[Samba] occasional interSiteTopologyGenerator differences between DCs

Tue Dec 7 13:16:04 UTC 2021

Hai Mourik-Jan, 

You changed FSMO roles? 

The english explanation i saw.. 

The intersite topology generator is an Active Directory process 
that defines the replication between sites on a network. 

A single domain controller in each site is automatically designated
to be the intersite topology generator. Because this action is performed
by the intersite topology generator, you are not required to take any 
action to determine the replication topology and bridgehead server roles.

The domain controller that holds the intersite topology generator role performs two functions:

?? It automatically selects one or more domain controllers to 
become bridgehead servers. This way, if a bridgehead server 
becomes unavailable, it automatically selects another bridgehead server, 
if possible.

?? It runs the KCC to determine the replication topology and resultant 
connection objects that the bridgehead servers can use to communicate 
with bridgehead servers of other sites.

Only why does it change server, i suspect the following but im not sure.. 
Lets say DC1 is the intersite topology generator, and your going to updated
your servers. At some point, DC1 is not reachable, so, automaticly it changes
to an other server.  

That could explain it, but again, im not sure on this one.. 
Below some steps you can look into how things are set now. 

i suggest, read everything first before change anything, since, 
this should be done automaticly. 

-----------------------------------------------
You can create a preferred bridgehead server, 
perform the following steps: 

1. Open Active Directory Sites and Services, expand Sites, 
expand the site that contains the server that you want to configure, 
expand Servers, and then in the console tree, right-click the 
domain controller that you want to make a preferred bridgehead server, 
and then click Properties.

2. Choose the inter-site transport or transports to designate the computer
 a preferred bridgehead server, click Add, and then click OK.

-----------------------------------------------
Procedure for forcing the KCC to run
To refresh replication topology, first determine whether you want to 
refresh the replication topology between sites or the replication topology within a site.

?? To regenerate it between sites, run the KCC on the domain controller that 
holds the intersite topology generator role.
?? To regenerate it within a site, run the KCC on any domain controller that 
is not the intersite topology generator.

To determine the domain controller that holds the role of the intersite topology 
generator in the site, perform the following steps:
1. In Active Directory Sites and Services, expand Sites, and then select the site.
2. In the details pane, right-click NTDS Site Settings, and then click Properties.

The site and server that holds the intersite topology generator role appears on 
the properties page under Inter-Site Topology Generator.
To force the KCC to run, perform the following steps:

1. In Active Directory Sites and Services, in the console tree, expand Sites, 
expand the site that contains the server on which you want to run the KCC, 
expand Servers, and then select the server object for the domain controller 
that you want to run the KCC on.

2. In the details pane, right-click NTDS Settings, click All Tasks, and then 
click Check Replication Topology.

-----------------------------------------------
Procedure To force replication over a connection, perform the following steps:

1. In Active Directory Sites and Services, expand the domain controller for the 
site that contains the connection that you use to replicate directory information.

2. In the console tree, click NTDS Settings.

3. In the details pane, right-click the connection that you use to replicate 
directory information, and then click Replicate Now.

I hope above helps a bit. 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens mj via samba
> Verzonden: dinsdag 7 december 2021 10:22
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] occasional interSiteTopologyGenerator 
> differences between DCs
> 
> Hi,
> 
> I am doing regular automated runs of samba-tool ldapcmp, to make sure 
> that all our DC's serve the same data. They run samba 4.13.14 
> on buster.
> 
> Since a couple of weeks, we are getting intermittant failures on the 
> interSiteTopologyGenerator. These differences appear and also 
> disappear 
> 'automatically' again. They usually stay for a couple of hours, 
> sometimes less.
> 
> They look like this:
> 
> > * Comparing [DOMAIN] context...
> > 
> > * Objects to be compared: 2002
> > 
> > * Result for [DOMAIN]: SUCCESS
> > 
> > * Comparing [CONFIGURATION] context...
> > 
> > * Objects to be compared: 1737
> > 
> > Comparing:
> > 'CN=NTDS SITE 
> SETTINGS,CN=DEFAULT-FIRST-SITE-NAME,CN=SITES,CN=CONFIGURATION,
> DC=SAMBA,DC=COMPANY,DC=COM' [ldap://sambadc4.samba.domain.com]
> > 'CN=NTDS SITE 
> SETTINGS,CN=DEFAULT-FIRST-SITE-NAME,CN=SITES,CN=CONFIGURATION,
> DC=SAMBA,DC=COMPANY,DC=COM' [ldap://sambadc3.samba.domain.com]
> >     Difference in attribute values:
> >         interSiteTopologyGenerator => 
> > [b'CN=NTDS 
> Settings,CN=WINDC2,CN=Servers,CN=Default-First-Site-Name,CN=Si
> tes,CN=Configuration,DC=samba,DC=company,DC=com']
> > [b'CN=NTDS 
> Settings,CN=SAMBADC3,CN=Servers,CN=Default-First-Site-Name,CN=
> Sites,CN=Configuration,DC=samba,DC=company,DC=com']
> > 
> >     FAILED
> > 
> > * Result for [CONFIGURATION]: FAILURE
> > 
> > SUMMARY
> > ---------
> > 
> > Attributes with different values:
> > 
> >     interSiteTopologyGenerator
> > 
> > * Comparing [SCHEMA] context...
> > 
> > * Objects to be compared: 1739
> > 
> > * Result for [SCHEMA]: SUCCESS
> > 
> > * Comparing [DNSDOMAIN] context...
> > 
> > * Objects to be compared: 305
> > 
> > * Result for [DNSDOMAIN]: SUCCESS
> > 
> > * Comparing [DNSFOREST] context...
> > 
> > * Objects to be compared: 21
> > 
> > * Result for [DNSFOREST]: SUCCESS
> > 
> 
> I'm not too woried, since everything works, and the situation always 
> proves to be only temporarily. We would not even have noticed this 
> occasional discrepancy, if we were not running the regular ldapcmp 
> though cron.
> 
> But can anyone explain why this is happening, and perhaps how 
> we could 
> prevent this?
> 
> Best,
> MJ
> 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
> 