Hello list,
I have problems with my PDC Samba Servers and all file servers.
All DC Server have a compiled Samba 4.4.5. File servers have Samba
Debian packages.
In all shared folders, the ACL has the group "Everyone" and I
can't
remove it.
The biggest problem concern SYSVOL, I can't modify GPO, I have an error
in MMC.
I have tried to resolv the problem with the "samba-tool ntacl
sysvolreset" command but it didn't resolv anything.
#samba-tool ntacl sysvolcheck
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception -
ProvisioningError: DB ACL on GPO file
//usr/local/samba/var/locks/sysvol/campuslr.cma17/Policies//{31B2F340-016D-11D2-945F-00C04FB984F9}/USER/Preferences/Groups/Groups.xml
O:BAG:DUD:(A;;0x001f01ff;;;DA)(A;;0x001f01ff;;;EA)(A;;0x001f01ff;;;BA)(A;;0x001f01ff;;;SY)(A;;0x001200a9;;;AU)(A;;0x001200a9;;;ED)
does not match expected value
O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)
from GPO object
File
"//usr/local/samba/lib/python2.7/site-packages/samba/netcmd//__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/ntacl.py",
line 270, in run
lp)
File
"//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py",
line 1732, in checksysvolacl
direct_db_access)
File
"//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py",
line 1683, in check_gpos_acl
domainsid, direct_db_access)
File
"//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py",
line 1640, in check_dir_acl
raise ProvisioningError('%s ACL on GPO file %s %s does not match
expected value %s from GPO object' % (acl_type(direct_db_access),
os.path.join(root, name), fsacl_sddl, acl))
# samba-tool dbcheck
Checking 2591 objects
Checked 2591 objects (0 errors)
# samba-tool gpo aclcheck
ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No
such element'
File
"//usr/local/samba/lib/python2.7/site-packages/samba/netcmd//__init__.py",
line 175, in _run
return self.run(*args, **kwargs)
File
"/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/gpo.py",
line
1150, in run
ds_sd_ndr = m['nTSecurityDescriptor'][0]
I tried to reinstall DC2, but then the problem extended itself to DC2.
I have the same problem on the fileservers.
I don't know where is the problem. Moreover I have a second Samba domain
without this problem.
Best regards,
Kevin
On Sat, 26 Nov 2016 11:44:50 +0100 Kévin GUERINEAU via samba <samba at lists.samba.org> wrote:> Hello list, > > I have problems with my PDC Samba Servers and all file servers. > All DC Server have a compiled Samba 4.4.5. File servers have Samba > Debian packages. > > In all shared folders, the ACL has the group "Everyone" and I can't > remove it. > The biggest problem concern SYSVOL, I can't modify GPO, I have an > error in MMC. > I have tried to resolv the problem with the "samba-tool ntacl > sysvolreset" command but it didn't resolv anything. > > > #samba-tool ntacl sysvolcheck > ERROR(<class 'samba.provision.ProvisioningError'>): uncaught > exception - ProvisioningError: DB ACL on GPO file > //usr/local/samba/var/locks/sysvol/campuslr.cma17/Policies//{31B2F340-016D-11D2-945F-00C04FB984F9}/USER/Preferences/Groups/Groups.xml > O:BAG:DUD:(A;;0x001f01ff;;;DA)(A;;0x001f01ff;;;EA)(A;;0x001f01ff;;;BA)(A;;0x001f01ff;;;SY)(A;;0x001200a9;;;AU)(A;;0x001200a9;;;ED) > does not match expected value > O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) > from GPO object > File > "//usr/local/samba/lib/python2.7/site-packages/samba/netcmd//__init__.py", > line 175, in _run > return self.run(*args, **kwargs) > File > "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/ntacl.py", > line 270, in run > lp) > File > "//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py", > line 1732, in checksysvolacl > direct_db_access) > File > "//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py", > line 1683, in check_gpos_acl > domainsid, direct_db_access) > File > "//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py", > line 1640, in check_dir_acl > raise ProvisioningError('%s ACL on GPO file %s %s does not match > expected value %s from GPO object' % (acl_type(direct_db_access), > os.path.join(root, name), fsacl_sddl, acl)) > > # samba-tool dbcheck > Checking 2591 objects > Checked 2591 objects (0 errors) > > # samba-tool gpo aclcheck > ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such > element' File > "//usr/local/samba/lib/python2.7/site-packages/samba/netcmd//__init__.py", > line 175, in _run > return self.run(*args, **kwargs) > File > "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/gpo.py", > line 1150, in run > ds_sd_ndr = m['nTSecurityDescriptor'][0] > > > I tried to reinstall DC2, but then the problem extended itself to DC2. > I have the same problem on the fileservers. > I don't know where is the problem. Moreover I have a second Samba > domain without this problem. > > Best regards, > KevinHave you tried 'samba-tool ntacl sysvolreset' Rowland PS Don't refer to your AD DC as a PDC, that is something else entirely ;-)
Yes, I have. But nothing change... Kevin Le 26/11/2016 à 12:08, Rowland Penny via samba a écrit :> On Sat, 26 Nov 2016 11:44:50 +0100 > Kévin GUERINEAU via samba <samba at lists.samba.org> wrote: > >> Hello list, >> >> I have problems with my PDC Samba Servers and all file servers. >> All DC Server have a compiled Samba 4.4.5. File servers have Samba >> Debian packages. >> >> In all shared folders, the ACL has the group "Everyone" and I can't >> remove it. >> The biggest problem concern SYSVOL, I can't modify GPO, I have an >> error in MMC. >> I have tried to resolv the problem with the "samba-tool ntacl >> sysvolreset" command but it didn't resolv anything. >> >> >> #samba-tool ntacl sysvolcheck >> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught >> exception - ProvisioningError: DB ACL on GPO file >> //usr/local/samba/var/locks/sysvol/campuslr.cma17/Policies//{31B2F340-016D-11D2-945F-00C04FB984F9}/USER/Preferences/Groups/Groups.xml >> O:BAG:DUD:(A;;0x001f01ff;;;DA)(A;;0x001f01ff;;;EA)(A;;0x001f01ff;;;BA)(A;;0x001f01ff;;;SY)(A;;0x001200a9;;;AU)(A;;0x001200a9;;;ED) >> does not match expected value >> O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) >> from GPO object >> File >> "//usr/local/samba/lib/python2.7/site-packages/samba/netcmd//__init__.py", >> line 175, in _run >> return self.run(*args, **kwargs) >> File >> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/ntacl.py", >> line 270, in run >> lp) >> File >> "//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py", >> line 1732, in checksysvolacl >> direct_db_access) >> File >> "//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py", >> line 1683, in check_gpos_acl >> domainsid, direct_db_access) >> File >> "//usr/local/samba/lib/python2.7/site-packages/samba/provision//__init__.py", >> line 1640, in check_dir_acl >> raise ProvisioningError('%s ACL on GPO file %s %s does not match >> expected value %s from GPO object' % (acl_type(direct_db_access), >> os.path.join(root, name), fsacl_sddl, acl)) >> >> # samba-tool dbcheck >> Checking 2591 objects >> Checked 2591 objects (0 errors) >> >> # samba-tool gpo aclcheck >> ERROR(<type 'exceptions.KeyError'>): uncaught exception - 'No such >> element' File >> "//usr/local/samba/lib/python2.7/site-packages/samba/netcmd//__init__.py", >> line 175, in _run >> return self.run(*args, **kwargs) >> File >> "/usr/local/samba/lib/python2.7/site-packages/samba/netcmd/gpo.py", >> line 1150, in run >> ds_sd_ndr = m['nTSecurityDescriptor'][0] >> >> >> I tried to reinstall DC2, but then the problem extended itself to DC2. >> I have the same problem on the fileservers. >> I don't know where is the problem. Moreover I have a second Samba >> domain without this problem. >> >> Best regards, >> Kevin > Have you tried 'samba-tool ntacl sysvolreset' > > Rowland > > PS Don't refer to your AD DC as a PDC, that is something else > entirely ;-) >