I've to fix this situation soon and need your advice:
Environment is now: 2 old gentoos with never patched Samba AD's of the old 4.2.x generation. The DC do use the bind service as DNS and the domain is provisioned with the --use-rfc2307 flag.
Environment should be: 2 CentOS 7.6 VM's with self compiled Samba packages of the latest generation (4.9.4 today), without the usage of the bind dns and instead the samba internal dns server. No --use-rfc2307 provisioning
Idea how I do it:
- Make a backup of the old domain
- Join the 2 new DC's
- transfer all fsmos and fix the forest+domain DNS Zones (ldif hack)
- test the connection from a server
- switch off the old DC's forever
Questions to the board:
- Can I mix the DC's with the actuall version and the old one ??? I can't update the old ones because the gentoo system is totally messed up.
- Can I mix the dns ? I really want to get rid off the bind dns. But bases on the limitations sections of the samba wiki say, the internal is for simple setups and the bind one for complex scenarios. However, I have 1 domain and multiple subnets...in our network is another real bind for everything else that should be the forwarder. The goal is to get rid off the old DC's without any hassle.
- I've no idea why we use --use-rfc2307. We use around 24 Linux servers with various services. The login from the linux servers is done by ldap query and no kerberos...I want to fix that. Aside the server we use ca. 35 Windows 7 and 10 Clients and 1 2012r2 Server