Re: Attribut msDS-KeyCredentialLink is missing

On Fri, 12 Jun 2026 06:10:13 +0000
Bruno MOREL <[email protected]> wrote:

> Hello,
> Well, I have trying to upgrade manually the schema with the file
> AD_DS_Attributes_Windows_Server_2016.ldf and I have an error. I think
> it is for that the upgrade doesn't pass... :
> 
> # samba-tool domain schemaupgrade
> --ldf-file=/usr/share/samba/setup/ad-schema/AD_DS_Attributes__Windows_Server_2016.ldf
> -v Applying
> /usr/share/samba/setup/ad-schema/AD_DS_Attributes__Windows_Server_2016.ldf
> updates..
>                                    . Exception: 'utf-8' codec can't
> decode byte 0x92 in position 854: invalid start byte Error
> encountered, aborting schema upgrade ERROR: Failed to upgrade schema
> 
> 

OK, I am now officially at a loss, I installed Debian 13 in a VM, added
the Tranquil IT Samba 4.24 repo and installed Samba and provisioned it
as a new AD domain, checking the functional level returned '2008 R2'

So I attempted to upgrade the schema and got 'No changes applied to
schema'
Not surprising, because when I checked the schema version, it was '88',
so I checked for 'msDS-KeyCredentialLink' in AD and it was there.

So I attempted to raise the functional level, the first command:

sudo samba-tool domain functionalprep --function-level=2016

Gave me lots of 'Skip Forest Update' lines, so I moved onto the next
command:

sudo samba-tool domain level raise --domain-level=2016
--forest-level=2016

Which returned:

Domain function level changed!
Forest function level changed!
All changes applied successfully!

Added 'ad dc functional level = 2016' to the DCs smb.conf file and
restarted Samba.

sudo samba-tool domain level show
Now shows:
Domain and forest function level for domain 'DC=ad,DC=home,DC=arpa'

Forest function level: (Windows) 2016
Domain function level: (Windows) 2016
Lowest function level of a DC: (Windows) 2016

Or to put it another way, it works for me.

Rowland


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba