samba - Oct 2024 - Strange problem with GPOs

I am facing a strange problem with AD GPOs.

I have had numerous GPOs working correctly for years but now, following the
installation of new servers with a new Samba version, I am unable to create
a new GPO with RSAT. I can configure it alright but it fails when I try to
apply the respective rights under "Delegation > Advanced". As soon
as I
apply the permissions, it fails with the message "The security ID structure
is invalid". If I click "Advanced" again the program silently
exits. When I
execute the app again, the same message "The security ID structure is
invalid" appears and nothing can be done regarding the permissions. I then
have to do a sysvolreset on the DC. After the sysvolreset I execute the
Windows app again and I am greeted by "The specified server cannot perform
the requested operation." The app never restarts correctly again until the
newly created GPO is deleted.

Furthermore, every single operation on GPOs performed through the Windows
app needs to be followed by a sysvolreset because the permissions are
mangled. I can't believe that this has not been solved after all these
years. It is somewhat disturbing because GPOs are one of the most useful
features of AD.

The DCs are running Samba 4.20.5 over AlmaLinux 9.4. Their smb.conf is the
following:

[global]
	workgroup = MYDOMAIN
	realm = MYDOMAIN.COM
	server role = active directory domain controller
	dns forwarder = xxx.xxx.xxx.xxx
	disable netbios = yes
	ntlm auth = no
	client ipc signing = mandatory
	server min protocol = SMB2_10
	host msdfs = yes
	admin users = @"CIMBAL\Domain Admins"
	smb ports = 445
	disable spoolss = yes
	apply group policies = yes

[netlogon]
	path = /usr/local/samba/var/sysvol/lan.cimbal.pt/scripts
	read only = no
	browsable = yes
	vfs objects = dfs_samba4 acl_xattr

[sysvol]
	path = /usr/local/samba/var/sysvol
	read only = no
	browsable = yes
	vfs objects = dfs_samba4 acl_xattr

I was able to narrow down the issue. I can add groups to the GPO object at
will. The issue only arises when the option "Apply group policy" is
selected. I can even apply it to ONE group, but if I apply it to another
one, the Group Policy Management app silently quits. At this point the Group
Policy Object is corrupted and the only option is to delete it.

I can edit everything in a Group Policy Object except "Apply group
policy"
to a second AD group.

In sum, I cannot create new Group Policy Objects that apply to more than one
group, which is close to useless. This didn't happen before. I upgrade to
Samba 4.21.1 but the issue is still there.