[Samba] New DC not showing [was Trouble transferring FSMO roles]

[Andrea Venturoli]

On 7/8/26 20:16, Rowland Penny via samba wrote:

>>> Early versions of samba-tool had a bug that prevented the seizure
>>> of the Domain Naming Master role. If you encounter this problem in
>>> your version, add the "--force" parameter as a temporary
>>> workaround. You should upgrade to a supported Samba version as soon
>>> as possible.
>>
>> Does this still apply to 4.23, which should be still a "supported"
>> version?
> 
> Probably, When you seize a role, it first tries to transfer it and
> generally fails, using '--force' just goes directly to attempting to
> seize the role.
> 
>>
>> Also, before I try this, does this mean I should demote the old DC
>> immediately thereafter?
>> (I'd like to keep it working for a few other days).
> 
> If you 'seize' any FSMO role, you should demote the old DC, it probably
> still thinks it owns the role just seized.
Hello again.

I forcibly transferred the roles and powered down the old Windows server.
There were some leftover references in DNS, that I deleted manually, and 
some trouble in the LDAP database, which "samba-tool dbcheck --fix" took 
care of.
After about a month I can say everything seems to work properly.



Yesterday I tried adding a second Samba DC.
Apparently everything worked fine: "samba-tool domain join" completed 
without complaining (and I stupidly didn't save this output).

However "samba-tool drs showrepl" would show errors (which again, 
unfortunately are now lost) and "host -t SRV 
_ldap._tcp.{mydomain}.local" only showed DC1 (not DC2 which I just added).



Forward one day...
Now "samba-tool drs showrepl" is fine on both DC: maybe it just neede 
time, but I had waited far more than "15 minutes" as stated in the docs.
Still, I'm missing the DC2 entry in "host -t SRV 
_ldap._tcp.{mydomain}.local".



Is anyone able to suggest how to proceed from here?

Should I just add the missing DNS entries?
Manually or with some command I don't know about?

Should I demote DC2 and start over?

Anything else to check?



  bye & Thanks
	av.

P.S.
Given that now "samba-tool dbcheck --cross-ncs" says "0 errors", is 
there anything else I should run in order to check that nothing bad is 
lurking?