[SOLVED] SambaAD - Stupid question

[JMB]

Good evening,
I must first congratulate you on the clarity of your documentation. It allowed me last June to set up my first Samba AD controller with my two other Windows 2019 DCs.

Unfortunately, since then, a major server failure has damaged our Active Directory, and I can no longer restore it as I was able to do six months earlier!
I consistently encounter the error:
DsAddEntry failed with status WERR_ACCESS_DENIED info (8567, 'WERR_DS_INCOMPATIBLE_VERSION')

or

ERROR(runtime): uncaught exception - (9003, 'WERR_DNS_ERROR_RCODE_NAME_ERROR').

This occurs regardless of the administration account: administrator or administrator.

I'm fairly certain this is a permissions issue with Active Directory, specifically with CN=SAMBA, CN=Servers, CN=Default-First-Site, CN=Sites, CN=Configuration, DC=.... But I can't identify which one it is or how to grant the necessary rights to the Administrator user, so I'm resigned to asking the question in this forum!

Thank you.

[dcardon]

Hello Jean-Marc,

what forest/domain level is your MS-AD at? The WERR_DS_INCOMPATIBLE_VERSION message would imply that you are at level 2k22/2k25, right?

Regards,

Denis

[JMB]

Hello,

I realize I didn't provide the relevant information... Sorry,

our current domain comprises two Windows 2019 DCs with a functional level of "2016". The Samba server is also at 2016... Samba 4 is version 4.23.
The join command is: `samba-tool domain join mydomain -U administrator --realm=MYDOMAIN -W netbios name MYDOMAIN --option="ad dc functional level = 2016"`.

What I don't understand is why it worked on the first try (or almost) in June, and now it doesn't work at all! Probably a Windows update...
I think I finally found a solution last night:

I integrated Samba4 with the option '--backend-dns=NONE', then I installed and configured BIND according to your documentation on hybrid DNS. I ran `samba_dnsupdate`, and everything more or less set itself up automatically— the joys of the Microsoft world! Incomprehensible, but it seems to be working, so I immediately made a backup.

Again, congratulations on your documentation, even if perfection doesn't yet exist.

Thank you.

[dcardon]

Hi Jean-Marc,

glad things worked out for you.

Have you considered giving a presentation at the next JRES conference in Tours about your experience with Samba-AD ? Samba deserves to be better known!

Best regards,

Denis