Difference between revisions of "Joining a Windows Server 2012 / 2012 R2 DC to a Samba AD"

m (Fix link)
(Rewrote Windows Server 2012/2012 R2 DC to a Samba AD)
Line 1: Line 1:
 
= Introduction =
 
= Introduction =
  
== WARNING ==
+
Samba 4.5 introduces support for the directory schemas 56 (Windows Server 2012) and 67 (Windows Server 2012 R2). However, you cannot join the first Windows Server 2012 or 2012 R2 domain controller (DC) directly to a Samba Active Directory (AD), because it uses the Windows management instrumentation (WMI) protocol for several tasks during the process. To work around, you require a Windows Server 2008 or 2008 R2 DC in the domain to join the first 2012 or 2012 R2 DC. After the first DC with this Windows Server version is joined and the directory schema updated, you can this one as replication partner when you join other Windows 2012 or 2012 R2 DCs.
  
'''Samba based AD currently doesn't support joining a Microsoft Windows 2012/2012R2 Server <u>as a Domain Controller</u> to a Samba Active Directory! Joining as a Member Server works. Follow the [[Joining_a_Windows_Client_or_Server_to_a_Domain|respective documentation]].'''
+
'''Windows Server 2012 and 2012 R2 as a DC, and the directory schemas 56 and 67 are experimental.''' If you encounter a bug, please report at https://bugzilla.samba.org.
  
'''This documentation describes the necessary steps and workarounds required for this task. Because of the missing 2012/2012R2 AD schema support in Samba, the join will break your installation!'''
 
  
'''This documentation is for research and debugging only, until all problems and limitations are fixed!'''
 
  
'''Only use this documentation <u>in labs for testing purposes and not in production</u>, because this process will break replication and the AD database!!!'''
 
  
  
 +
= Warning =
  
== KNOWN LIMITATIONS ==
+
'''Joining a Windows Server 2012 or 2012 R2 DC to a Samba AD breaks the AD replication! Do not use this documentation until the problem is fixed!'''
 +
For more details, see [https://bugzilla.samba.org/show_bug.cgi?id=12204 Bug #12204].
  
* Samba is shipped with AD schema version 47 (Windows Server 2008 R2). To join a newer version as DC, this schema has to be updated to 56 (Windows Server 2012) or 69 (Windows Server 2012 R2). The Samba AD database backend currently doesn't support all the changes introduced by the new schemas. This would lead to broken replication between Samba and Windows DCs for the affected directory partitions, this cannot be fixed at the moment! '''In simple words: A broken replication makes the AD inconsistent and will destroy your AD!'''
 
  
* At least one [[Joining_a_Windows_Server_2008_/_2008_R2_DC_to_a_Samba_AD|Windows Server 2008 / 2008R2 DC]] is required in the domain, because 2012 replicates the AD content via WMI (Windows Management Instrumentation) from the Schema Master, this isn't implemented yet in Samba. This Windows DC must also have an accessible SysVol share, as 2012 syncronizes its content via DFS-R protocol („SysVol Replication“), which also isn't implemented in Samba yet.
 
  
  
  
== Server information ==
+
= Requirements and Known Limitations =
  
This documentation uses the following configuration/settings:
+
* All Samba DCs must run 4.5.0 or later. For information about updating, see [[Updating_Samba|Updating Samba]].
  
'''Existing Samba DCs in the domain:'''
+
* Windows Server 2012 and 2012 R2 requires the Windows management instrumentation (WMI) protocol during the join, and for the forest and domain preparation. Samba currently does not support this protocol. Thus you must have an existing Windows domain controller (DC) with WMI support in your domain. For example, you can a Windows Server 2008 or 2008 R2 DC as replication partner during the join. For further information, see [[Joining_a_Windows_Server_2008_/_2008_R2_DC_to_a_Samba_AD|Joining a Windows Server 2008 / 2008 R2 DC to a Samba AD]].
Domain Controllers:            DC1 (10.99.0.1), DC2 (10.99.0.2)
+
 
DCs act also as a DNS server:  yes
+
 
+
 
'''Existing Windows 2008R2 DC in the domain:'''
+
 
Domain Controller:            DC3 (10.99.0.3)
+
 
+
= Network Configuration =
'''Domain information:'''
+
 
DNS Domain Name:              samdom.example.com
+
* Click the "Start" button, search for "View network connections", and open the search entry.
NT4 Domain Name (NETBIOS):    SAMDOM
+
 
DNS Servers:                  10.99.0.1, 10.99.0.2
+
* Right-click to your network adapter and select "Properties".
Domain Administrator:          Administrator
 
Domain Administrator Password: passw0rd
 
 
'''DC additionally joined to the domain:'''
 
Hostname:                      DC4
 
IP Address:                    10.99.0.4
 
Operating System:              Microsoft Windows Server 2012 R2
 
  
 +
* Configure the IP settings:
 +
:* Assign a static IP address, enter the subnet mask, and default gateway.
 +
:* Enter the IP of a DNS server that is able to resolve the Active Directory (AD) DNS zone.
  
 +
* Click "OK" to save the settings.
  
  
  
= Installation / Preparation =
 
  
== General ==
 
  
* Install Windows Server 2012 / 2012 R2.
+
= Date and Time Settings =
  
 +
Active Directory uses Kerberos for authentication. Kerberos requires that the domain member and the domain controllers (DC) are having a synchronous time. If the difference exceeds [http://technet.microsoft.com/en-us/library/cc779260%28v=ws.10%29.aspx 5 minutes] (default), the client is not able to access domain resources for security reasons.
  
 +
Before you join the domain, check the time configuration:
  
== Date And Time Settings ==
+
* Open the "Control Panel".
  
Active Directory uses Kerberos for authentication, which relies on a fairly consistent time across the network. This makes it necessary, that, before you can join the client to the Domain, the time on the client does not differ more than [http://technet.microsoft.com/en-us/library/cc779260%28v=ws.10%29.aspx 5 minutes] (default setting in an AD) to your Domain Controller.
+
* Navigrate to "Clock, Language and Region".
  
* Search for „Network and Sharing Center“
+
* Click "Date and Time".
  
:[[Image:Join_Win2012R2_Search_Date_and_time_settings.png]]
+
* Verify the date, time, and time zone settings. Adjust the settings, if necessary.
  
* Check your date, time and time zone settings.
+
* Click "OK" to save the changes.
  
  
  
== Configure Network ==
 
  
* Search for „Network and Sharing Center“
 
  
:[[Image:Join_Win2012R2_Search_Network_Sharing_Center.png]]
+
= FSMO Roles =
  
* Click „Change adapter settings“
+
When you join the first Windows Server 2012 or 2012 R2 host as a domain controller (DC) to an Active Directory (AD) forest, the directory schema and the domain are updated. This update must run on a Windows 2008 or 2008 R2 domain controller (DC). For updating the forest and directory schema, transfer the following two flexible single master operation (FSMO) roles to the Windows DC that is already a domain member:
  
* Right-click to your network connection and choose „properties“
+
* Schema Master
 +
* Infrastructure Master
  
* Configure the IP properties. Make sure, that you use a DNS server, that is authoritative for your AD DNS domain!
+
To transfer the two FSMO roles to a Windows Server 2008 or 2008 R2 DC, see [[Transfering_and_Seizing_FSMO_Roles#Windows_FSMO_Role_Management|Transfering and Seizing FSMO_Roles]].
  
:[[Image:Join_Win2012R2_IP_Configuration.png]]
+
If you successfully updated the schema during the first Windows Server 2012 or 2012 R2 join, you can later transfer the roles to a Samba DC again.
  
 +
'''Note that this is a necesary requirement and the forest or domain preparation fails if a Samba DC holds one or both roles during the first Windows Server 2012 or 2012 R2 DC is joined!'''
  
  
  
  
== FSMO Roles ==
 
  
As mentioned in the [[#KNOWN_LIMITATIONS|KNOWN LIMITATIONS]] section, joining a Windows Server 2012 / 2012 R2 requires an AD schema update. Because the Samba AD database backend doesn't support these changes yet, it's neccessary that the involed Schema Master (forest) and the Infrastructure Master (domain) FSMO role are hold by an already joined Windows 2008 / 2008 R2 DC. This allows the update to proceed, but will irrevocable break the replication with all Samba DCs! <u>This is the main reason, why this documentation is not for usage in production environments!</u>
 
  
  
 +
= Installing the Active Directory Domain Services =
  
=== Schema Master FSMO Role ===
+
* Start the "Server Manager".
  
This step is a workaround, because since Server 2012, the DC promotion process uses WMI (Windows Management Instrumentation), to retrieve data from the Schema Master.
+
* Click "Add roles and features".
  
See the documentation about [[Transfering_and_Seizing_FSMO_Roles#Windows_FSMO_Role_Management|Windows GUI tools, to transfer the Schema Master role]].
+
* Select "Role-based or feature-based installation" and click "Next".
  
 +
* Click "Select a server from the server pool" and select the local Windows Server from the list. Click "Next".
  
 +
* Select "Active Directory Domain Services", including all dependencies. Click "Next".
  
=== Infrastructure Master FSMO Role ===
+
* You do not need to select any additional features. Click "Next".
  
This workaround is required, because after updating the schema on the Schema Master of the forest, the Infrastructure Master is involved when preparing the domain for the new schema. Because after the schema update - what will break the replication with Samba DCs - it wouldn't be possible to do the preparation against a Samba DC any more.
+
* Start the installation.
  
See the documentation about [[Flexible_Single-Master_Operations_(FSMO)_roles#FSMO_role_management_using_the_Windows_GUI|Windows GUI tools, to transfer the Infrastructure Master role]].
+
* Click "Close".
  
  
  
  
= Installation: Active Directory Domain Services =
 
  
The folling steps have to executed on the 2012 / 2012 R2 host, that should be joined as a DC later. Do this locally on this host or use RSAT on Windows 8 / 8.1 to execute the commands remotely.
+
= Joining the Windows Server to the Domain =
  
* Open the Server Manager
+
* Log in to your Windows Server 2012 or 2012 installation using the local administrator account.
  
* Click „Add roles and features“
+
* Start the "Server Manager".
  
:[[Image:Join_Win2012R2_Server_Manager.png]]
+
* Click the notifier icon on the top navigation bar and click "Promote this server to a domain controller".
  
* Choose „Role-based or feature-based installation“. Click „Next“.
+
:[[Image:Join_Win2012R2_Server_Manager_Post_Deployment.png]]
  
* „Select a server from the server pool“ and choose the Windows Server out of the list, where to install the AD DC features. Click „Next“.
+
* Select "Add a domain controller to an existing domain", enter the Samba Active Directory (AD) domain name and credentials that are enabled to join a domain controller (DC) to the domain, like the domain administrator account. Click "Next".
  
* Choose „Active Directory Domain Services“ from the list, including all dependencies. Click „Next“.
+
* Select the options to enable on the new DC and enter the directory services restore mode (DSRM) password. It is required to boot the Windows DC in safe-mode to restore or repair the AD in case of problems. Click "Next".  
  
* Add additional features, if wanted. Click „Next“.
+
:[[Image:Join_Win2012R2_DS_Wizzard_Page2.png]]
  
* Start the installation
+
* If you enabled the "DNS server" option in the previous step, you may see a note, that a delegation for this DNS server cannot be created. Click "Next".
  
* Click „Close“, after the installation is finished.
+
* Samba currently does not support schema replication using the Windows management instrumentation (WMI) protocol. For this reason, select an existing Windows Domain Controller in the domain as replication source and click "Next".
  
 +
:[[Image:Join_Win2012R2_DS_Wizzard_Page3.png]]
  
 +
* Set the folders for the AD database, log files and the Sysvol folder. Click "Next".
  
 +
* Click "Next" to confirm the operations, Windows is going to perform.
  
 +
* Verify your settings and click "Next" to start the prerequisite check.
  
= Updating the schema =
+
* Windows runs some prerequisites checks. If any errors are displayed, fix them before you continue. Click "Install".
  
'''WARNING: This steps will break your Samba AD! Only do this in a lab environment for testing purposes!'''
+
* The DC promotions begins.
  
The following steps have to be executed on the Windows 2008/2008 R2 DC, that owns the Schema Master and Infrastructure Master role:
+
: If this is the first Windows Server 2012 or 2012 R2 DC in your AD forest:
 +
: '''Warning: This step breaks the AD directory replication!''' For more details, see [[#Warning|Warning]].
 +
: The installation wizzard is only able to run the AD forest preparation. The domain preparation step fails. To work around:
  
* Log into the existing 2008 / 2008 R2 DC, using an account, that is member of the universal groups „Schema Admins“ and „Enterprise Admins“.
+
:* Log in using the domain administrator account to your existing Windows Server 2008 or 2008 R2 installation that owns the "Schema Master" and the "Infrastructure Master" flexible single master operation (FSMO) role.
  
* Insert the Windows 2012 / 2012 R2 Installation DVD
+
:* Insert the Windows Server 2012 or Windows 2012 R2 installation DVD.
  
* Open a commandline and navigate into the following folder (assuming D: is your DVD drive with the 2012 / 2012 R2 installation DVD)
+
:* Open a command line and change to the "support\adprep" folder on the installation DVD. For example, if you DVD drive is "D":
  
 
  > D:
 
  > D:
  > cd support/adprep
+
  > cd support\adprep\
 +
 
 +
:* Start the domain preparation:
 +
 
 +
> adprep /domainprep
  
:[[Image:Join_Win2012R2_Adprep_DVD.png]]
+
:* You see the following message if the preparation succeeds:
  
* Start the forest preparation (schema update on forest level) by executing
+
Adprep successfully updated the domain-wide information.
  
> adprep.exe /forestprep
+
:* Restart the [[#Joining_the_Windows_Server_to_the_Domain|Joining the Windows Server to the Domain]] process.
  
:[[Image:Join_Win2012R2_Adprep_Forestprep.png]]
+
* If the wizzard completes successfully, the Windows server is restarted automatically.
:A successful run should end with the message
 
  
Adprep successfully updated the forest-wide information.
+
* Verify that all DC related DNS records have been created during the promotion. See [[Verifying and Creating a DC DNS Record|Verifying and Creating a DC DNS Record]].
 +
: '''Do not continue without checking the DNS records. They must exist for a working directory replication!'''
  
:'''After this step the replication between Windows and Samba DCs is broken!'''. On Samba DCs, this can be seen for all inbound connections from Windows DCs. Example:
 
  
# samba-tool drs showrepl
 
.....
 
CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
 
        Default-First-Site-Name\DC3 via RPC
 
                DSA object GUID: 691da691-4996-49a0-b5d8-347111d4aa5d
 
                Last attempt @ Sat Dec 20 18:20:14 2014 CET <u>failed, result 1359 (WERR_INTERNAL_ERROR)</u>
 
                28 consecutive failure(s).
 
                Last success @ Sat Dec 20 18:15:14 2014 CET
 
  
* Continue executing the domain preparation. There should be no output and only a success message:
 
  
:[[Image:Join_Win2012R2_Adprep_Domainprep.png]]
 
  
:This step will fail, if the Infrastructure Master role wasn't transfered to a Windows host, <u>before</u> updating the schema. In the domain preparation, the Infrastructure Master is involeved. And because of the broken replication after preparing the forest, the changes won't reached the Samba DCs. That's why the domainprep step can't be executed against a Samba DC any more!
+
= Verifying the Directory Replication =
  
 +
A few minutes after the domain controller (DC) started, the connections with all other DCs are automatically established and the replication begins.
  
 +
To verify the directory replication, run on a Samba DC:
  
 +
# samba-tool drs showrepl
 +
Default-First-Site-Name\SAMBADC
 +
DSA Options: 0x00000001
 +
DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
 +
DSA invocationId: 96bc0d6f-9cea-4011-b9a1-0e9971009b20
 +
 +
==== INBOUND NEIGHBORS ====
 +
 
 +
DC=DomainDnsZones,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ NTTIME(0) was successful
 +
                0 consecutive failure(s).
 +
                Last success @ NTTIME(0)
 +
 +
DC=DomainDnsZones,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ NTTIME(0) was successful
 +
                0 consecutive failure(s).
 +
                Last success @ NTTIME(0)
 +
 +
DC=ForestDnsZones,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ NTTIME(0) was successful
 +
                0 consecutive failure(s).
 +
                Last success @ NTTIME(0)
 +
 +
DC=ForestDnsZones,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ NTTIME(0) was successful
 +
                0 consecutive failure(s).
 +
                Last success @ NTTIME(0)
 +
 +
DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ Sat Dec 20 10:35:09 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:09 2014 CET
 +
 +
DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ Sat Dec 20 10:35:09 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:09 2014 CET
 +
 +
CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ Sat Dec 20 10:35:10 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:10 2014 CET
 +
 +
CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ Sat Dec 20 10:35:10 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:10 2014 CET
 +
 +
CN=Configuration,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ Sat Dec 20 10:35:11 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:11 2014 CET
 +
 +
CN=Configuration,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ Sat Dec 20 10:35:11 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:11 2014 CET
 +
 +
==== OUTBOUND NEIGHBORS ====
 +
 +
DC=DomainDnsZones,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ Sat Dec 20 10:35:17 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:17 2014 CET
 +
 +
DC=DomainDnsZones,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ Sat Dec 20 10:35:17 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:17 2014 CET
 +
 
 +
DC=ForestDnsZones,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ Sat Dec 20 10:35:17 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:17 2014 CET
 +
 +
DC=ForestDnsZones,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ Sat Dec 20 10:35:17 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:35:17 2014 CET
 +
 +
DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ Sat Dec 20 10:34:26 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:34:26 2014 CET
 +
 +
DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ Sat Dec 20 10:34:26 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:34:26 2014 CET
 +
 
 +
CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ Sat Dec 20 10:34:26 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:34:26 2014 CET
 +
 +
CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ Sat Dec 20 10:34:26 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:34:26 2014 CET
 +
 +
CN=Configuration,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2008R2DC via RPC
 +
                DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
 +
                Last attempt @ Sat Dec 20 10:34:21 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:34:21 2014 CET
 +
 +
CN=Configuration,DC=samdom,DC=example,DC=com
 +
        Default-First-Site-Name\Win2012R2DC via RPC
 +
                DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
                Last attempt @ Sat Dec 20 10:34:21 2014 CET was successful
 +
                0 consecutive failure(s).
 +
                Last success @ Sat Dec 20 10:34:21 2014 CET
 +
 +
==== KCC CONNECTION OBJECTS ====
 +
 +
Connection --
 +
        Connection name: f55bce90-d458-400a-a4ca-801c3e64bef3
 +
        Enabled        : TRUE
 +
        Server DNS name : Win2008R2DC.samdom.example.com
 +
        Server DN name  : CN=NTDS Settings,CN=Win2008R2DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
 +
                TransportType: RPC
 +
                options: 0x00000001
 +
Warning: No NC replicated for Connection!
 +
Connection --
 +
Connection name: fb03f58b-1654-4a02-8e11-f0ea120b60cc
 +
Enabled        : TRUE
 +
Server DNS name : Win2012R2DC.samdom.example.com
 +
Server DN name  : CN=NTDS Settings,CN=Win2012R2DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
 +
TransportType: RPC
 +
options: 0x00000001
 +
Warning: No NC replicated for Connection!
  
 +
It can take several minutes until all connections are established. If the connections on existing Samba DCs to the Windows DC are not established within 15 minutes, start the replication manually. For details, see [[Samba-tool_drs_replicate|samba-tool drs replicate]].
  
= Promote Windows Server 2012 / 2012 R2 to a Domain Controller =
+
If you are seeing the warning "No NC replicated for Connection!", see [[FAQ#Message:_Warning:_No_NC_replicated_for_Connection.21|FAQ: Warning: No NC replicated for Connection!]].
  
The following steps are executed on the 2012 / 2012 R2 host, that should be joined as a DC to the domain:
 
  
* In the Server Manager, click the notify icon, that indicates a outstanding „Post-deployment Configuration“ task and choose „Promote this server to a domain controller“.
 
  
:[[Image:Join_Win2012R2_Server_Manager_Post_Deployment.png]]
+
== Testing the Directory Replication ==
  
* Select „Add a domain controller to an existing domain“, enter the domain name and credentials, that are allowed to join a DC to the domain. Afterwards click „Next“
+
To test that the directory replication works correctly, add for example a user on an existing DC and verify that it shows up automatically on the new promoted Windows DC.
  
:[[Image:Join_Win2012R2_DS_Wizzard_Page1.png]]
 
  
* Set the Domain Controller capabilities, site information and the Directory Service Restore Mode password. The DSRM passwort is used to boot the Windows DC in a safe-mode, to restore or repair the AD. We assume here, to install the new DC with „DNS server“ and „Global catalog“. To continue, choose „Next“.
 
  
:[[Image:Join_Win2012R2_DS_Wizzard_Page2.png]]
 
  
* If you receive a message, that a delegation for this DNS server cannot be created, ignore it and continue with „Next“.
 
  
* Choose a Windows (!) Domain Controller to replicate from. This is necessary, because the schema is replicated via WMI and the SysVol content via FRS. Both is not supported by Samba yet. Click „Next“ to continue.
+
= The Sysvol Share =
  
:[[Image:Join_Win2012R2_DS_Wizzard_Page3.png]]
+
During the join, Windows tries to replicate the Sysvol directory content from an existing domain controller (DC). Samba currently does not support the DFS-R protocol. For this reason, the new DC may not show a "Sysvol" share. To enable the share:
  
* Adapt the folder locations, if desired. Click „Next“.
+
* Save the following content to a plain text file named "Win-Create-Sysvol-Share.reg" using a text editor like "Notepad" or "Editor" (not Word/Wordpad/OpenOffice/LibreOffice/etc.):
  
:[[Image:Join_Win2012R2_DS_Wizzard_Page4.png]]
+
Windows Registry Editor Version 5.00
 +
 +
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]
 +
 +
"SysvolReady"=dword:00000001
  
* Review your settings. Click „Next“.
+
* Log in using an account that is member of the local "Administrators" group.
  
* Windows executes some prerequisites checks. While warnings are Ok, any errors have to be solved, before you can continue. Click „Install“, to begin the DC promotion.
+
* Double-click the file to import it to the Windows registry.  
  
:[[Image:Join_Win2012R2_DS_Wizzard_Page5.png]]
+
* Reboot to take the changes effect.  
  
:Notice: During the join of the first 2012 / 2012 R2 DC in a forest, the schema is updated, if it wasn't done [[#Updating_the_schema|before]]. The automatic update during the join would fail in a Samba / Windows mixed envionment. That's why we [[#Updating_the_schema|had updated the schema before]].
 
  
* The DC promotions begins. If the wizzard finishes its work successful, a message is shown for a short moment, before the new DC automatically reboots.
 
  
:[[Image:Join_Win2012R2_DS_Wizzard_Page6.png]]
+
== Sysvol replication ==
  
* After the reboot, you can log into the new joined Windows Server 2012 / 2012 R2 Domain Controller.
+
Samba currently does not support the DFS-R protocol required for Sysvol replication. Please manually synchronise the content between DC or use a workaround like [[Robocopy_based_SysVol_replication_workaround|Robocopy-based Sysvol Replication]].

Revision as of 17:57, 6 September 2016

Introduction

Samba 4.5 introduces support for the directory schemas 56 (Windows Server 2012) and 67 (Windows Server 2012 R2). However, you cannot join the first Windows Server 2012 or 2012 R2 domain controller (DC) directly to a Samba Active Directory (AD), because it uses the Windows management instrumentation (WMI) protocol for several tasks during the process. To work around, you require a Windows Server 2008 or 2008 R2 DC in the domain to join the first 2012 or 2012 R2 DC. After the first DC with this Windows Server version is joined and the directory schema updated, you can this one as replication partner when you join other Windows 2012 or 2012 R2 DCs.

Windows Server 2012 and 2012 R2 as a DC, and the directory schemas 56 and 67 are experimental. If you encounter a bug, please report at https://bugzilla.samba.org.



Warning

Joining a Windows Server 2012 or 2012 R2 DC to a Samba AD breaks the AD replication! Do not use this documentation until the problem is fixed! For more details, see Bug #12204.



Requirements and Known Limitations

  • All Samba DCs must run 4.5.0 or later. For information about updating, see Updating Samba.
  • Windows Server 2012 and 2012 R2 requires the Windows management instrumentation (WMI) protocol during the join, and for the forest and domain preparation. Samba currently does not support this protocol. Thus you must have an existing Windows domain controller (DC) with WMI support in your domain. For example, you can a Windows Server 2008 or 2008 R2 DC as replication partner during the join. For further information, see Joining a Windows Server 2008 / 2008 R2 DC to a Samba AD.



Network Configuration

  • Click the "Start" button, search for "View network connections", and open the search entry.
  • Right-click to your network adapter and select "Properties".
  • Configure the IP settings:
  • Assign a static IP address, enter the subnet mask, and default gateway.
  • Enter the IP of a DNS server that is able to resolve the Active Directory (AD) DNS zone.
  • Click "OK" to save the settings.



Date and Time Settings

Active Directory uses Kerberos for authentication. Kerberos requires that the domain member and the domain controllers (DC) are having a synchronous time. If the difference exceeds 5 minutes (default), the client is not able to access domain resources for security reasons.

Before you join the domain, check the time configuration:

  • Open the "Control Panel".
  • Navigrate to "Clock, Language and Region".
  • Click "Date and Time".
  • Verify the date, time, and time zone settings. Adjust the settings, if necessary.
  • Click "OK" to save the changes.



FSMO Roles

When you join the first Windows Server 2012 or 2012 R2 host as a domain controller (DC) to an Active Directory (AD) forest, the directory schema and the domain are updated. This update must run on a Windows 2008 or 2008 R2 domain controller (DC). For updating the forest and directory schema, transfer the following two flexible single master operation (FSMO) roles to the Windows DC that is already a domain member:

  • Schema Master
  • Infrastructure Master

To transfer the two FSMO roles to a Windows Server 2008 or 2008 R2 DC, see Transfering and Seizing FSMO_Roles.

If you successfully updated the schema during the first Windows Server 2012 or 2012 R2 join, you can later transfer the roles to a Samba DC again.

Note that this is a necesary requirement and the forest or domain preparation fails if a Samba DC holds one or both roles during the first Windows Server 2012 or 2012 R2 DC is joined!




Installing the Active Directory Domain Services

  • Start the "Server Manager".
  • Click "Add roles and features".
  • Select "Role-based or feature-based installation" and click "Next".
  • Click "Select a server from the server pool" and select the local Windows Server from the list. Click "Next".
  • Select "Active Directory Domain Services", including all dependencies. Click "Next".
  • You do not need to select any additional features. Click "Next".
  • Start the installation.
  • Click "Close".



Joining the Windows Server to the Domain

  • Log in to your Windows Server 2012 or 2012 installation using the local administrator account.
  • Start the "Server Manager".
  • Click the notifier icon on the top navigation bar and click "Promote this server to a domain controller".
Join Win2012R2 Server Manager Post Deployment.png
  • Select "Add a domain controller to an existing domain", enter the Samba Active Directory (AD) domain name and credentials that are enabled to join a domain controller (DC) to the domain, like the domain administrator account. Click "Next".
  • Select the options to enable on the new DC and enter the directory services restore mode (DSRM) password. It is required to boot the Windows DC in safe-mode to restore or repair the AD in case of problems. Click "Next".
Join Win2012R2 DS Wizzard Page2.png
  • If you enabled the "DNS server" option in the previous step, you may see a note, that a delegation for this DNS server cannot be created. Click "Next".
  • Samba currently does not support schema replication using the Windows management instrumentation (WMI) protocol. For this reason, select an existing Windows Domain Controller in the domain as replication source and click "Next".
Join Win2012R2 DS Wizzard Page3.png
  • Set the folders for the AD database, log files and the Sysvol folder. Click "Next".
  • Click "Next" to confirm the operations, Windows is going to perform.
  • Verify your settings and click "Next" to start the prerequisite check.
  • Windows runs some prerequisites checks. If any errors are displayed, fix them before you continue. Click "Install".
  • The DC promotions begins.
If this is the first Windows Server 2012 or 2012 R2 DC in your AD forest:
Warning: This step breaks the AD directory replication! For more details, see Warning.
The installation wizzard is only able to run the AD forest preparation. The domain preparation step fails. To work around:
  • Log in using the domain administrator account to your existing Windows Server 2008 or 2008 R2 installation that owns the "Schema Master" and the "Infrastructure Master" flexible single master operation (FSMO) role.
  • Insert the Windows Server 2012 or Windows 2012 R2 installation DVD.
  • Open a command line and change to the "support\adprep" folder on the installation DVD. For example, if you DVD drive is "D":
> D:
> cd support\adprep\
  • Start the domain preparation:
> adprep /domainprep
  • You see the following message if the preparation succeeds:
Adprep successfully updated the domain-wide information.
  • If the wizzard completes successfully, the Windows server is restarted automatically.
Do not continue without checking the DNS records. They must exist for a working directory replication!



Verifying the Directory Replication

A few minutes after the domain controller (DC) started, the connections with all other DCs are automatically established and the replication begins.

To verify the directory replication, run on a Samba DC:

# samba-tool drs showrepl
Default-First-Site-Name\SAMBADC
DSA Options: 0x00000001
DSA object GUID: 4a6bd92a-6612-4b15-aa8c-9ec371e8994f
DSA invocationId: 96bc0d6f-9cea-4011-b9a1-0e9971009b20

==== INBOUND NEIGHBORS ====
 
DC=DomainDnsZones,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ NTTIME(0) was successful
               0 consecutive failure(s).
               Last success @ NTTIME(0)

DC=DomainDnsZones,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ NTTIME(0) was successful
               0 consecutive failure(s).
               Last success @ NTTIME(0)

DC=ForestDnsZones,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ NTTIME(0) was successful
               0 consecutive failure(s).
               Last success @ NTTIME(0)

DC=ForestDnsZones,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ NTTIME(0) was successful
               0 consecutive failure(s).
               Last success @ NTTIME(0)

DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ Sat Dec 20 10:35:09 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:09 2014 CET

DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ Sat Dec 20 10:35:09 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:09 2014 CET

CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ Sat Dec 20 10:35:10 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:10 2014 CET

CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ Sat Dec 20 10:35:10 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:10 2014 CET

CN=Configuration,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ Sat Dec 20 10:35:11 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:11 2014 CET

CN=Configuration,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ Sat Dec 20 10:35:11 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:11 2014 CET

==== OUTBOUND NEIGHBORS ====

DC=DomainDnsZones,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ Sat Dec 20 10:35:17 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:17 2014 CET

DC=DomainDnsZones,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ Sat Dec 20 10:35:17 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:17 2014 CET
 
DC=ForestDnsZones,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ Sat Dec 20 10:35:17 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:17 2014 CET

DC=ForestDnsZones,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ Sat Dec 20 10:35:17 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:35:17 2014 CET

DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ Sat Dec 20 10:34:26 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:34:26 2014 CET

DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ Sat Dec 20 10:34:26 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:34:26 2014 CET
 
CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ Sat Dec 20 10:34:26 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:34:26 2014 CET

CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ Sat Dec 20 10:34:26 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:34:26 2014 CET

CN=Configuration,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2008R2DC via RPC
               DSA object GUID: dfaec3fb-7546-4153-ba01-605e5efa27f9
               Last attempt @ Sat Dec 20 10:34:21 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:34:21 2014 CET

CN=Configuration,DC=samdom,DC=example,DC=com
       Default-First-Site-Name\Win2012R2DC via RPC
               DSA object GUID: fb03f58b-1654-4a02-8e11-f0ea120b60cc
               Last attempt @ Sat Dec 20 10:34:21 2014 CET was successful
               0 consecutive failure(s).
               Last success @ Sat Dec 20 10:34:21 2014 CET

==== KCC CONNECTION OBJECTS ====

Connection --
       Connection name: f55bce90-d458-400a-a4ca-801c3e64bef3
       Enabled        : TRUE
       Server DNS name : Win2008R2DC.samdom.example.com
       Server DN name  : CN=NTDS Settings,CN=Win2008R2DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
               TransportType: RPC
               options: 0x00000001
Warning: No NC replicated for Connection!
Connection --
	Connection name: fb03f58b-1654-4a02-8e11-f0ea120b60cc
	Enabled        : TRUE
	Server DNS name : Win2012R2DC.samdom.example.com
	Server DN name  : CN=NTDS Settings,CN=Win2012R2DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
		TransportType: RPC
		options: 0x00000001
Warning: No NC replicated for Connection!

It can take several minutes until all connections are established. If the connections on existing Samba DCs to the Windows DC are not established within 15 minutes, start the replication manually. For details, see samba-tool drs replicate.

If you are seeing the warning "No NC replicated for Connection!", see FAQ: Warning: No NC replicated for Connection!.


Testing the Directory Replication

To test that the directory replication works correctly, add for example a user on an existing DC and verify that it shows up automatically on the new promoted Windows DC.



The Sysvol Share

During the join, Windows tries to replicate the Sysvol directory content from an existing domain controller (DC). Samba currently does not support the DFS-R protocol. For this reason, the new DC may not show a "Sysvol" share. To enable the share:

  • Save the following content to a plain text file named "Win-Create-Sysvol-Share.reg" using a text editor like "Notepad" or "Editor" (not Word/Wordpad/OpenOffice/LibreOffice/etc.):
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters]

"SysvolReady"=dword:00000001
  • Log in using an account that is member of the local "Administrators" group.
  • Double-click the file to import it to the Windows registry.
  • Reboot to take the changes effect.


Sysvol replication

Samba currently does not support the DFS-R protocol required for Sysvol replication. Please manually synchronise the content between DC or use a workaround like Robocopy-based Sysvol Replication.