[Samba] GPO on a DC

samba-ml-en samba-ml-en at protonmail.com
Fri Jun 24 11:01:56 UTC 2022

Hello Louis,

$host tristsnpa43.ad2.domain.eu
tristsnpa43.ad2.domain.eu has address
$dig tristsnpa43.ad2.domain.eu +short

$host domain name pointer tristsnpa43.ad2.domain.eu.
$dig -x +short

       Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub

Link 2 (vlan10)
    Current Scopes: DNS
         Protocols: -DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=yes/supported
Current DNS Server:
       DNS Servers:
        DNS Domain: ~inf.domain.eu

Link 3 (vlan20)
    Current Scopes: DNS
         Protocols: +DefaultRoute -LLMNR -mDNS -DNSOverTLS DNSSEC=yes/supported
Current DNS Server:
       DNS Servers:
        DNS Domain: ad2.domain.eu ~.

For named, I have
systemctl edit named.service<<EOF
ExecReload=/usr/bin/systemctl restart named.service
ExecStartPost=/bin/sleep 10
After=network.target network-online.target

For samba-ad-dc, I have
systemctl edit samba-ad-dc.service<<EOF
After=network.target network-online.target named.service

Also as I previously mentioned:

Problem appears
1) on first start after boot
2) if systemctl restart samba-ad-dc (which rules out a problem with named since it is not restarted)
3) after the refresh period of 90mn +-30mn

Problem is NOT exhibited when
ssh to dc as root, run samba-gpupdate --force, -X, --rsop

I can sent a d10 log of working and not working examples, however, I could not find a way to get similar looking logs
samba-gpupdate --force -d10
cat /var/log/samba/log.winbindd will give a very detailed log.

I tried to add in smb.conf gpo update command=/usr/sbin/samba-gpupdate -d10 but the log does not look the same.

Anyway, here are the logs attached.

Have a great day,


------- Original Message -------
On Friday, June 24th, 2022 at 10:29 AM, L. van Belle via samba <samba at lists.samba.org> wrote:

> Just wondering here.
> Dit you check you A/PTR records of that new joined server.
> and, did you configure the start order of the services, especially if you
> use bind_DLZ
> In that case.
> systemctl edit bind9
> add:
> [Service]
> # Disable reloading completely.
> ExecReload=
> # Or set it to restart, above line is needed also,
> # so if needed only enable one below here.
> #ExecReload=/usr/sbin/rndc restart
> systemctl edit samba-ad-dc
> add :
> [Unit]
> After=network.target network-online.target bind9.service named.service
> # These below might not be needed anymore.
> [Service]
> NotifyAccess=all
> systemctl daemon-reload
> systemctl stop samba-ad-dc bind9
> systemctl start samba-ad-dc bind9
> check logs, reboot, let us know the result.
> Greetz,
> Louis
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: working.txt
URL: <http://lists.samba.org/pipermail/samba/attachments/20220624/078b2f0f/working.txt>

More information about the samba mailing list