Samba4 Troubleshooting

Troubleshooting

Checking Replication

• Check replication status

samba-tool drs showrepl

Force Removal of DC

• If a Samba4 DC goes offline and cannot be restored so that replication can resync with another DC it must be forcibly removed from the domain.
• If the failed DC owned any of the FSMO roles they must be seized by the current working DC. See link for howto:
• https://wiki.samba.org/index.php/Transfering_/_seizing_FSMO_roles
• Once all roles are on a working DC you may force remove the down DC from the domain. Use the following script:
• https://gallery.technet.microsoft.com/scriptcenter/d31f091f-2642-4ede-9f97-0e1cc4d577f3#content
• Check in ADUC under Domain Controllers(or appropriate OU) the DC was removed, if not delete the object.
• Open up the DNS Manager and remove all entries for the failed DC.
• Never restore/reintroduce the failed DC back into the domain, it will cause replication issues.
• To bring another DC up, setup samba as usual and join the domain as a DC using samba-tool:
• https://wiki.samba.org/index.php/Join_an_additional_Samba_DC_to_an_existing_Active_Directory

Demote a DC

• https://wiki.samba.org/index.php/Demote_a_Samba_AD_DC

Join a DC

• https://wiki.samba.org/index.php/Join_an_additional_Samba_DC_to_an_existing_Active_Directory

Backup and Restore

• https://wiki.samba.org/index.php/Backup_and_restore_an_Samba_AD_DC

LDB Search/Edit

• ldb search example:

ldbsearch -H /usr/local/samba/private/sam.ldb.d/DC\=DOMAINDNSZONES\,DC\=***\,DC\=***\,DC\=***\,DC\=***.ldb

• weird error with tombstone lifetime

[2015/05/20 14:27:27.377734,  0] ../source4/dsdb/repl/replicated_objects.c:783(dsdb_replicated_objects_commit)
 Failed to apply records: replmd_replicated_apply_add: error during DRS repl ADD: No objectClass found in replPropertyMetaData for DC=lluvia\0ACNF:fe4415b8-8a9d-417d-abb3-77771ec99f88\0ADEL:fe4415b8-8a9d-417d-abb3-77771ec99f88,CN=Deleted Objects,DC=DomainDnsZones,DC=***,DC=***,DC=***,DC=edu!
 : Object class violation

• use ldbedit to change the tombstone lifetime from 6 months to 10 days to get rid of all extra "Deleted Objects" that wont replicate

ldbedit -H ldap://localhost -Uadministrator -s base -b "CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=***,DC=***,DC=***,DC=***"

• https://wiki.samba.org/index.php/Restoring_deleted_AD_objects#Changing_the_defaults_for_msDS-deletedObjectLifetime_and_tombstoneLifetime