samba - Nov 2018 - GPUpdate

hello list, I noticed that when I run the command gpupdate in the clients I get
the following error

C:>gpupdate
Updating policy...

Computer policy could not be updated successfully. The following errors were enc
ountered:
The processing of Group Policy failed. Windows attempted to read the file \eccm
g.cupet.cusysvoldomainPolicies{31B2F340-016D-11D2-945F-00C04FB984F9}
gpt.ini from a domain controller and was not successful.

That policy I delete it, however the client PC keeps looking for it, some way to
fix this ... use samba4 Version 4.9.1

On Tue, 06 Nov 2018 14:54:26 +0000
Sandy via samba <samba at lists.samba.org> wrote:
> hello list, I noticed that when I run the command gpupdate in the
> clients I get the following error
> 
> C:>gpupdate
> Updating policy...
> 
> Computer policy could not be updated successfully. The following
> errors were enc ountered:
> The processing of Group Policy failed. Windows attempted to read the
> file \eccm
> g.cupet.cusysvoldomainPolicies{31B2F340-016D-11D2-945F-00C04FB984F9}
> gpt.ini from a domain controller and was not successful.
> 
> That policy I delete it, however the client PC keeps looking for it,
> some way to fix this ... use samba4 Version 4.9.1
It is called 'Default' for a reason, so put it back and don't
delete it again (and if you also deleted the other default policy, put
that back as well)

Rowland

> read the file \eccm
> g.cupet.cusysvoldomainPolicies{31B2F340-016D-11D2-945F-00C04FB984F9}
> gpt.ini from a domain controller and was not successful.

That is just an incorrect configured sysvol share.
The computer computer$ impersonates itself through user SYSTEM. 
And that one does not have rights to gpt.ini. 

Same for you...  
I suggest, start reading here, it explains all. 
https://lists.samba.org/archive/samba/2018-February/213690.html 

My output on with 4.8.6. 

C:\>gpupdate
Updating policy...

Computer Policy update has completed successfully.
User Policy update has completed successfully.


And this works as of samba 4.4.x and up for me. 
And yes, this is a bit a work around some nasty bugs but its working fine here.

I install software/certifcates, create local users, change/add localgroups to
computers, deploy printers, etc.
All done with GPO, and yes, it was hell to get it working. 


Greetz, 

Louis


> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Sandy via samba
> Verzonden: dinsdag 6 november 2018 15:54
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] GPUpdate
> 
> hello list, I noticed that when I run the command gpupdate in 
> the clients I get the following error
> 
> C:>gpupdate
> Updating policy...
> 
> Computer policy could not be updated successfully. The 
> following errors were enc
> ountered:
> The processing of Group Policy failed. Windows attempted to 
> read the file \eccm
> g.cupet.cusysvoldomainPolicies{31B2F340-016D-11D2-945F-00C04FB984F9}
> gpt.ini from a domain controller and was not successful.
> 
> That policy I delete it, however the client PC keeps looking 
> for it, some way to fix this ... use samba4 Version 4.9.1
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

On Tue, 6 Nov 2018 16:14:11 +0100
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
>  
> > read the file \eccm
> > g.cupet.cusysvoldomainPolicies{31B2F340-016D-11D2-945F-00C04FB984F9}
> > gpt.ini from a domain controller and was not successful.
> 
> 
> That is just an incorrect configured sysvol share.
> The computer computer$ impersonates itself through user SYSTEM. 
> And that one does not have rights to gpt.ini. 
> 
> Same for you...  
> I suggest, start reading here, it explains all. 
> https://lists.samba.org/archive/samba/2018-February/213690.html 
> 
> My output on with 4.8.6. 
> 
> C:\>gpupdate
> Updating policy...
> 
> Computer Policy update has completed successfully.
> User Policy update has completed successfully.
> 
> 
> And this works as of samba 4.4.x and up for me. 
> And yes, this is a bit a work around some nasty bugs but its working
> fine here.
> 
> I install software/certifcates, create local users, change/add
> localgroups to computers, deploy printers, etc. All done with GPO,
> and yes, it was hell to get it working. 
> 
> 
> Greetz, 
> 
Yes, but do you delete the default Policies that are hardcoded into AD ?

Rowland

I just deleted one that I had created related to the WSUS, and it keeps giving
me the same error, the two that come from defects remain there have not been
eliminated, the funny thing is that if I try to create a new one, it tells me
The system can not find the file specified,

On Tue, 06 Nov 2018 15:48:49 +0000
sandy.napoles at eccmg.cupet.cu wrote:
> no I delete only 31B2F340-016D-11D2-945F-00C04FB984F9, the default
> exist
> 
That is the default domain GPO, it is hardcoded in AD, put it back,
don't touch it again.

The other default GPO is for the DC and has the guid
{6AC1786C-016F-11D2-945F-00C04FB984F9}

Rowland

> Yes, but do you delete the default Policies that are 
> hardcoded into AD ?
> 
> Rowland
> 
> 
You mean the default Default Domain policies. 
No, but i've never done that and im using these so im not deleting them :-) 

And stupid me i forgot the most important one.

Open the registry editor and locate the below path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Create the DWORD value If the WaitForNetwork, if the value is not exists. Set
the value to 1.
Close the registry editor and restart the computer

I've set that by GPO, wait for network is very important. 
The start of computers with SSD is so fast, network the not ready yet. 

And these are as far as i know, not hardcoded, these are just files. 
You should be able to remove all policies and start fresh. 

And access denied on gpt.ini is a computer 

Greetz, 

Louis

the big question, how do I restore it again

On Tue, 06 Nov 2018 17:18:27 +0000
Sandy via samba <samba at lists.samba.org> wrote:
> the big question, how do I restore it again
> 
I take it that 'sysvol' is at /var/lib/samba, change it if it isn't,
replace 'domain.tld' with your dns domain.

mkdir -p
/var/lib/samba/sysvol/domain.tld/Policies/\{31B2F340-016D-11D2-945F-00C04FB984F9\}/MACHINE/

mkdir
/var/lib/samba/sysvol/domain.tld/Policies/\{31B2F340-016D-11D2-945F-00C04FB984F9\}/USER/

touch
/var/lib/samba/sysvol/domain.tld/Policies/\{31B2F340-016D-11D2-945F-00C04FB984F9\}/GPT.INI

Now use Louis's instructions to set the permissions from Windows.

Rowland