Category Archives: Windows

Samba AD issues are hard, hard, hard to fix

So it looks like I did something wrong at some point while setting up a domain and Samba4 is now broken for me.

Of course this had to happen after I spent time migrating my local account to the domain account. (No, it did not go as smoothly as the sources might lead you to believe.)

So I am understandably reluctant to reprovision the machine and go through that process again, breaking who-knows-what-else by breaking the NTFS ACLs formed since.

So yeah, I’ll use this post as an outlet for complaints about this breakage:

Mar  1 00:42:17 commander samba[12250]: [2015/03/01 00:42:17.752020,  0] ../lib/util/util_runcmd.c:317(samba_runcmd_io_handler)
Mar  1 00:42:17 commander samba[12250]:   /usr/sbin/samba_dnsupdate: Traceback (most recent call last):
Mar  1 00:42:17 commander samba[12250]: [2015/03/01 00:42:17.753033,  0] ../lib/util/util_runcmd.c:317(samba_runcmd_io_handler)
Mar  1 00:42:17 commander samba[12250]:   /usr/sbin/samba_dnsupdate:   File "/usr/sbin/samba_dnsupdate", line 612, in <module>
Mar  1 00:42:17 commander samba[12250]: [2015/03/01 00:42:17.753757,  0] ../lib/util/util_runcmd.c:317(samba_runcmd_io_handler)
Mar  1 00:42:17 commander samba[12250]:   /usr/sbin/samba_dnsupdate:     get_credentials(lp)
Mar  1 00:42:17 commander samba[12250]: [2015/03/01 00:42:17.754374,  0] ../lib/util/util_runcmd.c:317(samba_runcmd_io_handler)
Mar  1 00:42:17 commander samba[12250]:   /usr/sbin/samba_dnsupdate:   File "/usr/sbin/samba_dnsupdate", line 118, in get_credentials
Mar  1 00:42:17 commander samba[12250]: [2015/03/01 00:42:17.755084,  0] ../lib/util/util_runcmd.c:317(samba_runcmd_io_handler)
Mar  1 00:42:17 commander samba[12250]:   /usr/sbin/samba_dnsupdate:     creds.set_machine_account(lp)
Mar  1 00:42:17 commander samba[12250]: [2015/03/01 00:42:17.755797,  0] ../lib/util/util_runcmd.c:317(samba_runcmd_io_handler)
Mar  1 00:42:17 commander samba[12250]:   /usr/sbin/samba_dnsupdate: RuntimeError: (-1073741275, 'NT_STATUS_NOT_FOUND')

…uh, so the machine account is missing? What? How did that happen? Is it really missing?

# samba-tool user create COMMANDER$
New Password: #DUMMYPASSWORDHERE#
Retype Password: #DUMMYPASSWORDHERE#
ERROR(ldb): Failed to add user 'COMMANDER$':  - samldb: Account name (sAMAccountName) 'COMMANDER$' already in use!

Let’s try this, found on Samba’s wiki:

samba-tool dbcheck --fix --reset-well-known-acls

Hurray, an error has been fixed! But everything is still horribly broken.

Oh look! There’s a DC diagnostics tool shipping in Windows:

C:\Users\ivucica>dcdiag /s:ds.badc0de.net /v

Directory Server Diagnosis

Performing initial setup:
   * Connecting to directory service on server ds.badc0de.net.
   Ldap search capability attribute search failed on server ds.badc0de.net,
   return value = 52

Thanks, Microsoft, that’s helpful.

So I fiddled a bit and ended up with this:

C:\Users\ivucica>dcdiag /s:commander

Directory Server Diagnosis

Performing initial setup:
   Ldap search capability attribute search failed on server commander, return
   value = 81

C:\Users\ivucica>dcdiag /s:commander.ds.MYDOMAIN

Directory Server Diagnosis

Performing initial setup:
   Ldap search capability attribute search failed on server
   commander.ds.MYDOMAIN, return value = 81

No, passing /v did not help identifying either error 52 nor 81. But that 81 is mildly googlable. Wait, it’s mentioning LDAP… Is it even running?

Oh wait, Microsoft has another diagnostics tool (of course it does)

C:\Users\ivucica>nltest /dsgetdc:ds.MYDOMAIN force /gc
Getting DC name failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN

Of course there is no such domain, why would there be, am I right? tcpdump revealed that UDP packets on 389 were being rejected (and nothing is listening there). And connections to localhost were failing. So let’s look at help for samba-tool dbcheck. Huh. Let’s try this:

samba-tool dbcheck --fix --reindex --scope=base

And breakage begone!

C:\Users\ivucica>nltest /dsgetdc:ds.MYDOMAIN /force /gc
           DC: \\commander.ds.MYDOMAIN
      Address: \\10.0.99.150
     Dom Guid: b066b58f-6fa9-42d6-a45a-ABCDEFABCDEF
     Dom Name: ds.MYDOMAIN
  Forest Name: ds.MYDOMAIN
 Dc Site Name: DO-AMS1
        Flags: PDC GC DS LDAP KDC TIMESERV GTIMESERV WRITABLE DNS_DC DNS_DOMAIN
DNS_FOREST
The command completed successfully

Or not?

C:\Users\ivucica>dcdiag /s:ds.badc0de.net /v

Directory Server Diagnosis

Performing initial setup:
   * Connecting to directory service on server ds.badc0de.net.
   Ldap search capability attribute search failed on server ds.badc0de.net,
   return value = 52

Back to 52. And samba_dnsupdate is still broken, and the workstation cannot administrate the DC. Because, “The server is not operational.” Thanks, Samba, and thanks, Windows, for your immensely useful error messages.

Very, very discouraging and even a bit disturbing.

Error when applying group policies on a Samba 4 AD member

Today I ran into the following issue:

C:\WINDOWS\system32>gpupdate /force
Updating policy...

Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows attempted to read the file 
\\YOUR.DOMAIN\sysvol\YOUR.DOMAIN\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini
from a domain controller and was not successful. Group Policy settings
may not be applied until this event is resolved. This issue may be transient and
could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller
 has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
User Policy update has completed successfully.

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html 
from the command line to access information about Group Policy results.

The solution is simple:

samba-tool ntacl sysvolreset

Found in a mailing list post.

A simple WiX template for games

Over the last few days, I’ve got some comments and emails about my old, old post about WiX in which I promised to release a functional template.

Since that work with WiX was originally done for some games, and in the meantime I began working with OS X most of the time, it took “a while” for me to grab some time and remove company branding, create a sample project, and finally prepare and release the template for my own as well as other people’s use.

You can the template from its Bitbucket repository . Have fun!

Little tips on writing portable plugins (and rant on MSVC)

Having written a smallish plugin for a cross-platform database program FileMaker using a template that included projects for Xcode and VC, here’s a few tips on what you should think about when you start writing a plugin that should work on multiple platforms.

  1. Work on the Windows version first. If you’re at home on non-Windows platforms, MSVC will surprise you in numerous ways with its oddities and weird, outdated support for C.
  2. Write as much code in C for portability.
  3. Write in C90. Microsoft Visual Studio will barf a lot at you otherwise.
  4. If you disregarded #3 and wrote the code in C99 (for example, you declared variables during the function body instead of on the top of the function), you’ll have to switch to C++ to avoid changes to your code.
  5. Don’t write smart code. For example, MSVC barfs at the following:

    typedef struct _IVRect
    {
      int x, y, w, h;
    } IVRect;
    
    IVRect r = { .x = 5, .y = 6, .w = 7, .h = 8 };
    
    // but the following is ok. just don't change the order of
    // struct members. if you do -- woe upon you:
    IVRect s = { 5, 6, 7, 8 };
    

    and it especially barfs at the following:

    // given int IVRectSurfaceSum(const int rectCount, Rect * r):
    int surface = IVRectSurface(2, (IVRect[]) 
      {
        { .x = 5, .y = 6, .w = 7, .h = 8 },
        { .x = 1, .y = 2, .w = 3, .h = 4 } 
      });
    
  6. Use as many open source libraries available for majority of your platforms.
  7. …but always check what MSVC can swallow and what your target app uses. I have used version of libxml2 that depended on the newer zlib1.dll than has shipped with FileMaker. The only solution I found is — replacing FileMaker’s zlib1.dll. That’s nasty.
  8. Always write a small test C program that uses the same functions as your plugin. Port that to every platform first. On Windows, I couldn’t get stdout from my plugin once it ran under FileMaker. If I could’ve, I would’ve saved about a day of frustration why signing with xmlsec didn’t work. (xmlsec’s debug output wasn’t displayed anywhere, either).
  9. Get used to #ifdef _MSC_VER. Get really, really, really used to it.
  10. Since I’m not sure you could figure that out… I have a very low opinion about Visual C++. I did hear it produces nice, fast code. But that doesn’t change the fact that it’s terrible to use with low coverage of modern C. Actually, scratch that: nonexistent coverage of modern C.

    I mean, it’s so nasty that I’m wondering if I should have built a helper static library (or a DLL) which contained the C code using MinGW, and then used this helper library in the plugin itself.

    Visual C++ was — for me — slow, had little conformance with modern standards, and every time I had to copypaste something somewhere using GUI, a little part of me died. A slightly larger part if I had to overwrite something else, as was the case with zlib1.dll.

    I don’t know. Sure, it’s mostly familiarity-with-other-IDEs speaking out of me. Sure, tons and tons of people prefer and absolutely love Visual C++. Good for them.

    But, I apparently love modern language features far, far more. So, if you are like me, and if you are forced to build something with MSVC (an example might be — the SDK you’re writing the plugin with chose to use C++, hence the ABI is locked into MSVC), you really, really, really should constantly doublecheck if MSVC will eat up what you try to serve to it.

    Because if you used to work with Windows, and if you are nowadays mostly targeting another platform (or at least another compiler), and if you think you’re writing portable code — you may be in for a nasty surprise.

    Especially if you use third-party libraries!

First-chance exception at {address} (ntdll.dll) in {exename}.exe: 0xC0000139: Entry Point Not Found

Writing a plugin for a Windows application using Visual Studio?

You had the smarts to define the application’s exe as the debug executable in Visual Studio project options?

While reading the output, you saw the error from the post’s title?

First-chance exception at 
(ntdll.dll) in .exe: 0xC0000139: Entry Point Not Found

You’ve probably got a classic case of app-uses-one-version-of-dll-while-one-of-my-plugin’s-dependencies-wants-another-one. In my case, I had to replace zlib1.dll in the app with the one that came with Igor Zlatković’s Win32 builds of libxml2, xmlsec, etc.

Read a bit more about the error, including different causes.

Unibody Macbook 2009 – NVIDIA 9400m support for PhysX

Since 9400m has 16 CUDA cores, newer releases of PhysX system software do not support hardware acceleration on it. In newer releases, NVIDIA demands 256MB of memory on the GPU and 32 CUDA cores. 

But if you need it for development, testing or just for trying how it works and proving to yourself you can do it… grab old drivers from NVIDIA to get PhysX running on your machine. I’ve tried 9.09.0408.
Beware, NVIDIA’s Fluid Demo is still abysmally slow so I’m not sure if there’s any point. (Although I suspect this has more to do with it rendering 60000 particles than with anything else.)
You’ll need to manually uninstall the PhysX drivers that ship with your GPU drivers. If you don’t see them in Add/Remove Programs, then install the latest version of PhysX drivers (not your GPU drivers) and then uninstall.