s4-drepl: don't call UpdateRefs on a RODC

we use the ADD_REF bit in getncchanges instead

Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>

1 files changed, 11 insertions, 5 deletions

diff --git a/source4/dsdb/repl/drepl_out_helpers.c b/source4/dsdb/repl/drepl_out_helpers.c
index 1477d6fb54..2a32e5ca04 100644
--- a/source4/dsdb/repl/drepl_out_helpers.c
+++ b/source4/dsdb/repl/drepl_out_helpers.c
@@ -623,16 +623,22 @@ static void dreplsrv_op_pull_source_apply_changes_trigger(struct tevent_req *req
 		return;
 	}
 
+	if (state->op->extended_op != DRSUAPI_EXOP_NONE ||
+	    state->op->service->am_rodc) {
+		/*
+		  we don't do the UpdateRefs for extended ops or if we
+		  are a RODC
+		 */
+		tevent_req_done(req);
+		return;
+	}
+
 	/* now we need to update the repsTo record for this partition
 	   on the server. These records are initially established when
 	   we join the domain, but they quickly expire.  We do it here
 	   so we can use the already established DRSUAPI pipe
 	*/
-	if (state->op->extended_op == DRSUAPI_EXOP_NONE) {
-		dreplsrv_update_refs_trigger(req);
-	} else {
-		tevent_req_done(req);
-	}
+	dreplsrv_update_refs_trigger(req);
 }
 
 static void dreplsrv_update_refs_done(struct tevent_req *subreq);