samba - Sep 2012 - Samba4 ADC cannot edit GPO with W2K3

Hello,

I have been trying to setup a working environment with samba4-rc1 on 
fedora 17 following the samba4 howto at the wiki.
DNS and ldap are internal.
Everything looks like working, I can create and edit GPOs with WinXP Pro 
but with Win2K3 server I can create GPOs but I can't edit them. I cannot 
see any error at the log.samba file. Win2k3 gives an error that I will 
try to translate to english below:
         Group Policy Error:
                 It is not possible to open the group policy object. It 
is possible that you have not the right permissions to do so.
         Details:
                 It is not possible to find the access route on the network.

Thanks in advance,

Luis

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

> Hello,
>
> I have been trying to setup a working environment with samba4-rc1 on
> fedora 17 following the samba4 howto at the wiki.
> DNS and ldap are internal.
> Everything looks like working, I can create and edit GPOs with WinXP Pro
> but with Win2K3 server I can create GPOs but I can't edit them. I
cannot
> see any error at the log.samba file. Win2k3 gives an error that I will
> try to translate to english below:
>          Group Policy Error:
>                  It is not possible to open the group policy object. It
> is possible that you have not the right permissions to do so.
>          Details:
>                  It is not possible to find the access route on the
> network.
>
Try:
/usr/local/samba/bin/samba-tool ntacl sysvolcheck

and if it yields some error then:
/usr/local/samba/bin/samba-tool ntacl sysvolreset


It worked for me.

Cheers,
Felix.

On 09/28/2012 03:03 AM, Luis Martinez wrote:
> Hello,
>
> I have been trying to setup a working environment with samba4-rc1 on 
> fedora 17 following the samba4 howto at the wiki.
> DNS and ldap are internal.
> Everything looks like working, I can create and edit GPOs with WinXP 
> Pro but with Win2K3 server I can create GPOs but I can't edit them. I 
> cannot see any error at the log.samba file. Win2k3 gives an error that 
> I will try to translate to english below:
>         Group Policy Error:
>                 It is not possible to open the group policy object. It 
> is possible that you have not the right permissions to do so.
>         Details:
>                 It is not possible to find the access route on the 
> network.
Do a capture with tcpdump and locate the packets when you are clicking 
to create a GPO you'll most probably see some ldap or smb/smb2 error 
with those information we might be able to help you more.

Matthieu.

-- 
Matthieu Patou
Samba Team
http://samba.org