name for X500 OID is 'governsID', so this may be your
>> problem, try deleting 'taouser' from your AD object (this is allowed)
>> and see if your problem goes away.
> That fixed the dbcheck crashes on the other three servers, they now
> complete successfully.
>
> Still left are the three governsId collisions, which are now identical
> across all DCs:
>
>> Checking 3861 objects
>> Error: governsID CN=ucsUser,CN=Schema,CN=Configuration,DC=ad,DC=tao,DC=at on 1.3.6.1.4.1.19414.3.2.2 already exists as an attributeId or governsId
>> Error: governsID CN=taoSharedFolder,CN=Schema,CN=Configuration,DC=ad,DC=tao,DC=at on 1.3.6.1.4.1.19414.3.2.4 already exists as an attributeId or governsId
>> Error: governsID CN=taoMailingList,CN=Schema,CN=Configuration,DC=ad,DC=tao,DC=at on 1.3.6.1.4.1.19414.3.2.3 already exists as an attributeId or governsId
>> Checked 3861 objects (3 errors)
> How do I fix those? Can I just edit the old, defunct classes and change
> their governsId without breaking something?

I do not know, mainly because I have never tried to do something like 
this on a production server.

Rowland