samba - Mar 2016 - Permission denied on GPT.ini (Event ID 1058)

I just saw this thread while browsing my emails and I want to report
that I get this frequently but randomly on every Samba4 domain I run. It
is completely random in that it affects a PC today, but a week from now
that same PC may work just fine. It may then affect a different PC which
had no issues prior.

Also, if I click the link to "gpt.ini" in the event log the file DOES
open and I can view it all day long. It is almost as though the system
lies to me in saying it cannot access the file, but it can. I have been
dealing with this for two years now.

Finally, this seems to occur MUCH more frequently on domains which have
multiple DCs. A single DC domain may have this happen once in a year,
and only for a moment, whereas a multiple DC domain may have this happen
regularly.

Lead IT/IS Specialist
Reach Technology FP, Inc

On 03/18/2016 03:58 PM, lingpanda101 at gmail.com wrote:
> On 3/18/2016 2:15 PM, Sébastien Le Ray wrote:
>>
>>
>> Le 18/03/2016 18:50, lingpanda101 at gmail.com a écrit :
>>> Have you tried running 'gpresult /H GPReport.html' on the
workstation
>>> and see if it provides any details? You can also run 'Group
Policy
>>> Results' from within Microsoft Group Policy Management snap in.
>>
>> Yes, it show an error about maximum kerberos tickets exceeded but I
>> take that for a generic error message…
>>
>>>
>>> Are you using Item level targeting in your GPO?
>>>
>>
>> No
> 
> When this error happens, can you confirm if you can manually navigate to
> the file? Open file explorer and enter the UNC path.
> 
> ie. \\domain\sysvol\domain\Policies\SomeGUID\gpt.ini
> 
> On the workstation having the issue.
>

Hi,

Thank you for your report. I can confirm that the issue kind of 
"resolves" itself after a while (the while can be as long as several 
weeks which is annoying when you install a common base of software 
through GPO).

It seems like one (or several) of the DCs are misconfigured but checking 
throught ldapcmp returns no difference, and ntacl sysvolreset on all DC 
doesn't solve it (by the way it does not seem to adjust unix ACLs, if I 
setfacl -bR on Policies I never get ACLs back)

Clicking on the link in the events viewer (which *never* fails) opens it 
as the logged in user, that's why I'm convinced the issue is tied to 
machine accounts handling

Regards

Le 22/03/2016 15:11, Ryan Ashley a écrit :
> I just saw this thread while browsing my emails and I want to report
> that I get this frequently but randomly on every Samba4 domain I run. It
> is completely random in that it affects a PC today, but a week from now
> that same PC may work just fine. It may then affect a different PC which
> had no issues prior.
>
> Also, if I click the link to "gpt.ini" in the event log the file
DOES
> open and I can view it all day long. It is almost as though the system
> lies to me in saying it cannot access the file, but it can. I have been
> dealing with this for two years now.
>
> Finally, this seems to occur MUCH more frequently on domains which have
> multiple DCs. A single DC domain may have this happen once in a year,
> and only for a moment, whereas a multiple DC domain may have this happen
> regularly.
>
> Lead IT/IS Specialist
> Reach Technology FP, Inc
>

In addition,.. a handy to know. 

Windows resolves NetBIOS names by using one of the following four methods.
 1 = B-Node (broadcast)
 2 = P-Node (point-to-point)
 4 = M-Node (mixed)
 8 = H-Node (hybrid)

In the registry look for NodeType and/or DhcpNodeType 
When you cannot view other workgroup computers, remove these keys and reboot.

If you still see a wrong node-type after reboot, check you dhcp option 46. 
Still not working, try manualy creating the NodeType registry key. 


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens L.P.H. van
Belle
> Verzonden: dinsdag 22 maart 2016 16:17
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] Permission denied on GPT.ini (Event ID 1058)
> 
> Hai
> 
> In the end, i found the problem today.
> 
> The pc win7-64b with this problem had a wrongy network settting and 2
> nics.
> I removed 1 nic.
> Ipconfig /all gaves what whas wrong.
> 
> The nodetype was wrong.
> The "problem" pc had mixed set.
> And not hybrid  (0x8) (H Node)
> After changing this back to H-node and removeing the 2e nic.
> Rebooted the pc and it works again now.
> 
> Hope this helps someone.
> 
> 
> Greetz,
> 
> Louis
> 
> 
> 
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ryan
Ashley
> > Verzonden: dinsdag 22 maart 2016 15:11
> > Aan: samba at lists.samba.org
> > Onderwerp: Re: [Samba] Permission denied on GPT.ini (Event ID 1058)
> >
> > I just saw this thread while browsing my emails and I want to report
> > that I get this frequently but randomly on every Samba4 domain I run.
It
> > is completely random in that it affects a PC today, but a week from
now
> > that same PC may work just fine. It may then affect a different PC
which
> > had no issues prior.
> >
> > Also, if I click the link to "gpt.ini" in the event log the
file DOES
> > open and I can view it all day long. It is almost as though the system
> > lies to me in saying it cannot access the file, but it can. I have
been
> > dealing with this for two years now.
> >
> > Finally, this seems to occur MUCH more frequently on domains which
have
> > multiple DCs. A single DC domain may have this happen once in a year,
> > and only for a moment, whereas a multiple DC domain may have this
happen
> > regularly.
> >
> > Lead IT/IS Specialist
> > Reach Technology FP, Inc
> >
> > On 03/18/2016 03:58 PM, lingpanda101 at gmail.com wrote:
> > > On 3/18/2016 2:15 PM, Sébastien Le Ray wrote:
> > >>
> > >>
> > >> Le 18/03/2016 18:50, lingpanda101 at gmail.com a écrit :
> > >>> Have you tried running 'gpresult /H
GPReport.html' on the
> workstation
> > >>> and see if it provides any details? You can also run
'Group Policy
> > >>> Results' from within Microsoft Group Policy
Management snap in.
> > >>
> > >> Yes, it show an error about maximum kerberos tickets exceeded
but I
> > >> take that for a generic error message?
> > >>
> > >>>
> > >>> Are you using Item level targeting in your GPO?
> > >>>
> > >>
> > >> No
> > >
> > > When this error happens, can you confirm if you can manually
navigate
> to
> > > the file? Open file explorer and enter the UNC path.
> > >
> > > ie. \\domain\sysvol\domain\Policies\SomeGUID\gpt.ini
> > >
> > > On the workstation having the issue.
> > >
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
> 
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

Hi Sébastien,

On 03/22/2016 04:04 PM, Sébastien Le Ray wrote:
> Clicking on the link in the events viewer (which *never* fails) opens it
> as the logged in user, that's why I'm convinced the issue is tied
to
> machine accounts handling
I have had problems with machine accounts accessing sysvol folders on 
smba DCs. I solved this by adding a gid & uid to the machine accounts.

Perhaps try that?

MJ