samba - Mar 2025 - GPO applied - icon not there

Let me ask something else I currently see at one of my customers:

2 Samba DCs, 4.21.4, Debian-12.9

(SYSVOL synced one-way, just adding ...)

We use GPOs for many years there (sure).

One of the GPOs places an icon on the Desktop, a link to some specific 
software.

The GPO is applied to all users in a specific group ... all 
employees/their domain users are members of this group.

This GPO works for many years also.

Now I prepare moving a server etc so I need a 2nd icon pointing to the 
new instance (another network drive, another working directory).

So I copied the old GPO, and edited the copy.

Same group ... new path, etc (new name, sure)

Now **most** of the members of the group get the new icon, but **some** 
do not get the icon (they tell me, I haven't yet seen it myself ... 
consider some strange display issue ... Can one icon be hidden behind 
another?).

And additionally:

if these users run "gpresult", the GPO is shown as executed. It's
not
filtered out somehow ... it looks as if it has been run successfully.

I created a **new* GPO (to rule out the copy-ing of an old GPO) and 
added another icon specifically for the problematic users. No icon on 
the desktop.

(yes, we tested "gpupdate /force", rebooting, etc)

Now what is that?

two of these users are old ... think samba-3 ... so maybe they have 
properties they shouldn't have or something

one is a rather new one, so this thesis is weak also

-

What do I miss here, what can I do to further debug this?

Thanks for any ideas, Stefan

This is a Windows issue, not Samba's.

Since October 2022 update of Windows 10, and due to security reasons, remote
paths in file shortcut icons have been disabled.

They have to be expressly enabled through Local GPOs, but Microsoft deems it
to be a security risk.

I ended up editing the GPOs to copy icon files from the DCs'
netlogon/scripts directory to a folder in the Public profile of the client
computers and applying them to the network shortcuts and folders from there.
This way, they are local resources and not considered as a security hazard
by Microsoft.

> This is a Windows issue, not Samba's.
> Since October 2022 update of Windows 10, and due to security reasons, 
> remote paths in file shortcut icons have been disabled.
> They have to be expressly enabled through Local GPOs, but Microsoft
> deems it to be a security risk.
> I ended up editing the GPOs to copy icon files from the DCs'
netlogon/scripts 
> directory to a folder in the Public profile of the client computers and
applying 
> them to the network shortcuts and folders from there. This way, they are
local 
> resources and not considered as a security hazard by Microsoft.
You can apply them using the %PUBLIC% variable in the icon path. In my case,
I use %PUBLIC%\Pictures\Icons\someicon.ico