User manual NOVELL OPEN ENTERPRISE SERVER 2.0 SP2 DOMAIN SERVICE FOR WINDOWS

[. . . ] novdocx (en) 7 January 2010 AUTHORIZED DOCUMENTATION Domain Services for Windows Administration Guide Novell® 2. 0 SP2 November 16 2009 Open Enterprise Server www. novell. com OES 2 SP2: Domain Services for Windows Administration Guide novdocx (en) 7 January 2010 Legal Notices Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. [. . . ] Solution: For any task that has failed, delete the associated objects from the server and then retry the task. For instance, if the DNS Configuration task failed, you need to delete the Locator object and the Group object ldapmodify Failed Cause: Replica synchronization fails. Solution: To resolve this issue, refer Novell Error Codes Reference Guide (http://www. novell. com/ documentation/nwec/?page=/documentation/nwec/nwec/data/al39nky. html) Establish Trust Cause This error occurs in cases where the parent realm could not be resolved 122 OES 2 SP2: Domain Services for Windows Administration Guide novdocx (en) 7 January 2010 Solution Use the provision -q -q --locate-dc parent. domain command to resolve the parent domain. Update Service Configuration Cause This error occurs in cases where the parent realm could not be resolved Solution Use the provision -q -q --locate-dc parent. domain command to resolve the parent domain. Cleanup Cause This error occurs in cases where the parent realm could not be resolved Solution Use the provision -q -q --locate-dc parent. domain command to resolve the parent domain. Retry executing the task. 7. 9 Executing Provisioning Tasks Manually For details on executing Provisioning tasks manually, see Executing Provisioning Tasks Manually Provisioning Domain Services for Windows 123 novdocx (en) 7 January 2010 124 OES 2 SP2: Domain Services for Windows Administration Guide novdocx (en) 7 January 2010 8 Verifying DSfW Installation 8 This section discusses details on verifying DSfW server after installing and provisioning. Section 8. 1, "Verifying the Installation, " on page 125 8. 1 Verifying the Installation Perform these tasks to verify that eDirectory and DSfW have been installed and configured correctly. NOTE: After you have installed a child domain or an subsequent domain controller, the DNS server running at forest root domain (or the DNS server you are pointing to in /etc/resolv. conf file) must be restarted. Execute the following command on the server hosting the Novell DNS service: rc-novell-named restart Check the /etc/hosts file to ensure that it contains only one entry with this server's primary IP address. For example: 192. 168. 1. 1 oesdc. dsfw. com oesdc Check the /etc/resolv. conf file to ensure that it contains a name server and domain search entry for server on which DNS is hosted. For example: nameserver 192. 168. 1. 1 search dsfw. com Verify that eDirectory has been properly configured by using the following command: /opt/novell/eDirectory/bin/ndsstat -h localhost This command returns information similar to the following: Tree Name: DSFW_TREE Server Name:. CN=OESDC. OU=OESSystemObjects. dc=dsfw. dc=com. T=DSFW_TREE Binary Version: 20217. 06 Root Most Entry Depth: 0 Product Version: eDirectory for Linux v8. 8 SP5 [DS] Execute xadcntrl validate at the terminal prompt. If the services are configured correctly, the result of the command will be similar to the following output: Verifying DSfW Installation 125 novdocx (en) 7 January 2010 Tree Name: DSFW-TREE Server Name: . CN=testfrd. OU=OESSystemObjects. dc=dsfw. dc=com. T=DSFW-TREE. Binary Version: 20501. 00 Root Most Entry Depth: 0 Product Version: eDirectory for Linux v8. 8 SP5 [DS] Checking for nameserver BIND number of zones: 2 debug level: 0 xfers running: 0 xfers deferred: 0 soa queries in progress: 0 query logging is OFF recursive clients: 0/1000 tcp clients: 0/100 server is up and running zone details are dumped at /var/opt/novell/log/named/named_zones. info Checking Checking Checking Checking running Checking Checking Checking Checking Checking Checking for for for for for for for for for for Name Service Cache Daemon: RPC Endpoint Mapper Service Kerberos KDC Service Kerberos Password Change Server Domain Services Daemon Samba NMB daemon Samba WINBIND daemon Samba SMB daemon service sshd rsync daemon: running running running running running running running running running Execute the following commands: kinit administrator rpcclient -k localhost ­c dsroledominfo If your server is configured correctly, you should see information similar to the following: Machine Role = [5] Directory Service is running. Domain is in native mode. 126 OES 2 SP2: Domain Services for Windows Administration Guide novdocx (en) 7 January 2010 9 Upgrading DSfW 9 This section provides information and links for upgrading DSfW to OES 2 SP2. Section 9. 1, "Upgrading DSfW to OES 2 SP2, " on page 127 Section 9. 2, "Upgrading from OES 1. 0 Linux, " on page 127 Section 9. 3, "Migrating Data to a Domain Services for Windows Server, " on page 127 Section 9. 4, "Limitations, " on page 128 9. 1 Upgrading DSfW to OES 2 SP2 To upgrade DSfW from OES 2 SP1 to OES 2 SP2, follow the process documented in the "Upgrading to OES 2" in the OES 2 SP2: Planning and Implementation Guide IMPORTANT: While running the upgrade process, make sure you first upgrade the first domain controller and then upgrade the additional domain controllers in that domain. 9. 1. 1 Prerequisite Before running the upgrade process, ensure that time is synchronized between all the servers in the replica ring. 9. 1. 2 Limitations After upgrading, you may encounter a Samba cache file corruption issue. Follow the instruction documented in "Error Mapping SID to UID" on page 211 to resolve the error. 9. 2 Upgrading from OES 1. 0 Linux In-place upgrade of an existing OES 1. 0 Linux server to a DSfW server is not supported. You must first install and configure a new OES 2 Linux server with DSfW, then migrate data from the existing OES 1. 0 NetWare or Linux server. 9. 3 Migrating Data to a Domain Services for Windows Server The migration of data to an OES 2 Linux server running DSfW is similar to any other data migration to OES 2 Linux: You should use the new OES 2 migration tools. When the source and destination servers are in the same eDirectoryTM tree, only the data and trustee rights are migrated. When the source and destination servers are in different eDirectory trees, the data and associated users are migrated. Upgrading DSfW 127 novdocx (en) 7 January 2010 For information on how to use the OES 2 migration tools for migrating data, see the OES 2 SP2: Migration Tool Administration Guide 9. 4 Limitations An error is seen in cases where the version of the forest root domain is OES 2 SP1 and you are attempting to install a subsequent domain controller of version OES 2 SP2. To resolve the error, see "No such Entry" on page 116. 128 OES 2 SP2: Domain Services for Windows Administration Guide novdocx (en) 7 January 2010 Running Domain Services for Windows in a Virtualized Environment 10 10 Domain Services for Windows runs in a virtualized environment just as it does on a physical Open Enterprise Server (OES) 2 Linux server and requires no special configuration or other changes. To get started with virtualization, see "Introduction to Xen Virtualization (http://www. novell. com/ documentation/sles10/xen_admin/data/sec_xen_basics. html)" in the Virtualization with Xen (http:// www. novell. com/documentation/sles10/xen_admin/data/bookinfo. html) guide. For information on setting up virtualized NetWare, see "Installing and Managing NetWare on a Xen-based VM" in the OES 2 SP2: Installation Guide guide. [. . . ] For example, if users in the eng. novell. com domain need to gain access to resources in the sales. novell. com domain, the novell. com domain must be traversed because it is on the trust path. You can create a shortcut trust between eng. novell. com and sales. novell. com, bypassing novell. com in the trust path. Trusted Domain Object A critical object that represents the trust relationship between the two domains. It directly relates to the trust relationships displayed in the Active Directory Domains and Trusts administrative tool. [. . . ]