[Samba] DC join failed

Andrew Bartlett abartlet at samba.org
Fri May 31 20:30:52 UTC 2019 

On Fri, 2019-05-31 at 15:50 -0300, Epsilon Minus via samba wrote:
> Dears,
> 
> I have a problem to join a Version 4.7.6-Ubuntu to a Domain 2008 R2
> how Domain Controller.
> 
> if i add a Windows server how domain controller i wasn't a problem.
> but is not de samba case.
> 
> the samba join  output :
> 
> samba-tool domain join example.local DC -U example\\administrator
> Finding a writeable DC for domain 'example.local'
> Found DC AD01.example.local
> Password for [CONYLEC\administrator]:
> workgroup is CONYLEC
> realm is example.local
> Adding CN=DC02,OU=Domain Controllers,DC=example,DC=local
> Adding CN=DC02,CN=Servers,CN=Nombre-predeterminado-primer-sitio,CN=Sites,CN=Configuration,DC=example,DC=local
> Adding CN=NTDS Settings,CN=DC02,CN=Servers,CN=Nombre-predeterminado-primer-sitio,CN=Sites,CN=Configuration,DC=example,DC=local
> Adding SPNs to CN=DC02,OU=Domain Controllers,DC=example,DC=local
> Setting account password for DC02$
> Enabling account
> Calling bare provision
> Looking up IPv4 addresses
> Looking up IPv6 addresses
> No IPv6 address will be assigned
> Setting up secrets.ldb
> Setting up the registry
> Setting up the privileges database
> Setting up idmap db
> Setting up SAM db
> Setting up sam.ldb partitions and settings
> Setting up sam.ldb rootDSE
> Pre-loading the Samba 4 and AD schema
> A Kerberos configuration suitable for Samba AD has been generated at
> /var/lib/samba/private/krb5.conf
> Provision OK for domain DN DC=example,DC=local
> Starting replication
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[402/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[804/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[1206/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[1608/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[2010/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[2412/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[2814/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[3216/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[3618/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[4020/2921] linked_values[0/0]
> Schema-DN[CN=Schema,CN=Configuration,DC=example,DC=local]
> objects[4198/2921] linked_values[0/0]
> Analyze and apply schema objects
> Partition[CN=Configuration,DC=example,DC=local] objects[402/4617]
> linked_values[0/67]
> Partition[CN=Configuration,DC=example,DC=local] objects[804/4617]
> linked_values[0/67]
> Partition[CN=Configuration,DC=example,DC=local] objects[1206/4617]
> linked_values[0/67]
> Partition[CN=Configuration,DC=example,DC=local] objects[1597/4617]
> linked_values[0/67]
> Partition[CN=Configuration,DC=example,DC=local] objects[1910/4617]
> linked_values[16/67]
> Partition[CN=Configuration,DC=example,DC=local] objects[1992/4617]
> linked_values[51/67]
> Replicating critical objects from the base DN of the domain
> Partition[DC=example,DC=local] objects[110/190] linked_values[11/50]
> Partition[DC=example,DC=local] objects[254/6103] linked_values[11/50]
> Partition[DC=example,DC=local] objects[384/6103] linked_values[0/50]
> Partition[DC=example,DC=local] objects[493/6103] linked_values[0/50]
> Partition[DC=example,DC=local] objects[605/6103] linked_values[0/50]
> Partition[DC=example,DC=local] objects[735/6103] linked_values[34/50]
> Partition[DC=example,DC=local] objects[862/6103] linked_values[5/50]
> Partition[DC=example,DC=local] objects[944/6103] linked_values[0/50]
> Done with always replicated NC (base, config, schema)
> Replicating DC=DomainDnsZones,DC=example,DC=local
> Partition[DC=DomainDnsZones,DC=example,DC=local] objects[61/61]
> linked_values[0/0]
> Replicating DC=ForestDnsZones,DC=example,DC=local
> Partition[DC=ForestDnsZones,DC=example,DC=local] objects[22/22]
> linked_values[0/0]
> Join failed - cleaning up
> Deleted CN=DC02,OU=Domain Controllers,DC=example,DC=local
> Deleted CN=NTDS
> Settings,CN=DC02,CN=Servers,CN=Nombre-predeterminado-primer-sitio,CN=Sites,CN=Configuration,DC=example,DC=local
> Deleted CN=DC02,CN=Servers,CN=Nombre-predeterminado-primer-sitio,CN=Sites,CN=Configuration,DC=example,DC=local
> ERROR(runtime): uncaught exception - (8453, 'WERR_DS_DRA_ACCESS_DENIED')
>   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
> line 176, in _run
>     return self.run(*args, **kwargs)
>   File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line
> 661, in run
>     machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
>   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1474, in join_DC
>     ctx.do_join()
>   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1377, in do_join
>     ctx.join_replicate()
>   File "/usr/lib/python2.7/dist-packages/samba/join.py", line 961, in
> join_replicate
>     exop=drsuapi.DRSUAPI_EXOP_FSMO_RID_ALLOC)
>   File "/usr/lib/python2.7/dist-packages/samba/drs_utils.py", line
> 291, in replicate
>     (level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level, req)
> 
> 
> I look for the error, but don't find a solution.

In Samba 4.7 we added:

commit c503ca302d4f9dd0fc9c01344a25a917f6c3fafe
Author: Andrew Bartlett <abartlet at samba.org>
Date:   Mon Oct 31 16:48:33 2016 +1300

    join.py: Attempt to allocate a RID Set during the join
    
    If we are joining the RID Manager, then we should get a RID Set,
but
    otherwise we should accept failure with the right error code
    
    Signed-off-by: Andrew Bartlett <abartlet at samba.org>
    Reviewed-by: Garming Sam <garming at catalyst.net.nz>

This was intended to make Samba joins more reliable, ensuring users
could be created right away on the new DC.  However it is likely we
didn't test against windows in both RID Master and not RID master
configurations.

Can you try joining a DC that is not the RID master, or alternately
that is one?

Make sure to let us know the result and file a bug so we can adjust the
exceptions.  This operation is actually entirely optional from a
protocol perspective, so you can also edit it out of the python, but I
would like to fix Samba to cope automatically if possible. 

Ideally do this all on Samba 4.10 so we can have confidence this is
still an issue on the current code before we start making changes.

Thanks!

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

More information about the samba mailing list