Description Arvid Requate 2016-01-25 14:18:18 CET

Created attachment 7429 [details]
move_cn_system_dns_zones.sh

There have been two reported cases where DNS records in the _msdcs zone were not resolvable after an AD takeover (e.g. Ticket#: 2015121721000414).

In this situation /var/log/syslog shows the following messages:
============================================================
Jan 18 20:00:48 master named[7097]: samba_dlz: trying partition 'CN=MicrosoftDNS,CN=System,DC=foo,DC=local'
Jan 18 20:00:48 master named[7097]: samba_dlz: configured writeable zone '1.168.192.in-addr.arpa'
Jan 18 20:00:48 master named[7097]: samba_dlz: pre-W2k3 zone found
============================================================

The message "pre-W2k3 zone found" shows, that the dlz_bind9 module found a DNS zone in Samba/AD below the DN 'CN=MicrosoftDNS,CN=System,DC=foo,DC=local'. In cases like these the C code ignores _msdcs zones located below other partitions, like DC=ForestDnsZones:
============================================================
Jan 18 20:00:48 master named[7097]: samba_dlz: Ignoring dnsZone _msdcs.foo.local
============================================================

As a first step the attached script may be used to fix this issue manually. It searches for '(&(objectClass=dnsZone)(!(dc=RootDNSServers)))' below CN=System.