[Samba] Failed to commit objects: DOS code 0x000021bf attempting to add DC to Zentyal 3.2 domain (samba 4.1.7)
rwebb at zylatech.com
Mon May 25 21:45:53 UTC 2020
----- On May 25, 2020, at 5:22 PM, Andrew Bartlett abartlet at samba.org wrote:
> On Mon, 2020-05-25 at 10:26 -0400, Rich Webb via samba wrote:
>> ----- On May 24, 2020, at 11:30 PM, samba samba at lists.samba.org
>> > On Sun, 2020-05-24 at 23:01 -0400, Rich Webb via samba wrote:
>> > > Hello,
>> > >
>> > > I'm attempting to join a new samba 4 server version 4.12.3 to an
>> > > existing samba 4 domain running on Zentyal 3.2 (samba version
>> > > 4.1.7).
>> > >
>> > > I'm getting the error in the subject line: Failed to commit
>> > > objects:
>> > > DOS code 0x000021bf
>> > If you turn up the log level is there more information? (eg -d4)?
>> > But yes, Samba 4.1.7 is before we fixed a number of issues in the
>> > replication protocol, and I'm not surprised you have issues.
>> > Andrew Bartlett
>> > --
>> Also I am currently using 4.10.15 as I tried to backrev to a version
>> that would join properly. The -d4 produced a ton of output... Let me
>> know if you need more but here is the final pieces that would likely
>> give a clue. I have no idea what mail-fs1 is.. that may have been an
>> old host name possibly left hanging around in DNS? The DC's name is
>> Missing parent while attempting to apply records: No parent with GUID
>> fe34e0f7-7c0d-415d-af6e-d564e2b1cdb4 found for object remotely known
>> as CN=mail-fs1,OU=Kerberos,DC=tca,DC=local
>> ERROR(runtime): uncaught exception - (8460, "Failed to process
>> 'chunk' of DRS replicated objects: WERR_DS_DRA_MISSING_PARENT")
> Thanks, this gives us the information we need.
> What has happened here is that Samba 4.1, indeed all Samba versions
> sort the returned results by the order of last change. However, before
> 4.4 did not know about the GET_ANC flag, to sort the results tree-wise,
> which we need in this situation, so we can find the parent objects
> before we replicate the children.
> This means that, to replicate from Samba 4.1, you need to carefully
> change a unimportant attribute in all the child objects of OU=Kerberos
> 'later' than the last change of OU=Kerberos itself.
> The only other alternative is an in-place upgrade, so the sending Samba
> version gains this capability.
> If this makes sense, then have a go. Otherwise (or if this is a large
> or critical network) this might be a job for a commercial support
> provider who will probably write a script to assist.
> How big is your domain?
> (Dreaming, with unlimited development time I would love to have Samba
> cope with this natively, by sorting the results on the new DC and using
> REPL_SINGLE_OBJECT to fill in the gaps, but this is a much bigger
> I hope this gives you a way forward.
> Andrew Bartlett
Not a huge domain - maybe 8 users or so. When you say in place upgrade are you talking about upgrading Zentyal so that Samba gets upgraded to at least 4.5 or above?
More information about the samba