[Samba] dsdb_access Access check failed on CN=Configuration

[Rowland penny]

On 23/05/2019 20:45, Mike Ray wrote:
> OK -- I fixed this issue.
>
> The fix also fixed the issue where the following ldapsearch command use to return but no longer did:
> # ldapsearch -x -H ldap://DC -b dc=domain,dc=local "(&(gidNumber=xxxx)(!(uidNumber=*)))"
>
> The answer is that I needed to re-add "acl:search = no" to the smb.conf to all DCs.
>
> The question is why?
>
> I upgraded from a custom compiled Samba ~4.0 to Samba 4.9 about a little over a month ago.
>
> Shortly after upgrading, I noted strange behavior with seemingly high CPU/RAM usage on DCs causing logon issues. Additionally, I was seeing errors in the output of "samba-tool drs kcc <DC>". That discussion is here: https://lists.samba.org/archive/samba/2019-April/222643.html
>
> The first problem of high load seemed to resolve itself after we increased resources on the system and tweaked AV settings on the box.
>
> The second problem was resolved by off-setting CRONs so that "samba-tool drs kcc <DC>" did not run at the same time.
>
> However, while debugging with the list, several smb.conf edits were suggested. One suggestion was the removal of "acl:search = no". It was noted that it was a very old fix and unlikely to be needed now. However, it seems I do need it.
>
> Does anyone have any information on that directive? I'm having issues finding it in the man page.

Did you classicupgrade originally ?

try reading this bug:

https://bugzilla.samba.org/show_bug.cgi?id=9481

Rowland