So I ran a samba-tool ntacl sysvolcheck, and the following error message
came up:
--------------------snip--------------------
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception -
ProvisioningError: DB ACL on GPO directory
/var/lib/samba/sysvol/samdom.com/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Scripts/Startup
O:BAG:DUD:(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;;0x001f01ff;;;BA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)
does not match expected value
O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)
from GPO object
File "/usr/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python2.7/site-packages/samba/netcmd/ntacl.py", line
249, in run
lp)
File
"/usr/lib/python2.7/site-packages/samba/provision/__init__.py",
line 1733, in checksysvolacl
direct_db_access)
File
"/usr/lib/python2.7/site-packages/samba/provision/__init__.py",
line 1684, in check_gpos_acl
domainsid, direct_db_access)
File
"/usr/lib/python2.7/site-packages/samba/provision/__init__.py",
line 1650, in check_dir_acl
raise ProvisioningError('%s ACL on GPO directory %s %s does not
match expected value %s from GPO object' % (acl_type(direct_db_access),
os.path.join(root, name), fsacl_sddl, acl))
--------------------snip--------------------
The GPO directory in question is the Default Domain Policy.
Any idea what happened here? I never touched the DDD, it's still on
version 0, and I never did any changes to those files either. I manually
checked the ACL, without having made a diff on it, it looks pretty much
the same like the ACL on the other containers.
Is it safe to run sysvolreset?
Viktor
On 16.11.2015 09:34, L.P.H. van Belle wrote:> I guest,
>
> incorrect rights on you sysvol,
> Try : samba-tool ntacl sysvolreset
> And check the share rights.
>
> By default this should work out of the box.
> Did you change the sysvol rights?
>
>
> Greetz,
>
> Louis
>
>
>> -----Oorspronkelijk bericht-----
>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ole Traupe
>> Verzonden: maandag 16 november 2015 9:25
>> Aan: samba at lists.samba.org
>> Onderwerp: Re: [Samba] Win Clients and DNS
>>
>> Viktor, can you manually check whether you have DNS records for your
Win
>> clients?
>>
>> In the DNS settings for your Win clients' network adapters you can
>> uncheck that the current address shall be registered in DNS.
>>
>> Ole
>>
>>
>> Am 16.11.2015 um 01:31 schrieb Viktor Trojanovic:
>>> I have an AD with 1 Samba DC and 5 Windows 10 clients. The DC and
the
>>> clients all have a fixed IPv4 address.
>>>
>>> In the windows event viewer, I constantly see the following
warning:
>>>
>>> Event 8019, DNS Client Events
>>> ------------------------------------------
>>> The system failed to register host (A or AAA) resource records
(RRs)
>>> for network adapter with settings:
>>>
>>> Adapter Name: {someGUID}
>>> Host Name: Client-PC
>>> Primary Domain Suffix: SAMDOM.COM
>>> DNS Server list:
>>> 192.168.0.1
>>> Sent update to server: <?>
>>> IP Addresses:
>>> 192.168.0.15
>>> ------------------------------------------
>>>
>>> Is it necessary to manually make some entries in DNS for the client
>>> machines? I didn't see anything about that in the Wiki.
>>>
>>> I'm trying to figure out if this is connected to another
problem I'm
>>> facing. A machine based GPO is not executed because "the file
>>> \\SAMDOM.COM\SysVol\[...]\gpt.ini from a domain controller could
not
>>> be read", and as one of the possible reasons for the error,
name
>>> resolution is mentioned. I can access the file just fine once
I'm
>>> logged in so I really don't know what the issue is here.
>>>
>>> Thanks,
>>> Viktor
>>>
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions: https://lists.samba.org/mailman/options/samba
>
>
On 16/11/15 11:19, Viktor Trojanovic wrote:> So I ran a samba-tool ntacl sysvolcheck, and the following error > message came up: > > --------------------snip-------------------- > ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception > - ProvisioningError: DB ACL on GPO directory > /var/lib/samba/sysvol/samdom.com/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Scripts/Startup > O:BAG:DUD:(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;;0x001f01ff;;;BA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) > does not match expected value > O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) > from GPO object > File "/usr/lib/python2.7/site-packages/samba/netcmd/__init__.py", > line 175, in _run > return self.run(*args, **kwargs) > File "/usr/lib/python2.7/site-packages/samba/netcmd/ntacl.py", line > 249, in run > lp) > File "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", > line 1733, in checksysvolacl > direct_db_access) > File "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", > line 1684, in check_gpos_acl > domainsid, direct_db_access) > File "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", > line 1650, in check_dir_acl > raise ProvisioningError('%s ACL on GPO directory %s %s does not > match expected value %s from GPO object' % > (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl, acl)) > --------------------snip-------------------- > > The GPO directory in question is the Default Domain Policy. > > Any idea what happened here? I never touched the DDD, it's still on > version 0, and I never did any changes to those files either. I > manually checked the ACL, without having made a diff on it, it looks > pretty much the same like the ACL on the other containers. > > Is it safe to run sysvolreset? > > Viktor > > On 16.11.2015 09:34, L.P.H. van Belle wrote: >> I guest, >> >> incorrect rights on you sysvol, >> Try : samba-tool ntacl sysvolreset >> And check the share rights. >> >> By default this should work out of the box. >> Did you change the sysvol rights? >> >> >> Greetz, >> >> Louis >> >> >>> -----Oorspronkelijk bericht----- >>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ole Traupe >>> Verzonden: maandag 16 november 2015 9:25 >>> Aan: samba at lists.samba.org >>> Onderwerp: Re: [Samba] Win Clients and DNS >>> >>> Viktor, can you manually check whether you have DNS records for your >>> Win >>> clients? >>> >>> In the DNS settings for your Win clients' network adapters you can >>> uncheck that the current address shall be registered in DNS. >>> >>> Ole >>> >>> >>> Am 16.11.2015 um 01:31 schrieb Viktor Trojanovic: >>>> I have an AD with 1 Samba DC and 5 Windows 10 clients. The DC and the >>>> clients all have a fixed IPv4 address. >>>> >>>> In the windows event viewer, I constantly see the following warning: >>>> >>>> Event 8019, DNS Client Events >>>> ------------------------------------------ >>>> The system failed to register host (A or AAA) resource records (RRs) >>>> for network adapter with settings: >>>> >>>> Adapter Name: {someGUID} >>>> Host Name: Client-PC >>>> Primary Domain Suffix: SAMDOM.COM >>>> DNS Server list: >>>> 192.168.0.1 >>>> Sent update to server: <?> >>>> IP Addresses: >>>> 192.168.0.15 >>>> ------------------------------------------ >>>> >>>> Is it necessary to manually make some entries in DNS for the client >>>> machines? I didn't see anything about that in the Wiki. >>>> >>>> I'm trying to figure out if this is connected to another problem I'm >>>> facing. A machine based GPO is not executed because "the file >>>> \\SAMDOM.COM\SysVol\[...]\gpt.ini from a domain controller could not >>>> be read", and as one of the possible reasons for the error, name >>>> resolution is mentioned. I can access the file just fine once I'm >>>> logged in so I really don't know what the issue is here. >>>> >>>> Thanks, >>>> Viktor >>>> >>> >>> -- >>> To unsubscribe from this list go to the following URL and read the >>> instructions: https://lists.samba.org/mailman/options/samba >> >> > >Firstly, have you changed anything on the DC after provision? I don't mean adding users or groups, but anything else? I think if you examine what samba-tool thinks is different, you will find that it is only these: O:BAG:DUD and O:DAG:DAD To turn these into English :-) O = owner BA = BUILTIN\Administrators G = group DU = Domain Users DA = Domain Administrators BA becoming DA is fairly common and I don't think is relevant But somehow DA has become DU That is why I asked if you have changed anything. Now as for do your computers A and PTR records need to be added to AD, try this on the DC: ping -c1 member1 where 'member1' is the hostname of one of your workstations, it should return something like this: PING member1.samdom.example.com (192.168.0.2) 56(84) bytes of data. 64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.261 ms --- member1.samdom.example.com ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.261/0.261/0.261/0.000 ms Not like this: ping: unknown host member1 If you get the later, you need to add the records manually. Rowland
See replies below On 16.11.2015 12:39, Rowland Penny wrote:> On 16/11/15 11:19, Viktor Trojanovic wrote: >> So I ran a samba-tool ntacl sysvolcheck, and the following error >> message came up: >> >> --------------------snip-------------------- >> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught >> exception - ProvisioningError: DB ACL on GPO directory >> /var/lib/samba/sysvol/samdom.com/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Scripts/Startup >> O:BAG:DUD:(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;;0x001f01ff;;;BA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) >> does not match expected value >> O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) >> from GPO object >> File "/usr/lib/python2.7/site-packages/samba/netcmd/__init__.py", >> line 175, in _run >> return self.run(*args, **kwargs) >> File "/usr/lib/python2.7/site-packages/samba/netcmd/ntacl.py", line >> 249, in run >> lp) >> File >> "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", line >> 1733, in checksysvolacl >> direct_db_access) >> File >> "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", line >> 1684, in check_gpos_acl >> domainsid, direct_db_access) >> File >> "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", line >> 1650, in check_dir_acl >> raise ProvisioningError('%s ACL on GPO directory %s %s does not >> match expected value %s from GPO object' % >> (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl, acl)) >> --------------------snip-------------------- >> >> The GPO directory in question is the Default Domain Policy. >> >> Any idea what happened here? I never touched the DDD, it's still on >> version 0, and I never did any changes to those files either. I >> manually checked the ACL, without having made a diff on it, it looks >> pretty much the same like the ACL on the other containers. >> >> Is it safe to run sysvolreset? >> >> Viktor >> >> On 16.11.2015 09:34, L.P.H. van Belle wrote: >>> I guest, >>> >>> incorrect rights on you sysvol, >>> Try : samba-tool ntacl sysvolreset >>> And check the share rights. >>> >>> By default this should work out of the box. >>> Did you change the sysvol rights? >>> >>> >>> Greetz, >>> >>> Louis >>> >>> >>>> -----Oorspronkelijk bericht----- >>>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ole Traupe >>>> Verzonden: maandag 16 november 2015 9:25 >>>> Aan: samba at lists.samba.org >>>> Onderwerp: Re: [Samba] Win Clients and DNS >>>> >>>> Viktor, can you manually check whether you have DNS records for >>>> your Win >>>> clients? >>>> >>>> In the DNS settings for your Win clients' network adapters you can >>>> uncheck that the current address shall be registered in DNS. >>>> >>>> Ole >>>> >>>> >>>> Am 16.11.2015 um 01:31 schrieb Viktor Trojanovic: >>>>> I have an AD with 1 Samba DC and 5 Windows 10 clients. The DC and the >>>>> clients all have a fixed IPv4 address. >>>>> >>>>> In the windows event viewer, I constantly see the following warning: >>>>> >>>>> Event 8019, DNS Client Events >>>>> ------------------------------------------ >>>>> The system failed to register host (A or AAA) resource records (RRs) >>>>> for network adapter with settings: >>>>> >>>>> Adapter Name: {someGUID} >>>>> Host Name: Client-PC >>>>> Primary Domain Suffix: SAMDOM.COM >>>>> DNS Server list: >>>>> 192.168.0.1 >>>>> Sent update to server: <?> >>>>> IP Addresses: >>>>> 192.168.0.15 >>>>> ------------------------------------------ >>>>> >>>>> Is it necessary to manually make some entries in DNS for the client >>>>> machines? I didn't see anything about that in the Wiki. >>>>> >>>>> I'm trying to figure out if this is connected to another problem I'm >>>>> facing. A machine based GPO is not executed because "the file >>>>> \\SAMDOM.COM\SysVol\[...]\gpt.ini from a domain controller could not >>>>> be read", and as one of the possible reasons for the error, name >>>>> resolution is mentioned. I can access the file just fine once I'm >>>>> logged in so I really don't know what the issue is here. >>>>> >>>>> Thanks, >>>>> Viktor >>>>> >>>> >>>> -- >>>> To unsubscribe from this list go to the following URL and read the >>>> instructions: https://lists.samba.org/mailman/options/samba >>> >>> >> >> > > Firstly, have you changed anything on the DC after provision? I don't > mean adding users or groups, but anything else? > > I think if you examine what samba-tool thinks is different, you will > find that it is only these: > > O:BAG:DUD and O:DAG:DAD > > To turn these into English :-) > > O = owner > BA = BUILTIN\Administrators > G = group > DU = Domain Users > DA = Domain Administrators > > BA becoming DA is fairly common and I don't think is relevant > But somehow DA has become DU >Yes, those are the ACL's I see, BA is the owner, DA has full rights, DU can read.> That is why I asked if you have changed anything. >No, I haven't. Please also check my new thread about the ACL issue.> Now as for do your computers A and PTR records need to be added to AD, > try this on the DC: > > ping -c1 member1 > > where 'member1' is the hostname of one of your workstations, it should > return something like this: > > PING member1.samdom.example.com (192.168.0.2) 56(84) bytes of data. > 64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.261 ms > > >This is making things even more confusing.. if I enter the DNS records, then the command nslookup clientname will provide the correct IP address. Ping doesn't work for half of the clients but it doesn't work even using the IP address. Seems like the firewall is blocking it which is again really weird because I didn't make any changes and all clients are exactly the same.