Hi Marc,
Ok, I apologise, I was unsure if the number
{31B2F340-016D-11D2-945F-00C04FB984F9} was something sensitive
password-like or not, so i changed it slightly.... Sorry..! The number
is actually the number as you quote it below for the Default Domain Policy.
> The two GUID directories, that exist on every AD DC, are
>
> {6AC1786C-016F-11D2-945F-00C04FB984F9} = Default Domain Controller Policy
> {31B2F340-016D-11D2-945F-00C04FB984F9} = Default Domain Policy
>
> So yours is a GPO, you had created.
Again...apologies: no it really is the default domain policy.
> That's normal. If you create a new GPO, the GPMC only created the GUID
> folder, that contains an empty Machine and User folder and the GPT.INI
> file. Nothing else.
But in case of the default domain policy..? Is it also normal?
I guess perhaps not...? And how to solve this..?
> Have you verified, that the error "Access is denied" is correct?
I can access the UNC
\\samba.company.com\sysvol\samba.company.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\User\
So I guess "access denied" is NOT the problem.
(though I'm trying as a user, and perhaps GPO runs as a machine account...)
samba-tool ntacl sysvolcheck crashes with the well-known error:
> root at DC2:~# samba-tool ntacl sysvolcheck
> lp_load_ex: refreshing parameters
> Initialising global parameters
> rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
> Processing section "[global]"
> Processing section "[netlogon]"
> Processing section "[sysvol]"
> ldb_wrap open of idmap.ldb
> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception - ProvisioningError: DB ACL on GPO directory
/var/lib/samba/sysvol/samba.company.com/Policies/{A577A789-8C39-447A-8555-42B247B9943C}
O:LAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)
does not match expected value
O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)
from GPO object
> File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 175,
in _run
> return self.run(*args, **kwargs)
> File "/usr/lib/python2.7/dist-packages/samba/netcmd/ntacl.py",
line 249, in run
> lp)
> File
"/usr/lib/python2.7/dist-packages/samba/provision/__init__.py", line
1730, in checksysvolacl
> direct_db_access)
> File
"/usr/lib/python2.7/dist-packages/samba/provision/__init__.py", line
1681, in check_gpos_acl
> domainsid, direct_db_access)
> File
"/usr/lib/python2.7/dist-packages/samba/provision/__init__.py", line
1628, in check_dir_acl
> raise ProvisioningError('%s ACL on GPO directory %s %s does not
match expected value %s from GPO object' % (acl_type(direct_db_access),
path, fsacl_sddl, acl))
> root at DC2:~#
In a thread a few weeks ago I was told that this is quite normal. Most
of us see this. A few weeks ago I ran sysvolreset as well.
Anyway: that running sysvolreset again will not give me a registry.pol
file in that location...
What to do..? Do I have a problem?
MJ