[Samba] deleted objects

[Rowland Penny]

On 08/06/2023 23:18, Alexandros Karypidis via samba wrote:
> Hello,
> 
> Just over a week ago, I updated samba 4.17.8-Debian from an old 4.9.x version. Initially I had two domain controllers DC1 and DC2. I did the upgrade as follows:
> 
> 1) Create a new DC3 with the new samba version and make it FSMO
> 2) Demote/delete DC1 and DC2
> 3) Recreate DC1 and DC2
> 4) Demote/delete the temporary DC3 from step (1)
> 
> Everything seems to work fine except I noticed today these messages:
> 
> root at dc1 ~# samba-tool dbcheck
> 
> Checking 291 objects
> NOTE: old (due to rename or delete) DN string component for lastKnownParent in object CN=RID Set\0ADEL:fad2af7d-0a1b-4434-bbe1-9932faf63f65,CN=Deleted Objects,DC=ad,DC=home,DC=lan - CN=DC2,CN=Computers,DC=ad,DC=home,DC=lan
> Not fixing old string component
> NOTE: old (due to rename or delete) DN string component for lastKnownParent in object CN=RID Set\0ADEL:379a5d40-b1a6-4c9b-9d10-93038f6a3ece,CN=Deleted Objects,DC=ad,DC=home,DC=lan - CN=DC3,OU=Domain Controllers,DC=ad,DC=home,DC=lan
> Not fixing old string component
> NOTE: old (due to rename or delete) DN string component for lastKnownParent in object CN=RID Set\0ADEL:a2c4a376-1fc8-49c8-85d6-a46949613b66,CN=Deleted Objects,DC=ad,DC=home,DC=lan - CN=DC1,CN=Computers,DC=ad,DC=home,DC=lan
> Not fixing old string component
> NOTE: old (due to rename or delete) DN string component for lastKnownParent in object CN=RID Set\0ADEL:b702ac13-935a-4def-9ef6-3dbdca55e820,CN=Deleted Objects,DC=ad,DC=home,DC=lan - CN=DC3,OU=Domain Controllers,DC=ad,DC=home,DC=lan
> Not fixing old string component
> Checked 291 objects (0 errors)
> 
> I get the same in the other domain controller:
> 
> root at dc2 ~# samba-tool dbcheck
> 
> Checking 291 objects
> NOTE: old (due to rename or delete) DN string component for lastKnownParent in object CN=RID Set\0ADEL:fad2af7d-0a1b-4434-bbe1-9932faf63f65,CN=Deleted Objects,DC=ad,DC=home,DC=lan - CN=DC2,CN=Computers,DC=ad,DC=home,DC=lan
> Not fixing old string component
> NOTE: old (due to rename or delete) DN string component for lastKnownParent in object CN=RID Set\0ADEL:379a5d40-b1a6-4c9b-9d10-93038f6a3ece,CN=Deleted Objects,DC=ad,DC=home,DC=lan - CN=DC3,OU=Domain Controllers,DC=ad,DC=home,DC=lan
> Not fixing old string component
> NOTE: old (due to rename or delete) DN string component for lastKnownParent in object CN=RID Set\0ADEL:a2c4a376-1fc8-49c8-85d6-a46949613b66,CN=Deleted Objects,DC=ad,DC=home,DC=lan - CN=DC1,CN=Computers,DC=ad,DC=home,DC=lan
> Not fixing old string component
> NOTE: old (due to rename or delete) DN string component for lastKnownParent in object CN=RID Set\0ADEL:b702ac13-935a-4def-9ef6-3dbdca55e820,CN=Deleted Objects,DC=ad,DC=home,DC=lan - CN=DC3,OU=Domain Controllers,DC=ad,DC=home,DC=lan
> Not fixing old string component
> Checked 291 objects (0 errors)
> 
> These seem to be leftovers from my prior work and the "CN=Deleted Objects" seems to me like it's some sort of "Recycle Bin" node.

Close, those are described as tombstoned objects.
> 
> 1) Is it ok to run "samba-tool dbcheck --fix --yes" in this state? Will this remove these and clean up the database?

It is probably okay to run that command, but it also probably wont fix 
your problem ;-)

Try reading 'samba-tool domain tombstones expunge --help'

> 
> 2) Should I run the fix only in the FSMO controller and wait for replication to fix the other controller, or do I need to run dbcheck --fix on both?
> 
You should only need to run the command on one DC, replication will fix 
the rest.

Rowland