samba - Aug 2022 - ERROR(runtime): uncaught exception - (3221225524, 'The object name is not found.')

I have to look into a Samba4 installation from a former colleague that 
has been running for the last two years reliably.

It's "old" unfortunately, version 4.11.6 and we are delaying the
upgrade
(scared of breaking it).

The administrator reported GPO related issues (GPO with new drive 
mappings via group membership seem not to be applied) and I tried the 
following:

a)
root at dmh002sv:/# samba-tool dbcheck
Checking 1173 objects
Checked 1173 objects (0 errors)
root at dmh002sv:/#

good

b)
root at dmh002sv:/# samba-tool gpo aclcheck -UAdministrator

Processing section "[netlogon]"
Processing section "[sysvol]"
Processing section "[usr_profiles]"
.. cut ..
Processing section "[vpn_certs]"
Processing section "[share_pool]"

ERROR(runtime): uncaught exception - (3221225524, 'The object name is 
not found.')
 ? File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py",
line
186, in _run
 ??? return self.run(*args, **kwargs)
 ? File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py", line
1581,
in run
 ??? fs_sd = conn.get_acl(sharepath, security.SECINFO_OWNER | 
security.SECINFO_GROUP | security.SECINFO_DACL, 
security.SEC_FLAG_MAXIMUM_ALLOWED)

Can someone point me where to start looking at? Because it has been 
running reliable and I am pretty sure that there have been GPO changes 
over the last two years, I suspect that maybe a recent GPO change is 
causing this but don't know how to find and isolate a most recent GPO 
change?

Thanks
Michael

On Mon, 2022-08-22 at 21:30 +1200, Michael Doerner | TechnologyWise via
samba wrote:
> I have to look into a Samba4 installation from a former colleague
> that 
> has been running for the last two years reliably.
> 
> It's "old" unfortunately, version 4.11.6 and we are delaying
the
> upgrade 
> (scared of breaking it).
I would be more scared about all the CVE's that have been fixed after
4.11.6
> 
> The administrator reported GPO related issues (GPO with new drive 
> mappings via group membership seem not to be applied) and I tried
> the 
> following:
> 
> a)
> root at dmh002sv:/# samba-tool dbcheck
> Checking 1173 objects
> Checked 1173 objects (0 errors)
> root at dmh002sv:/#
> 
> good
> 
> b)
> root at dmh002sv:/# samba-tool gpo aclcheck -UAdministrator
> 
> Processing section "[netlogon]"
> Processing section "[sysvol]"
> Processing section "[usr_profiles]"
> .. cut ..
> Processing section "[vpn_certs]"
> Processing section "[share_pool]"
> 
> ERROR(runtime): uncaught exception - (3221225524, 'The object name
> is 
> not found.')
>    File
"/usr/lib/python3/dist-packages/samba/netcmd/__init__.py",
> line 
> 186, in _run
>      return self.run(*args, **kwargs)
>    File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py",
line
> 1581, 
> in run
>      fs_sd = conn.get_acl(sharepath, security.SECINFO_OWNER | 
> security.SECINFO_GROUP | security.SECINFO_DACL, 
> security.SEC_FLAG_MAXIMUM_ALLOWED)
It seems that it cannot find the GPO on disc. GPO's are stored in AD
and on disc, so I would start by checking in sysvol.
Is this the only DC ?

Rowland

You can read and run :
https://raw.githubusercontent.com/thctlo/samba4/master/samba-check-set-sysvol.sh
That?s the sysvol default. 

It creates a file you can use to apply it but before you do compare it first. 
Use getfacl to see whats now on sysvol. 

also, check you resolving configuration.
/etc/resolv.conf still pointing the the correct DNS server(s)

its also handy to mention the OS your running on it. ? 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba <samba-bounces at lists.samba.org> Namens Michael Doerner
|
> TechnologyWise via samba
> Verzonden: maandag 22 augustus 2022 11:30
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] ERROR(runtime): uncaught exception - (3221225524,
> 'The object name is not found.')
> 
> I have to look into a Samba4 installation from a former colleague that has
> been running for the last two years reliably.
> 
> It's "old" unfortunately, version 4.11.6 and we are delaying
the upgrade
> (scared of breaking it).
> 
> The administrator reported GPO related issues (GPO with new drive
> mappings via group membership seem not to be applied) and I tried the
> following:
> 
> a)
> root at dmh002sv:/# samba-tool dbcheck
> Checking 1173 objects
> Checked 1173 objects (0 errors)
> root at dmh002sv:/#
> 
> good
> 
> b)
> root at dmh002sv:/# samba-tool gpo aclcheck -UAdministrator
> 
> Processing section "[netlogon]"
> Processing section "[sysvol]"
> Processing section "[usr_profiles]"
> .. cut ..
> Processing section "[vpn_certs]"
> Processing section "[share_pool]"
> 
> ERROR(runtime): uncaught exception - (3221225524, 'The object name is
not
> found.')
>    File
"/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 186,
> in _run
>      return self.run(*args, **kwargs)
>    File "/usr/lib/python3/dist-packages/samba/netcmd/gpo.py",
line 1581, in
> run
>      fs_sd = conn.get_acl(sharepath, security.SECINFO_OWNER |
> security.SECINFO_GROUP | security.SECINFO_DACL,
> security.SEC_FLAG_MAXIMUM_ALLOWED)
> 
> Can someone point me where to start looking at? Because it has been
> running reliable and I am pretty sure that there have been GPO changes over
> the last two years, I suspect that maybe a recent GPO change is causing
this
> but don't know how to find and isolate a most recent GPO change?
> 
> Thanks
> Michael
> 
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba