2

I have to migrate a domain controller from Samba 4.5 to Windows Server 2016. The problem is, samba's DC implementation is not complete. It doesn't join correctly anything newer than Server 2008R2, and it does not implement SYSVOL replication.

The first was solved by using a Server 2008R2 instance as an intermediate step, which was promoted successfully. Then samba was demoted and dejoined, then the first Server 2016 joined and promoted.

What is causing severe problems is the missing sysvol replication. The "official" recommendation around this is to use something like robocopy for a one-way sync from the samba DC to windows, then manually set the "SysvolReady" flag to 1 on the windows DC to trick it into believing everything is OK. This works at first, but now I still don't have working replication when joining the Server 2016 DC.

The situation is:

  1. FRS service is stopped on the 2008 DC, DFS is running.
  2. Using the DFS console, the replication set for SYSVOL exists but has no members.
  3. Using AD Users and Groups, under System, DFSR-GlobalSettings, Domain System Volume, and Topology - is empty (probably the same as #2).
  4. Using ADSI-Edit, there is no DFSR-LocalSettings object for any DC
  5. dfsrmig /getglobalstate says the global state is "Eliminated", but the local state is "Starting".

Any recommendations how to get out of this? I can afford to lose current Sysvol contents, there were mainly some GPOs which I have backed up. I can also afford some downtime, if neccessary.

Thank you!

Improve this question
3
  • There aren't any ms-DFSR-Member objects in DFSR Global Settings > Domain System Volume > Topology, and there are no msDFSR-Subscription objects under the Domain Controllers DFSR-LocalSettings, so replication cannot function. Did SYSVOL exist when joining the first 2008 R2 domain controller? What occurred between joining the 2008 R2 DC and DFS running?
    – Greg Askew
    Oct 20, 2018 at 13:52
  • An empty Sysvol existed when joining the 2008 DC, but it was not shared. I then copied over Sysvol contents from the samba DC using robocopy and set SysvolReady to 1 using regedit. Then after restart, Sysvol was shared. I didn't do anything specific to DFS, I did not explicitly enable it or migrate it from FRS. That's just the way it was right after joining.
    – Andreas Heinlein
    Oct 20, 2018 at 16:32
  • That makes sense I guess, considering Samba documentation states doesn't really have the internals for SYSVOL replication. I think you are probably in brain surgery territory. You could try installing a new 2016 DC with the same forest/domain/domain controller name, and using LDIFDE to export the DFSR Local Settings > Domain System Volume node for the domain controller, and the DFSR Global Settings > Domain System Volume node and importing them on the real DC. No idea if it would work though.
    – Greg Askew
    Oct 20, 2018 at 17:46

1 Answer 1

Reset to default
2

I suggest you to try rebuilding from scratch a SYSVOL share that replicates through FRS and, in a second step, a migration to DFS-R.

First of all, make sure that either Active Directory replication (repadmin /replsummary and repadmin /showrepl) is working well across domain controllers. Then, demote Windows 2016 domain controllers, because they do not support FRS.

On remaining Windows 2008 R2 domain controllers, stop and disable DFSR service and delete objects related to DFS-R (make a backup first):

  • CN=Domain System Volume,CN=DFSR-GlobalSettings,CN=SYSTEM,DC={domain}
  • CN=Domain System Volume,CN=DFSR-LocalSettings,CN={the server name},OU=Domain Controllers,DC={domain}, for each domain controller

Rebuild SYSVOL by following procedures from KB315457:

Restore your SYSVOL backup data and, then, migrate SYSVOL replication service from FRS to DFS-R. Before you begin, please read this article:

And this article set:

After migrating SYSVOL replication service to DFS-R, promote Windows 2016 domain controllers again.

I made one successful SYSVOL migration from FRS to DFS-R recently. However, my Samba experience is limited to domain members only. I do not have any experience with Samba domain controllers, therefore I can't ensure how good my answer is. I am not able to test it.

Improve this answer
2
  • Sounds like it could work. I already thought in that direction, but you saved me some time trying to find out how to do it, thanks! As long as this is the only DC and there is no one working in the domain on weekends, it should be possible to take a snapshot of it and revert to it in case it doesn't work, right?
    – Andreas Heinlein
    Oct 21, 2018 at 8:14
  • I believe that the snapshot can be reverted safely if the virtualization environment (such as Microsoft Hyper-V and VMware vSphere) does not depend on the Active Directory for users authentication and there is only one domain controller in entire forest. For the purpose of data integrity, I recommend you to shutdown the DC before taking the snapshot. Note that domain users and machines may change their passwords during SYSVOL reconstruction; such members will be unable to authenticate if the snapshot is reverted.
    – Anderson Medeiros Gomes
    Oct 21, 2018 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .