Can't join Domain after Takeover - Small Business Server (SBS)

[cpzengel]

Hi,

after Takeover from SBS2008 i demoted the old dc and renamed the Machine from sbs to sbs2008 with new DHCP IP

NSLOOKUP to tld.local is working but is not possible to join

Hinweis: Diese Informationen sind für einen Netzwerkadministrator bestimmt. Wenden Sie sich an den Netzwerkadministrator, wenn Sie kein Netzwerkadministrator sind, und leiten Sie die Informationen in der Datei C:\Windows\debug\dcdiag.txt weiter.

Der folgende Fehler ist beim Abfragen von DNS über den Ressourceneintrag der Dienstidentifizierung (SRV) aufgetreten, der zur Suche eines Active Directory-Domänencontrollers für die Domäne “leister-schuhe.local” verwendet wird:

Fehler: “DNS-Serverfehler.”
(Fehlercode 0x0000232A RCODE_SERVER_FAILURE)

Es handelt sich um die Abfrage des Dienstidentifizierungseintrags (SRV) für _ldap._tcp.dc._msdcs.leister-schuhe.local

Die häufigsten Ursachen dieses Fehlers sind:

• Die von diesem Computer verwendeten DNS-Server enthalten falsche Stammhinweise. Dieser Computer wurde zur Verwendung der folgenden IP-Adressen konfiguriert:

10.0.0.4

• Mindestens eine der folgenden Zonen enthalten eine falsche Delegierung:

leister-schuhe.local
local
. (die Stammzone)

Klicken Sie auf “Hilfe”, um weitere Informationen über die Fehlerbehandlung zu erhalten.

NETBIOS Name for Join brings a login thats accepted

After a while the System shows up under Devices with a Computer account, but

Die angegebenen Netzwerkresource bzw. das angegebene Gerät ist nicht mehr verfügbar

even the Machine is already present in UCS

Help apreciated

[externa1]

Hi

try running this script
/usr/share/univention-samba4/scripts/check_essential_samba4_dns_records.sh
it will show that recent dns records are missing in s4 dns - also they are available in ldap dns

i had this at all take-over scenarios and the only workaround was reprovisioning samba4 on ucs master

rg
christian

[cpzengel]

i just found an older topic from me.
please advice

root@ucs-Leister:/usr/share/univention-samba4/scripts# ./check_essential_samba4_dns_records.sh
Host gc._msdcs.leister-schuhe.local not found: 2(SERVFAIL)
_gc._tcp.leister-schuhe.local has SRV record 0 100 3268 sbs.leister-schuhe.local.
_gc._tcp.leister-schuhe.local has SRV record 0 100 3268 ucs-leister.leister-schuhe.local.
Host _ldap._tcp.gc._msdcs.leister-schuhe.local not found: 2(SERVFAIL)
_ldap._tcp.leister-schuhe.local has SRV record 0 100 389 sbs.leister-schuhe.local.
_ldap._tcp.leister-schuhe.local has SRV record 0 100 389 ucs-leister.leister-schuhe.local.
Host _ldap._tcp.dc._msdcs.leister-schuhe.local not found: 2(SERVFAIL)
Host _ldap._tcp.pdc._msdcs.leister-schuhe.local not found: 2(SERVFAIL)
Host _ldap._tcp.df242e69-6d7e-45d2-90d0-990bea885ab2.domains._msdcs.leister-schuhe.local not found: 2(SERVFAIL)
Host _kerberos._tcp.dc._msdcs.leister-schuhe.local not found: 2(SERVFAIL)
_kerberos._tcp.leister-schuhe.local has SRV record 0 100 88 sbs.leister-schuhe.local.
_kerberos._tcp.leister-schuhe.local has SRV record 0 100 88 ucs-leister.leister-schuhe.local.
_kerberos._udp.leister-schuhe.local has SRV record 0 100 88 ucs-leister.leister-schuhe.local.
_kerberos._udp.leister-schuhe.local has SRV record 0 100 88 sbs.leister-schuhe.local.
_kpasswd._tcp.leister-schuhe.local has SRV record 0 100 464 sbs.leister-schuhe.local.
_kpasswd._tcp.leister-schuhe.local has SRV record 0 100 464 ucs-leister.leister-schuhe.local.
_kpasswd._udp.leister-schuhe.local has SRV record 0 100 464 sbs.leister-schuhe.local.
_kpasswd._udp.leister-schuhe.local has SRV record 0 100 464 ucs-leister.leister-schuhe.local.
Located DC ‘ucs-Leister’ in site ‘Default-First-Site-Name’
Host 759df28d-4dfa-4b28-9e2f-94d3dc7d95fa._msdcs.leister-schuhe.local not found: 2(SERVFAIL)

Records for site Default-First-Site-Name:

_ldap._tcp.Default-First-Site-Name._sites.leister-schuhe.local has SRV record 0 100 389 ucs-leister.leister-schuhe.local.
_ldap._tcp.Default-First-Site-Name._sites.leister-schuhe.local has SRV record 0 100 389 sbs.leister-schuhe.local.
Host _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.leister-schuhe.local not found: 2(SERVFAIL)
_kerberos._tcp.Default-First-Site-Name._sites.leister-schuhe.local has SRV record 0 100 88 ucs-leister.leister-schuhe.local.
_kerberos._tcp.Default-First-Site-Name._sites.leister-schuhe.local has SRV record 0 100 88 sbs.leister-schuhe.local.
Host _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.leister-schuhe.local not found: 2(SERVFAIL)

Optional GC Records for site Default-First-Site-Name:

_gc._tcp.Default-First-Site-Name._sites.leister-schuhe.local has SRV record 0 100 3268 sbs.leister-schuhe.local.
_gc._tcp.Default-First-Site-Name._sites.leister-schuhe.local has SRV record 0 100 3268 ucs-leister.leister-schuhe.local.
Host _ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.leister-schuhe.local not found: 2(SERVFAIL)
_kerberos.leister-schuhe.local descriptive text “LEISTER-SCHUHE.LOCAL”

[cpzengel]

@externa1

reprovisioning samba4 on ucs master

how do i initiate that?

[SirTux]

@cpzengel

how do i initiate that?

Re-Provisioning Samba4 on a DC Master

This article describes the re-provision of a Samba 4 DC Master. Please see this article if a UCS@school environment is used. Problem: Several Samba 4 data is either lost or corrupt The LDB-Data of Samba 4 (z.B. /var/lib/samba/private/sam.ldb) is corrupted/broken/lost and Samba 4 has to be re-provisioned. Solution: Samba 4 can be re-provisioned with the help of the existing LDAP data The following steps will describe the needed procedure: Note: Make sure that all of your groups/users…

[cpzengel]

some commands failed
then i went back to a zfs snapshot
after reboot a join was possible with win 10 test machine

the old sbs also could be joined

the issue were non resolving dns entries i´ve seen in webfrontend, but not in nslookup

any idea?

[cpzengel]

@cpzengel

/usr/share/univention-samba4/scripts

Problem back again. Workstation can login, Terminalserver cant.
Please help

[cpzengel]

[cpzengel]

sometimes login on ts possible, sometimes not.
join not possible

[externa1]

Hi,

what you are posting here is the Samba DNS
https://help.univention.com/uploads/default/original/2X/f/f0aa58a902d6c7a3a2bf909f69d7ba608558756b.png

an here LDAP
https://help.univention.com/uploads/default/original/2X/4/44a0e77e68f8908cf2aac42f7e779f22b39da4e9.png

I think there should be a way provided by Univention to only recreate s4 dns from ldap dns !!

you can try to add the missing dns entries throut RSAT Tools and Windows DNS Management Tool - but i don’t know if this gets synced tp ldap as the records exists already there

rg
Christian

[cpzengel]

ucr set dns/backend=‘ldap’
/etc/init.d/bind9 restart

helped for the moment.
can i keep hat setting?

[SirTux]

Yes you can use also openLDAP as backend. AFAIK it would only be a problem if you are using dynamic IPs / DNS.

To fix the problem you could try an resync, e.g.

/usr/share/univention-s4-connector/resync_object_from_ucs.py --filter relativeDomainName=_ldap._tcp

But this is without warranty. You should do a backup first.

[stoeckigt]

Hi @cpzengel,

I would really appreciate to have a broad look into the /var/log/daemon.* Logfiles about bind9. At least I ask you to post the tail -f /var/log/daemon.log | grep 'named' when restarting the dns daemon systemctrl restart bind9.service.

[stoeckigt]

Hi @cpzengel

as you can see in the ‘daemon.log’:

daemon.log - bind9 start <click to enlarge>

Nov 12 09:30:18 ucs-master named[5993]: ----------------------------------------------------
Nov 12 09:30:18 ucs-master named[5993]: BIND 9 is maintained by Internet Systems Consortium,
Nov 12 09:30:18 ucs-master named[5993]: Inc. (ISC), a non-profit 501©(3) public-benefit
Nov 12 09:30:18 ucs-master named[5993]: corporation. Support and training for BIND 9 are
Nov 12 09:30:18 ucs-master named[5993]: available at https://www.isc.org/support
Nov 12 09:30:18 ucs-master named[5993]: ----------------------------------------------------
Nov 12 09:30:18 ucs-master named[5993]: adjusted limit on open files from 4096 to 1048576
Nov 12 09:30:18 ucs-master named[5993]: found 2 CPUs, using 2 worker threads
Nov 12 09:30:18 ucs-master named[5993]: using 2 UDP listeners per interface
Nov 12 09:30:18 ucs-master named[5993]: using up to 4096 sockets
Nov 12 09:30:18 ucs-master named[5993]: loading configuration from ‘/etc/bind/named.conf.samba4’
Nov 12 09:30:18 ucs-master named[5993]: reading built-in trusted keys from file ‘/etc/bind/bind.keys’
Nov 12 09:30:18 ucs-master named[5993]: using default UDP/IPv4 port range: [1024, 65535]
Nov 12 09:30:18 ucs-master named[5993]: using default UDP/IPv6 port range: [1024, 65535]
Nov 12 09:30:18 ucs-master named[5993]: listening on IPv6 interfaces, port 53
Nov 12 09:30:18 ucs-master named[5993]: listening on IPv4 interface lo, 127.0.0.1#53
Nov 12 09:30:18 ucs-master named[5993]: listening on IPv4 interface eth0, 10.0.0.4#53
Nov 12 09:30:18 ucs-master named[5993]: listening on IPv4 interface eth0:1, 10.0.0.200#53
Nov 12 09:30:18 ucs-master named[5993]: listening on IPv4 interface docker0, 172.17.42.1#53
Nov 12 09:30:18 ucs-master named[5993]: generating session key for dynamic DNS
Nov 12 09:30:18 ucs-master named[5993]: sizing zone task pool based on 1 zones
Nov 12 09:30:18 ucs-master named[5993]: Loading ‘samba4.zone’ using driver dlopen
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: started for DN DC=domain,DC=local
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: starting configure
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: trying partition ‘CN=MicrosoftDNS,CN=System,DC=domain,DC=local’
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: configured writeable zone ‘0.0.10.in-addr.arpa’
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: pre-W2k3 zone found
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: trying partition ‘CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=local’
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: configured writeable zone ‘domain.local’
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: trying partition ‘CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=local’
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: configured writeable zone ‘myself.dyndns.org’
Nov 12 09:30:19 ucs-master named[5993]: samba_dlz: Ignoring dnsZone _msdcs.domain.local
Nov 12 09:30:19 ucs-master named[5993]: set up managed keys zone for view _default, file ‘managed-keys.bind’

the Zone ‘_msdcs.domain.local’ is ignored because there is a ‘pre-W2k3 zone’ found - a so called ‘legacy zone’.

There is a Script to migrate_legacy_dns_zones.sh (10,5 KB), you might give it a try to automatically fix that issue.

[cpzengel]

e08003da2ee3b63dca0c9efffbaa630c555886b1.sh: 25: e08003da2ee3b63dca0c9efffbaa630c555886b1.sh: Syntax error: “(” unexpected (expecting “}”)

strange name came from wget

[stoeckigt]

If you want to directly download the Script to your server, you need to specify the appropriate name:

wget -o '/tmp/migrate_legacy_dns_zones.sh' https://help.univention.com/uploads/default/original/2X/e/e08003da2ee3b63dca0c9efffbaa630c555886b1.sh

or you download and transfer the file via scp (WinSCP).

[cpzengel]

sh migrate_legacy_dns_zones.sh

migrate_legacy_dns_zones.sh: 1: migrate_legacy_dns_zones.sh: --2017-11-13: not found
migrate_legacy_dns_zones.sh: 2: migrate_legacy_dns_zones.sh: Syntax error: “(” unexpected

[SirTux]

@stoeckigt

wget -o ‘/tmp/migrate_legacy_dns_zones.sh’ https://help.univention.com/uploads/default/original/2X/e/e08003da2ee3b63dca0c9efffbaa630c555886b1.sh

The command is wrong. It has to be

wget -O '/tmp/migrate_legacy_dns_zones.sh' https://help.univention.com/uploads/default/original/2X/e/e08003da2ee3b63dca0c9efffbaa630c555886b1.sh

“-o” means that the output of wget will be written to the given file.

[cpzengel]

download not the problem

migrate_legacy_dns_zones.sh: 25: migrate_legacy_dns_zones.sh: Syntax error: “(” unexpected (expecting “}”)

[stoeckigt]

this seemed to be malformated due to Windows/Download copied to Linux. With the command dos2unix you can reformat the file to execute it properly.