Re: [Samba] Samba Migration and AD integration
- Date: Wed, 7 Feb 2018 10:55:44 +0000
- From: Rowland Penny via samba <samba@xxxxxxxxxxxxxxx>
- Subject: Re: [Samba] Samba Migration and AD integration
On Wed, 7 Feb 2018 10:02:10 +0000
Praveen Ghimire <PGhimire@xxxxxxxxxxxxxx> wrote:
> Hi Rowland,
> Following the
> ran some tests migrating from Bind9 to Samba Internal with the
> following results
> Stopped the BIND, Samba-AD-DC services
> samba_upgradedns --dns-backend=SAMBA_INTERNAL
> Reading domain information
> DNS accounts already exist
> Reading records from zone
> file /var/lib/samba/private/dns/<REALMNAME>.zone DNS partitions
> already exist Finished upgrading DNS
> You have switched to using SAMBA_INTERNAL as your dns backend, but
> you still have samba starting looking for a BIND backend. Please
> remove the -dns from your server services line.
Did you remove the 'server services' line ?
> Started the Samba-AD-DC service and left the Bind9 stopped.
> The .zone file had the all the SOA records for the REALM. The issue
> (after the change from Bind9 to Samba and also from Samba Internal to
> Bind9) we get the following when trying to add a machine to the
> The error was: "This operation returned because the timeout period
> expired." (error code 0x000005B4 ERROR_TIMEOUT)
> The query was for the SRV record for _ldap._tcp.dc._msdcs.<realmname>
> The DNS servers used by this computer for name resolution are not
> responding. This computer is configured to use DNS servers with the
> following IP addresses: 172.16.24.1 Verify that this computer is
> connected to the network, that these are the correct DNS server IP
> addresses, and that at least one of the DNS servers is running.
Does the computer you are trying to join have an ipaddress in the
172.16.24.x range ?
Does the nameserver in /etc/resolv.conf point to the Samba DCs
ipaddress or '127.0.0.1' ?
try running this:
samba_dnsupdate --verbose --all-names
This should try to create/update all the required dns records, if it
errors out add '--use-samba-tool'
> The SRV records are missing by the looks of it.
> service --status-all
> [ + ] apparmor
Have you tried turning apparmor off ?
> [ + ] isc-dhcp-server
I could never get isc-dhcp-server to update the server records in AD
when using the internal dns server.
> [ + ] ufw
Are all the required ports open ?
> Also, does the Realm name needs to be something like abcd.local
> instead of abcdef?
It would probably better if it had a TLD (just don't use .local), but
should work without one.
To unsubscribe from this list go to the following URL and read the