Hi list, Today, I spent most of the day figuring out why my password policies set via GPO are not applied on a domain level, just to find out that this is not one of the many occasions where Windows is the problem but it's really Samba, for a change. Apparently, password policies can only be changed using samba-tool and not via GPO. IMO, the FAQ is not very clear here. https://wiki.samba.org/index.php/FAQ#Is_it_possible_to_set_user_specific_password_policies_in_Samba4_.28e._g._on_a_OU-base.29.3F It says Samba cannot handle GPO restrictions because they are not saved in the SysVol volume. But what is a GPO restriction? If I google for "GPO restrictions", the only results I get are about "Software restrictions using GPO" which does not seem to be the same. Can someone therefore please explain to me what exactly these GPO restrictions are that Samba can't handle? I'd also appreciate if someone could list which other GPO I cannot set successfully using RSAT. Cheers, Viktor
> Can someone therefore please explain to me what exactly these GPO > restrictions are that Samba can't handle? I'd also appreciate if someone > could list which other GPO I cannot set successfully using RSAT.It seems to me that the FAQ is pretty clear. The paragraph you quoted from ends like this: "It [Samba] only serves GPOs via the SysVol share." From the above statement one can infer that the relevant Microsoft documentation should be consulted in order to know which GPOs are served via the SysVol share. Those, and only those, are the GPOs Samba serves. Any other GPOs that Microsoft products eventually serve through other methods are not served by Samba. Really simple, isn't it?
> On 04 Jun 2016, at 22:14, Miguel Medalha <medalist at sapo.pt> wrote: > > >> Can someone therefore please explain to me what exactly these GPO >> restrictions are that Samba can't handle? I'd also appreciate if someone >> could list which other GPO I cannot set successfully using RSAT. > > It seems to me that the FAQ is pretty clear. The paragraph you quoted from ends like this: > > "It [Samba] only serves GPOs via the SysVol share." > > From the above statement one can infer that the relevant Microsoft documentation should be consulted in order to know which GPOs are served via the SysVol share. Those, and only those, are the GPOs Samba serves. Any other GPOs that Microsoft products eventually serve through other methods are not served by Samba. Really simple, isn't it? >Since you like pointing out how clear and simple everything is for you, how about making things simpler for me and pointing me to this "relevant documentation"? And if you believe that one sentence hidden in a FAQ somewhere makes this whole issue crystal clear, well, let's just say that I disagree. A wiki page on GPOs with Samba where some of the main issues are described would be a lot more helpful. Maybe I'll create one myself once I'm clear on all the facts.
Hi Viktor, Please follow the below link for step by step tutorial on GPO creation and setting up the restrictions as well, < http://www.tecmint.com/creating-organizational-units-and-enableing-group-policy-in-zentyal/>--Regards Ashishkumar S. Yadav On Sat, Jun 4, 2016 at 10:52 PM, Viktor Trojanovic <viktor at troja.ch> wrote:> Hi list, > > Today, I spent most of the day figuring out why my password policies set > via GPO are not applied on a domain level, just to find out that this is > not one of the many occasions where Windows is the problem but it's really > Samba, for a change. Apparently, password policies can only be changed > using samba-tool and not via GPO. > > IMO, the FAQ is not very clear here. > > > https://wiki.samba.org/index.php/FAQ#Is_it_possible_to_set_user_specific_password_policies_in_Samba4_.28e._g._on_a_OU-base.29.3F > > It says Samba cannot handle GPO restrictions because they are not saved in > the SysVol volume. But what is a GPO restriction? If I google for "GPO > restrictions", the only results I get are about "Software restrictions > using GPO" which does not seem to be the same. > > Can someone therefore please explain to me what exactly these GPO > restrictions are that Samba can't handle? I'd also appreciate if someone > could list which other GPO I cannot set successfully using RSAT. > > Cheers, > Viktor > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >