samba - Apr 2024 - GPO Editor says "Access denied" for Group Policy Objects

.. we setup 2 new DCs replacing older DCs and joined them to the domain, 
then decommissioned the old DCs. I now discover that I cannot edit the 
GPO objects anymore.
"sysvolcheck" shows no errors. I read through some documentation but
it
sounds outdated to me. Any hints where I would start looking? Who should 
normally be the owner of the sysvol directory itself?

What I find strange is that on a domain member, getent group shows me 
all Domain groups, while on the DC these are not shown.
But that might be totally unrelated.

Any hints?

Thank you and best regards, Jakob Curdes

On Thu, 25 Apr 2024 16:55:55 +0200
Jakob Curdes via samba <samba at lists.samba.org> wrote:
> .. we setup 2 new DCs replacing older DCs and joined them to the
> domain, then decommissioned the old DCs. I now discover that I cannot
> edit the GPO objects anymore.
> "sysvolcheck" shows no errors. I read through some documentation
but
> it sounds outdated to me. Any hints where I would start looking? Who
> should normally be the owner of the sysvol directory itself?
> 
> What I find strange is that on a domain member, getent group shows me 
> all Domain groups, while on the DC these are not shown.
> But that might be totally unrelated.
> 
> Any hints?
> 
Without more info, Anything would be guess work, but a guess in the
dark would be to ask if you are using rfc2307 attributes and if so,
does Domain Admins have a gidNumber attribute ?

Rowland