This is the procedure to upgrade the Active Directory schema and functional level of a Samba AD domain. You will typically do this after upgrading Samba to a new major version that supports a higher functional level.
Backup your Samba AD domain first! Irreversible changes will be made to the domain — once the schema is upgraded, you cannot go back.
samba-tool domain backup online --targetdir=/backup/schema-upgrade --server=dc1 -U "MAD\Administrator"
Upgrade Samba to at least 4.20.0 on all DCs. This is required, as older versions do not support `ad dc functional level = 2016` or schema 2019.
Install `patch` on the DC where you run `samba-tool domain schemaupgrade` (you only need it on that DC):
apt-get install patch
Add this parameter to the `[global]` section of `/etc/samba/smb.conf` on every Samba AD DC:
ad dc functional level = 2016
This enables the internal logic in Samba to operate at functional level 2016, which allows the domain to use new features and improves compatibility with modern Windows clients.
Restart the Samba service on all DCs:
systemctl restart samba-ad-dc.service
Now run the following commands — these will upgrade the Active Directory schema and domain functional level.
The schema defines which objects and attributes exist in AD. Functional level controls which AD features are available.
samba-tool domain schemaupgrade --schema=2019 samba-tool domain functionalprep --function-level=2016 samba-tool domain level raise --domain-level=2016 --forest-level=2016
Explanation:
You can verify the current levels with:
samba-tool domain level show
After changing schema and functional level, it is good practice to check the AD database for errors:
samba-tool dbcheck --cross-ncs --fix --yes
You may have to run this command twice to fully fix any errors.
Typical errors you may see:
After raising the schema and functional level, you should expect to see a large number of changes to be propagated across your AD domain. This is normal, especially if you run `samba-tool visualize uptodateness` shortly after completing the upgrade.
Example output after schema upgrade:
samba-tool visualize uptodateness -rS --utf8
DOMAIN
out-of-date-ness
╭───────────────── CN=DC2+
│ ╭───────────── CN=DC3+
│ │ ╭───────── CN=DC4+
DC │ │ │ ╭───── CN=DC1+
CN=DC2+ · 3 0 0
CN=DC3+ 0 · 0 0
CN=DC4+ 0 0 · 0
CN=DC1+ 432 432 432 ·
'+' stands for ',CN=Servers,CN=default,CN=Sites,CN=Configuration,DC=mad,DC=caponato,DC=es'
CONFIGURATION
out-of-date-ness
╭───────────────── CN=DC2+
│ ╭───────────── CN=DC3+
│ │ ╭───────── CN=DC4+
DC │ │ │ ╭───── CN=DC1+
CN=DC2+ · 3 0 0
CN=DC3+ 0 · 0 0
CN=DC4+ 0 0 · 0
CN=DC1+ 432 432 432 ·
'+' stands for ',CN=Servers,CN=default,CN=Sites,CN=Configuration,DC=mad,DC=caponato,DC=es'
SCHEMA
out-of-date-ness
╭───────────────── CN=DC2+
│ ╭───────────── CN=DC3+
│ │ ╭───────── CN=DC4+
DC │ │ │ ╭───── CN=DC1+
CN=DC2+ · 171 3 3
CN=DC3+ 3 · 3 3
CN=DC4+ 3 3 · 3
CN=DC1+ 432 440 432 ·
'+' stands for ',CN=Servers,CN=default,CN=Sites,CN=Configuration,DC=mad,DC=caponato,DC=es'
DNSDOMAIN
out-of-date-ness
╭───────────────── CN=DC2+
│ ╭───────────── CN=DC3+
│ │ ╭───────── CN=DC4+
DC │ │ │ ╭───── CN=DC1+
CN=DC2+ · 431 430 789
CN=DC3+ 430 · 430 789
CN=DC4+ 430 430 · 789
CN=DC1+ 432 432 432 ·
'+' stands for ',CN=Servers,CN=default,CN=Sites,CN=Configuration,DC=mad,DC=caponato,DC=es'
DNSFOREST
out-of-date-ness
╭───────────────── CN=DC2+
│ ╭───────────── CN=DC3+
│ │ ╭───────── CN=DC4+
DC │ │ │ ╭───── CN=DC1+
CN=DC2+ · 432 432 793
CN=DC3+ 432 · 432 800
CN=DC4+ 432 432 · 793
CN=DC1+ 432 440 432 ·
'+' stands for ',CN=Servers,CN=default,CN=Sites,CN=Configuration,DC=mad,DC=caponato,DC=es' </code>
Caponato's Samba notebook. Start here or return to Main menu.