Bug 35443 - AD Takeover vs. AD Recycle bin Feature
AD Takeover vs. AD Recycle bin Feature
Product: UCS
Classification: Unclassified
Component: Samba4
UCS 3.2
Other Linux
: P5 normal (vote)
: UCS 3.2-3-errata
Assigned To: Arvid Requate
Felix Botner
Depends on:
Blocks: 36216
  Show dependency treegraph
Reported: 2014-07-23 09:23 CEST by Felix Botner
Modified: 2014-10-22 16:07 CEST (History)
5 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted after Product Owner Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Fix for error in handling deleted entries in repl_meta_data LDB module (646 bytes, patch)
2014-08-05 11:12 CEST, Ivo van Geel
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Felix Botner univentionstaff 2014-07-23 09:23:59 CEST
The samba join to the AD domain fails if the Recycle bin Feature is activated in AD, at least if there is one "recycled" object:

2014-06-12 18:22:09,103 Failed to apply linked attribute change
'attribute 'isRecycled': invalid modify flags on 'CN=NTDS
2014-06-12 18:22:09,103 dn:

I found no way to delete this object in AD, but there is a script in the samba source tree source4/scripting/bin/enablerecyclebin to activate Recycle bin in Samba, maybe we have to run this during the takeover

To activate this Feature in AD, see

discussion about a similar problem:
Comment 1 Arvid Requate univentionstaff 2014-07-23 11:08:29 CEST
We need to test if this also happens with Windows 2008 (R2). If not then this would be duplicate of Bug 28913.
Comment 2 Arvid Requate univentionstaff 2014-07-24 17:51:50 CEST

> For the recycle bin feature we found some information to delete/clean this:
> http://blogs.technet.com/b/ad/archive/2009/03/24/taking-out-the-trash.aspx
> [...]
> Performing the actions in the article (changing the tombstone lifetime
> to 3 days and forcing a garbage collection run) does indeed help to
> perform the AD takeover process.
> The only problem is that when the ad-takeover fails, for whatever
> reason, a new item is added into the AD recycle bin (being the
> Univention DC server), so you can only try again after 3 days (minimal
> tombstone value).
Comment 3 Ivo van Geel 2014-08-05 11:12:30 CEST
Created attachment 6054 [details]
Fix for error in handling deleted entries in repl_meta_data LDB module
Comment 4 Ivo van Geel 2014-08-05 11:20:27 CEST

I found (and fixed) the problem with performing an AD-takeover with items in the AD recyclebin. There was an error in creating an array with search parameters, caused the Deleted items to not be detected. The included patch fixes the problems I had in my test-environment.

After applying the patch, the ad-takeover was completed succesfully.
Comment 5 Arvid Requate univentionstaff 2014-08-20 19:58:31 CEST
Ok, the proposed patch will be in UCS 4.0-0 as it has been committed upstream:

( discussed here https://bugzilla.samba.org/show_bug.cgi?id=10294 ).

We still need to QA if the takeover succeeds.
Comment 6 Arvid Requate univentionstaff 2014-08-28 12:08:53 CEST
Retagged for errata3.2-3
Comment 7 Arvid Requate univentionstaff 2014-09-08 11:12:56 CEST
Samba has been rebuilt with the upstram 98_fix_join_with_recycle_bin.patch.
Comment 8 Felix Botner univentionstaff 2014-09-09 14:28:14 CEST
OK - 3.2-3

Comment 9 Janek Walkenhorst univentionstaff 2014-09-10 17:47:02 CEST
Comment 10 Janek Walkenhorst univentionstaff 2014-10-22 16:07:31 CEST