samba - Jan 2016 - Windows 10 administrative templates /central store with Samba

Hi list,

This might or might not be a Samba related post. Feel free to ignore it 
in case it is too far off-topic

My current understanding is that ...
a) I need those new templates in order to fully integrate Win10 clients 
in an AD domain (i.e. with compatible policies).
b) I can only modify policies based on Win10 admx files from Win10 
machines (i.e. with the RSAT tools for Win10).

Are there any Samba-related implications or issues on doing that, 
particularly if I follow the MS advice to store those admx files in a 
central store in the SYSVOL (\PolicyDefinitions) folder?

Also, are there any implications for existing domains with e.g. Win7 
clients? Is it advised to keep Win7 and Win10 in separate containers?

I remember that somebody here reported issues with his/her existing 
Samba domain after having used the RSAT tools for Win10. But I am not 
able to find this post again. Does somebody remember or is able to tell 
how to avoid such (or other) trouble?

Also, Viktor Trojanovic and Robert Watson reported the same error 
message on administering a domain from Win10 with RSAT in the midst of 
November. Have you been able to understand/solve it?

"Group Policy Management: A processing error occured collecting data 
using this base domain controller. Please change the base domain 
controller and try again."

Ole

On 1/21/2016 9:39 AM, Ole Traupe wrote:
> Hi list,
>
> This might or might not be a Samba related post. Feel free to ignore 
> it in case it is too far off-topic
>
> My current understanding is that ...
> a) I need those new templates in order to fully integrate Win10 
> clients in an AD domain (i.e. with compatible policies).
> b) I can only modify policies based on Win10 admx files from Win10 
> machines (i.e. with the RSAT tools for Win10).
>
> Are there any Samba-related implications or issues on doing that, 
> particularly if I follow the MS advice to store those admx files in a 
> central store in the SYSVOL (\PolicyDefinitions) folder?
>
> Also, are there any implications for existing domains with e.g. Win7 
> clients? Is it advised to keep Win7 and Win10 in separate containers?
>
> I remember that somebody here reported issues with his/her existing 
> Samba domain after having used the RSAT tools for Win10. But I am not 
> able to find this post again. Does somebody remember or is able to 
> tell how to avoid such (or other) trouble?
>
> Also, Viktor Trojanovic and Robert Watson reported the same error 
> message on administering a domain from Win10 with RSAT in the midst of 
> November. Have you been able to understand/solve it?
>
> "Group Policy Management: A processing error occured collecting data 
> using this base domain controller. Please change the base domain 
> controller and try again."
>
> Ole
>
>
>
Ole,

     I can speak to one of your questions.

"Are there any Samba-related implications or issues on doing that, 
particularly if I follow the MS advice to store those admx files in a 
central store in the SYSVOL (\PolicyDefinitions) folder?"

I use a central store for my Windows 7 clients. I have not experienced 
any issues with doing so.

-- 
-James

Commented inbetween. 
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ole Traupe
> Verzonden: donderdag 21 januari 2016 15:40
> Aan: samba
> Onderwerp: [Samba] Windows 10 administrative templates /central store with
> Samba
> 
> Hi list,
> 
> This might or might not be a Samba related post. Feel free to ignore it
> in case it is too far off-topic
> 
> My current understanding is that ...
> a) I need those new templates in order to fully integrate Win10 clients
> in an AD domain (i.e. with compatible policies).
[L.P.H. van Belle] http://trekker.net/archives/group-policy-downloads/ 
> b) I can only modify policies based on Win10 admx files from Win10
> machines (i.e. with the RSAT tools for Win10).
 [L.P.H. van Belle] Dont know, still win7 here, i did a short test with win10,
and i didnt had any problems managing this from a win7 pc.
> Are there any Samba-related implications or issues on doing that,
> particularly if I follow the MS advice to store those admx files in a
> central store in the SYSVOL (\PolicyDefinitions) folder?
[L.P.H. van Belle] yes, and be sure to make good backups of that folder. 
> 
> Also, are there any implications for existing domains with e.g. Win7
> clients? Is it advised to keep Win7 and Win10 in separate containers?
[L.P.H. van Belle] Nope, once you have win7 and add the win10 int the
PolicyDefinitions you can use that also on win7.
> 
> I remember that somebody here reported issues with his/her existing
> Samba domain after having used the RSAT tools for Win10. But I am not
> able to find this post again. Does somebody remember or is able to tell
> how to avoid such (or other) trouble?
[L.P.H. van Belle] There where and maybe there still are a few problems with the
policies, but i think windows had this fixed no.
If not, google the error message, solution is on the MS site, few small changes.
> 
> Also, Viktor Trojanovic and Robert Watson reported the same error
> message on administering a domain from Win10 with RSAT in the midst of
> November. Have you been able to understand/solve it?
[L.P.H. van Belle] can answere this one, no win10 rsat
tested.
> 
> "Group Policy Management: A processing error occured collecting data
> using this base domain controller. Please change the base domain
> controller and try again."
> 
> Ole
> 
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

On 21.01.2016 15:51, James wrote:
> On 1/21/2016 9:39 AM, Ole Traupe wrote:
>> Hi list,
>>
>> This might or might not be a Samba related post. Feel free to ignore 
>> it in case it is too far off-topic
>>
>> My current understanding is that ...
>> a) I need those new templates in order to fully integrate Win10 
>> clients in an AD domain (i.e. with compatible policies).
>> b) I can only modify policies based on Win10 admx files from Win10 
>> machines (i.e. with the RSAT tools for Win10).
>>
>> Are there any Samba-related implications or issues on doing that, 
>> particularly if I follow the MS advice to store those admx files in a 
>> central store in the SYSVOL (\PolicyDefinitions) folder?
>>
>> Also, are there any implications for existing domains with e.g. Win7 
>> clients? Is it advised to keep Win7 and Win10 in separate containers?
>>
>> I remember that somebody here reported issues with his/her existing 
>> Samba domain after having used the RSAT tools for Win10. But I am not 
>> able to find this post again. Does somebody remember or is able to 
>> tell how to avoid such (or other) trouble?
>>
>> Also, Viktor Trojanovic and Robert Watson reported the same error 
>> message on administering a domain from Win10 with RSAT in the midst 
>> of November. Have you been able to understand/solve it?
>>
>> "Group Policy Management: A processing error occured collecting
data
>> using this base domain controller. Please change the base domain 
>> controller and try again."
>>
>> Ole
>>
>>
>>
> Ole,
>
>     I can speak to one of your questions.
>
> "Are there any Samba-related implications or issues on doing that, 
> particularly if I follow the MS advice to store those admx files in a 
> central store in the SYSVOL (\PolicyDefinitions) folder?"
>
> I use a central store for my Windows 7 clients. I have not experienced 
> any issues with doing so.
>
Thanks, James, sounds good. I take it you have no experience in adding 
Win10 templates to such a pre-existing store?

Thanks, Louis, commented within.

On 21.01.2016 16:23, L.P.H. van Belle wrote:
> Commented inbetween.
>
>> -----Oorspronkelijk bericht-----
>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ole Traupe
>> Verzonden: donderdag 21 januari 2016 15:40
>> Aan: samba
>> Onderwerp: [Samba] Windows 10 administrative templates /central store
with
>> Samba
>>
>> Hi list,
>>
>> This might or might not be a Samba related post. Feel free to ignore it
>> in case it is too far off-topic
>>
>> My current understanding is that ...
>> a) I need those new templates in order to fully integrate Win10 clients
>> in an AD domain (i.e. with compatible policies).
> [L.P.H. van Belle] http://trekker.net/archives/group-policy-downloads/
>
>> b) I can only modify policies based on Win10 admx files from Win10
>> machines (i.e. with the RSAT tools for Win10).
>   [L.P.H. van Belle] Dont know, still win7 here, i did a short test with
win10, and i didnt had any problems managing this from a win7 pc.
>
>> Are there any Samba-related implications or issues on doing that,
>> particularly if I follow the MS advice to store those admx files in a
>> central store in the SYSVOL (\PolicyDefinitions) folder?
> [L.P.H. van Belle] yes, and be sure to make good backups of that folder.
>
>> Also, are there any implications for existing domains with e.g. Win7
>> clients? Is it advised to keep Win7 and Win10 in separate containers?
> [L.P.H. van Belle] Nope, once you have win7 and add the win10 int the
PolicyDefinitions you can use that also on win7.
Will the old templates auto-magically be used for Win7 and the new ones 
for Win10, or how is that working?

So it is not necessary to have separate containers (and policies) for 
Win7 vs. Win10? Ok, I remember seeing things like "This will have no 
effect on OS Windows Vista or newer." in the comments of Policy 
settings. This speaks for a smart integration.

>
>> I remember that somebody here reported issues with his/her existing
>> Samba domain after having used the RSAT tools for Win10. But I am not
>> able to find this post again. Does somebody remember or is able to tell
>> how to avoid such (or other) trouble?
> [L.P.H. van Belle] There where and maybe there still are a few problems
with the policies, but i think windows had this fixed no.
> If not, google the error message, solution is on the MS site, few small
changes.
I particiularly remember that somebody claimed to have messed up his/her 
LDAP by managing the Samba domain from Win10. So this wouldn't have 
anything todo with Windows.

>
>> Also, Viktor Trojanovic and Robert Watson reported the same error
>> message on administering a domain from Win10 with RSAT in the midst of
>> November. Have you been able to understand/solve it?
> [L.P.H. van Belle] can answere this one, no win10 rsat tested.
>> "Group Policy Management: A processing error occured collecting
data
>> using this base domain controller. Please change the base domain
>> controller and try again."
>>
>> Ole
>>
>>
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>
>

commented within.
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ole Traupe
> Verzonden: donderdag 21 januari 2016 16:47
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Windows 10 administrative templates /central store
> with Samba
> 
> Thanks, Louis, commented within.
> 
> On 21.01.2016 16:23, L.P.H. van Belle wrote:
> > Commented inbetween.
> >
> >> -----Oorspronkelijk bericht-----
> >> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ole
Traupe
> >> Verzonden: donderdag 21 januari 2016 15:40
> >> Aan: samba
> >> Onderwerp: [Samba] Windows 10 administrative templates /central
store
> with
> >> Samba
> >>
> >> Hi list,
> >>
> >> This might or might not be a Samba related post. Feel free to
ignore it
> >> in case it is too far off-topic
> >>
> >> My current understanding is that ...
> >> a) I need those new templates in order to fully integrate Win10
clients
> >> in an AD domain (i.e. with compatible policies).
> > [L.P.H. van Belle] http://trekker.net/archives/group-policy-downloads/
> >
> >> b) I can only modify policies based on Win10 admx files from Win10
> >> machines (i.e. with the RSAT tools for Win10).
> >   [L.P.H. van Belle] Dont know, still win7 here, i did a short test
with
> win10, and i didnt had any problems managing this from a win7 pc.
> >
> >> Are there any Samba-related implications or issues on doing that,
> >> particularly if I follow the MS advice to store those admx files
in a
> >> central store in the SYSVOL (\PolicyDefinitions) folder?
> > [L.P.H. van Belle] yes, and be sure to make good backups of that
folder.
> >
> >> Also, are there any implications for existing domains with e.g.
Win7
> >> clients? Is it advised to keep Win7 and Win10 in separate
containers?
> > [L.P.H. van Belle] Nope, once you have win7 and add the win10 int the
> PolicyDefinitions you can use that also on win7.
> 
> Will the old templates auto-magically be used for Win7 and the new ones
> for Win10, or how is that working?
[L.P.H. van Belle] 
You make a copy of the win7 admx ( on the server  PolicyDefinitions ) 
Now add/overwrite the win10 admx files in that same folder.

! DO BACKUP THAT FOLDER ! 
I had some problems with admx files and then your very happy to have a backup of
that.
> 
> So it is not necessary to have separate containers (and policies) for
> Win7 vs. Win10? Ok, I remember seeing things like "This will have no
> effect on OS Windows Vista or newer." in the comments of Policy
> settings. This speaks for a smart integration.
[L.P.H. van Belle] nope, and yes your correct. 

> 
> 
> >
> >> I remember that somebody here reported issues with his/her
existing
> >> Samba domain after having used the RSAT tools for Win10. But I am
not
> >> able to find this post again. Does somebody remember or is able to
tell
> >> how to avoid such (or other) trouble?
> > [L.P.H. van Belle] There where and maybe there still are a few
problems
> with the policies, but i think windows had this fixed no.
> > If not, google the error message, solution is on the MS site, few
small
> changes.
> 
> I particiularly remember that somebody claimed to have messed up his/her
> LDAP by managing the Samba domain from Win10. So this wouldn't have
> anything todo with Windows.
[L.P.H. van Belle] this i dont know, can recall that. 
> 
> 
> >
> >> Also, Viktor Trojanovic and Robert Watson reported the same error
> >> message on administering a domain from Win10 with RSAT in the
midst of
> >> November. Have you been able to understand/solve it?
> > [L.P.H. van Belle] can answere this one, no win10 rsat tested.
> >> "Group Policy Management: A processing error occured
collecting data
> >> using this base domain controller. Please change the base domain
> >> controller and try again."
> >>
> >> Ole
> >>
> >>
> >>
> >> --
> >> To unsubscribe from this list go to the following URL and read the
> >> instructions:  https://lists.samba.org/mailman/options/samba
> >
> >
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

Hi Ole,

I've been using Samba with Win10 clients for a while now, so I'm happy 
to share some of my findings.

See comments inline.

On 21.01.2016 15:39, Ole Traupe wrote:
> Hi list,
>
> This might or might not be a Samba related post. Feel free to ignore 
> it in case it is too far off-topic
>
> My current understanding is that ...
> a) I need those new templates in order to fully integrate Win10 
> clients in an AD domain (i.e. with compatible policies).
As long as you have your RSAT installed on a Win10 machine, you actually 
don't need to install the templates to the sysvol store. The purpose of 
the template store is that multiple admins working from various machines 
with different versions of windows can always access all capabilities.
> b) I can only modify policies based on Win10 admx files from Win10 
> machines (i.e. with the RSAT tools for Win10).
>
See above. The purpose of installing the ADMX to the central store is 
that you can modify policies for Win10 also from a Win7 machine.
> Are there any Samba-related implications or issues on doing that, 
> particularly if I follow the MS advice to store those admx files in a 
> central store in the SYSVOL (\PolicyDefinitions) folder?
>
I did that, and have no issues.
> Also, are there any implications for existing domains with e.g. Win7 
> clients? Is it advised to keep Win7 and Win10 in separate containers?
>
No, there should be no issues. The only thing you have to remember is 
that settings which are specific to Win10 will obviously not have any 
effect on Win7 machines.
> I remember that somebody here reported issues with his/her existing 
> Samba domain after having used the RSAT tools for Win10. But I am not 
> able to find this post again. Does somebody remember or is able to 
> tell how to avoid such (or other) trouble?
>
No issues. I did report a few but eventually found out they were not 
related to the RSAT, or to Samba.
> Also, Viktor Trojanovic and Robert Watson reported the same error 
> message on administering a domain from Win10 with RSAT in the midst of 
> November. Have you been able to understand/solve it?
>
> "Group Policy Management: A processing error occured collecting data 
> using this base domain controller. Please change the base domain 
> controller and try again."
You'll get that error message when you click on the domain in the forest 
shown in RSAT. You can simply ignore it, it's not an actual
issue.
> Ole
>
Viktor

On 21.01.2016 17:16, Viktor Trojanovic wrote:
> Hi Ole,
>
> I've been using Samba with Win10 clients for a while now, so I'm
happy
> to share some of my findings.
>
> See comments inline.
>
> On 21.01.2016 15:39, Ole Traupe wrote:
>> Hi list,
>>
>> This might or might not be a Samba related post. Feel free to ignore 
>> it in case it is too far off-topic
>>
>> My current understanding is that ...
>> a) I need those new templates in order to fully integrate Win10 
>> clients in an AD domain (i.e. with compatible policies).
> As long as you have your RSAT installed on a Win10 machine, you 
> actually don't need to install the templates to the sysvol store. The 
> purpose of the template store is that multiple admins working from 
> various machines with different versions of windows can always access 
> all capabilities.
Ok, great! So either RSAT for Win10 or putting the admx files on the 
central store. Got it.

>
>> b) I can only modify policies based on Win10 admx files from Win10 
>> machines (i.e. with the RSAT tools for Win10).
>>
> See above. The purpose of installing the ADMX to the central store is 
> that you can modify policies for Win10 also from a Win7 machine.
>
>> Are there any Samba-related implications or issues on doing that, 
>> particularly if I follow the MS advice to store those admx files in a 
>> central store in the SYSVOL (\PolicyDefinitions) folder?
>>
> I did that, and have no issues.
>
>> Also, are there any implications for existing domains with e.g. Win7 
>> clients? Is it advised to keep Win7 and Win10 in separate containers?
>>
> No, there should be no issues. The only thing you have to remember is 
> that settings which are specific to Win10 will obviously not have any 
> effect on Win7 machines.
Check.

>
>> I remember that somebody here reported issues with his/her existing 
>> Samba domain after having used the RSAT tools for Win10. But I am not 
>> able to find this post again. Does somebody remember or is able to 
>> tell how to avoid such (or other) trouble?
>>
> No issues. I did report a few but eventually found out they were not 
> related to the RSAT, or to Samba.
>
>> Also, Viktor Trojanovic and Robert Watson reported the same error 
>> message on administering a domain from Win10 with RSAT in the midst 
>> of November. Have you been able to understand/solve it?
>>
>> "Group Policy Management: A processing error occured collecting
data
>> using this base domain controller. Please change the base domain 
>> controller and try again."
>
> You'll get that error message when you click on the domain in the 
> forest shown in RSAT. You can simply ignore it, it's not an actual
issue.
>> Ole
>>
>
> Viktor
Thanks a lot, Viktor!

Viktor, thanks again!

Now that I did this (added the Win10 1511 ADMX files to the central 
store), I probably will have to recreate the policies that will be 
applied to Win10 machines, right?

Ole


On 21.01.2016 17:16, Viktor Trojanovic wrote:
> Hi Ole,
>
> I've been using Samba with Win10 clients for a while now, so I'm
happy
> to share some of my findings.
>
> See comments inline.
>
> On 21.01.2016 15:39, Ole Traupe wrote:
>> Hi list,
>>
>> This might or might not be a Samba related post. Feel free to ignore 
>> it in case it is too far off-topic
>>
>> My current understanding is that ...
>> a) I need those new templates in order to fully integrate Win10 
>> clients in an AD domain (i.e. with compatible policies).
> As long as you have your RSAT installed on a Win10 machine, you 
> actually don't need to install the templates to the sysvol store. The 
> purpose of the template store is that multiple admins working from 
> various machines with different versions of windows can always access 
> all capabilities.
>
>> b) I can only modify policies based on Win10 admx files from Win10 
>> machines (i.e. with the RSAT tools for Win10).
>>
> See above. The purpose of installing the ADMX to the central store is 
> that you can modify policies for Win10 also from a Win7 machine.
>
>> Are there any Samba-related implications or issues on doing that, 
>> particularly if I follow the MS advice to store those admx files in a 
>> central store in the SYSVOL (\PolicyDefinitions) folder?
>>
> I did that, and have no issues.
>
>> Also, are there any implications for existing domains with e.g. Win7 
>> clients? Is it advised to keep Win7 and Win10 in separate containers?
>>
> No, there should be no issues. The only thing you have to remember is 
> that settings which are specific to Win10 will obviously not have any 
> effect on Win7 machines.
>
>> I remember that somebody here reported issues with his/her existing 
>> Samba domain after having used the RSAT tools for Win10. But I am not 
>> able to find this post again. Does somebody remember or is able to 
>> tell how to avoid such (or other) trouble?
>>
> No issues. I did report a few but eventually found out they were not 
> related to the RSAT, or to Samba.
>
>> Also, Viktor Trojanovic and Robert Watson reported the same error 
>> message on administering a domain from Win10 with RSAT in the midst 
>> of November. Have you been able to understand/solve it?
>>
>> "Group Policy Management: A processing error occured collecting
data
>> using this base domain controller. Please change the base domain 
>> controller and try again."
>
> You'll get that error message when you click on the domain in the 
> forest shown in RSAT. You can simply ignore it, it's not an actual
issue.
>> Ole
>>
>
> Viktor