samba - Jun 2017 - GPO Problem

Thanks Elias.

But I run samba-tool ntacl sysvolreset and:


root at DC02:~# samba-tool ntacl sysvolreset
lp_load_ex: refreshing parameters
Initialising global parameters
Processing section "[global]"
Processing section "[netlogon]"
Processing section "[sysvol]"
Processing section "[sistemas]"
ldb_wrap open of idmap.ldb
lp_load_ex: refreshing parameters
Processing section "[global]"
Processing section "[netlogon]"
Processing section "[sysvol]"
Processing section "[sistemas]"
Module 'acl_xattr' loaded
Module 'dfs_samba4' loaded
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service Unknown Service (snum == -1)
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service Unknown Service (snum == -1)
lp_load_ex: refreshing parameters
Processing section "[global]"
Processing section "[netlogon]"
Processing section "[sysvol]"
Processing section "[sistemas]"
ldb_wrap open of idmap.ldb
ldb_wrap open of idmap.ldb
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol
connect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
'force unknown acl user = true' for service sysvol


know that means?



2017-06-07 14:01 GMT-03:00 Elias Pereira <empbilly at gmail.com>:
> Maybe this link help.
> https://wiki.samba.org/index.php/Updating_Samba#Fixing_
> Incorrect_Sysvol_and_Directory_ACLs
>
> On Tue, Jun 6, 2017 at 4:09 PM, Epsilon Minus via samba <
> samba at lists.samba.org> wrote:
>
>> 2017-06-06 15:54 GMT-03:00 Rowland Penny via samba <samba at
lists.samba.org
>> >:
>> > On Tue, 6 Jun 2017 15:35:42 -0300
>> > Epsilon Minus via samba <samba at lists.samba.org> wrote:
>> >
>> >> Hi. I have a problem applying GPO. I do not know where to look
>> >> Reviewing I found this:
>> >>
>> >> # samba-tool ntacl sysvolcheck
>> >> lp_load_ex: refreshing parameters
>> >> Initialising global parameters
>> >> Processing section "[global]"
>> >> Processing section "[netlogon]"
>> >> Processing section "[sysvol]"
>> >> Processing section "[sistemas]"
>> >> ldb_wrap open of idmap.ldb
>> >> Module 'acl_xattr' loaded
>> >> Module 'dfs_samba4' loaded
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>> >> and 'force unknown acl user = true' for service sysvol
>> >> #
>> >>
>> >>
>> >> My smb.conf:
>> >> oot at DC02:~# cat /etc/samba/smb.conf
>> >>
>> >> # Global parameters
>> >> [global]
>> >>     workgroup = CLINICAGUEMES
>> >>     realm = CLINICAGUEMES.COM.AR
>> >>     netbios name = DC02
>> >>     server role = active directory domain controller
>> >>     server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc,
drepl,
>> >> winbindd, ntp_signd, kcc, dnsupdate
>> >>     idmap_ldb:use rfc2307 = yes
>> >>     ldap server require strong auth = No
>> >>     log level = 3
>> >>
>> >>     #### Deshabilito error en los logs por las impresoras
>> >>     load printers = no
>> >>         printing = bsd
>> >>         printcap name = /dev/null
>> >>         disable spoolss = yes
>> >>
>> >>
>> >> [netlogon]
>> >>     path = /var/lib/samba/sysvol/clinicaguemes.com.ar/scripts
>> >>     read only = No
>> >>
>> >> [sysvol]
>> >>     path = /var/lib/samba/sysvol
>> >>     read only = No
>> >>
>> >> [sistemas]
>> >>     path = /datos/grupos/sistemas
>> >>     read only = No
>> >>     valid users = +sistemas
>> >>
>> >>
>> >> Is ok this? :
>> >>
>> >> root at DC02:/var/lib/samba# ls -l
>> >> total 1404
>> >> -rw-------   1 root root       421888 nov 21  2016
account_policy.tdb
>> >> -rw-------   1 root root          696 nov 21  2016
group_mapping.tdb
>> >> drwxr-x---   2 root root         4096 ene 24 21:04 ntp_signd
>> >> drwxr-xr-x  10 root root         4096 nov 21  2016 printers
>> >> drwxr-xr-x   7 root root         4096 jun  6 15:33 private
>> >> -rw-------   1 root root       528384 nov 21  2016
registry.tdb
>> >> -rw-------   1 root root       421888 nov 21  2016
share_info.tdb
>> >> drwxrwx---+  3 root    3000000   4096 jun  6 15:19 sysvol
>> >> <<<<----------  is okey ?
>> >> drwxrwx--T   2 root sambashare   4096 nov 21  2016 usershares
>> >> -rw-------   1 root root        32768 jun  5 22:54
winbindd_cache.tdb
>> >> drwxr-x---   2 root root         4096 ene 24 21:04
winbindd_privileged
>> >>
>> >>
>> >>
>> >>
>> >>
>> >> I do not know where to look for the logs to apply the GPOs
>> >>
>> >
>> > Not sure about the GPO (I don't use them), but the owner:group
on
>> > sysvol is okay.
>> >
>> > Also, you cannot use 'valid users' on a DC, you need to
set the ACLs
>> > from windows.
>> >
>> > Rowland
>> >
>> > --
>> > To unsubscribe from this list go to the following URL and read the
>> > instructions:  https://lists.samba.org/mailman/options/samba
>>
>> Thanks you. I remove "valid user" but the error continius.
>>
>> Add new information:
>>
>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar# samba-tool gpo
>> aclcheck
>> ldb_wrap open of secrets.ldb
>> GENSEC backend 'gssapi_spnego' registered
>> GENSEC backend 'gssapi_krb5' registered
>> GENSEC backend 'gssapi_krb5_sasl' registered
>> GENSEC backend 'spnego' registered
>> GENSEC backend 'schannel' registered
>> GENSEC backend 'naclrpc_as_system' registered
>> GENSEC backend 'sasl-EXTERNAL' registered
>> GENSEC backend 'ntlmssp' registered
>> GENSEC backend 'ntlmssp_resume_ccache' registered
>> GENSEC backend 'http_basic' registered
>> GENSEC backend 'http_ntlm' registered
>> GENSEC backend 'krb5' registered
>> GENSEC backend 'fake_gssapi_krb5' registered
>> resolve_lmhosts: Attempting lmhosts lookup for name
>> _ldap._tcp.CLINICAGUEMES.COM.AR<0x0>
>> resolve_lmhosts: Attempting lmhosts lookup for name
>> _ldap._tcp.CLINICAGUEMES.COM.AR<0x0>
>> resolve_lmhosts: Attempting lmhosts lookup for name
>> dc01.clinicaguemes.com.ar<0x20>
>> resolve_lmhosts: Attempting lmhosts lookup for name
>> dc01.clinicaguemes.com.ar<0x20>
>> ERROR(runtime): uncaught exception - (-1073741766, '{Path Not
Found}
>> The path %hs does not exist.')
>>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
>> line 175, in _run
>>     return self.run(*args, **kwargs)
>>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.py", line
>> 1148, in run
>>     fs_sd = conn.get_acl(sharepath, security.SECINFO_OWNER |
>> security.SECINFO_GROUP | security.SECINFO_DACL,
>> security.SEC_FLAG_MAXIMUM_ALLOWED)
>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar#
>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar#
>>
>>
>> Excuse me. I'm not mean those erros.
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>>
>
>
>
> --
> Elias Pereira
>

>
> onnect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
> 'force unknown acl user = true' for service Unknown Service (snum
== -1)
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service Unknown Service (snum
== -1)
> lp_load_ex: refreshing parameters

What can understand about this error is that you are using permissions via
posix and somehow this "unknown service" error is occurring.

Remove "valid users = + systems" and set acls by windows

https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs

On Tue, Jun 13, 2017 at 11:17 AM, Epsilon Minus <theepsilonminus at
gmail.com>
wrote:
> Thanks Elias.
>
> But I run samba-tool ntacl sysvolreset and:
>
>
> root at DC02:~# samba-tool ntacl sysvolreset
> lp_load_ex: refreshing parameters
> Initialising global parameters
> Processing section "[global]"
> Processing section "[netlogon]"
> Processing section "[sysvol]"
> Processing section "[sistemas]"
> ldb_wrap open of idmap.ldb
> lp_load_ex: refreshing parameters
> Processing section "[global]"
> Processing section "[netlogon]"
> Processing section "[sysvol]"
> Processing section "[sistemas]"
> Module 'acl_xattr' loaded
> Module 'dfs_samba4' loaded
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service Unknown Service (snum
== -1)
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service Unknown Service (snum
== -1)
> lp_load_ex: refreshing parameters
> Processing section "[global]"
> Processing section "[netlogon]"
> Processing section "[sysvol]"
> Processing section "[sistemas]"
> ldb_wrap open of idmap.ldb
> ldb_wrap open of idmap.ldb
>
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
> connect_acl_xattr: setting 'inherit acls = true' 'dos filemode
= true' and
> 'force unknown acl user = true' for service sysvol
>
>
> know that means?
>
>
>
> 2017-06-07 14:01 GMT-03:00 Elias Pereira <empbilly at gmail.com>:
>
>> Maybe this link help.
>> https://wiki.samba.org/index.php/Updating_Samba#Fixing_Incor
>> rect_Sysvol_and_Directory_ACLs
>>
>> On Tue, Jun 6, 2017 at 4:09 PM, Epsilon Minus via samba <
>> samba at lists.samba.org> wrote:
>>
>>> 2017-06-06 15:54 GMT-03:00 Rowland Penny via samba <
>>> samba at lists.samba.org>:
>>> > On Tue, 6 Jun 2017 15:35:42 -0300
>>> > Epsilon Minus via samba <samba at lists.samba.org>
wrote:
>>> >
>>> >> Hi. I have a problem applying GPO. I do not know where to
look
>>> >> Reviewing I found this:
>>> >>
>>> >> # samba-tool ntacl sysvolcheck
>>> >> lp_load_ex: refreshing parameters
>>> >> Initialising global parameters
>>> >> Processing section "[global]"
>>> >> Processing section "[netlogon]"
>>> >> Processing section "[sysvol]"
>>> >> Processing section "[sistemas]"
>>> >> ldb_wrap open of idmap.ldb
>>> >> Module 'acl_xattr' loaded
>>> >> Module 'dfs_samba4' loaded
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> connect_acl_xattr: setting 'inherit acls = true'
'dos filemode = true'
>>> >> and 'force unknown acl user = true' for service
sysvol
>>> >> #
>>> >>
>>> >>
>>> >> My smb.conf:
>>> >> oot at DC02:~# cat /etc/samba/smb.conf
>>> >>
>>> >> # Global parameters
>>> >> [global]
>>> >>     workgroup = CLINICAGUEMES
>>> >>     realm = CLINICAGUEMES.COM.AR
>>> >>     netbios name = DC02
>>> >>     server role = active directory domain controller
>>> >>     server services = s3fs, rpc, nbt, wrepl, ldap, cldap,
kdc, drepl,
>>> >> winbindd, ntp_signd, kcc, dnsupdate
>>> >>     idmap_ldb:use rfc2307 = yes
>>> >>     ldap server require strong auth = No
>>> >>     log level = 3
>>> >>
>>> >>     #### Deshabilito error en los logs por las impresoras
>>> >>     load printers = no
>>> >>         printing = bsd
>>> >>         printcap name = /dev/null
>>> >>         disable spoolss = yes
>>> >>
>>> >>
>>> >> [netlogon]
>>> >>     path =
/var/lib/samba/sysvol/clinicaguemes.com.ar/scripts
>>> >>     read only = No
>>> >>
>>> >> [sysvol]
>>> >>     path = /var/lib/samba/sysvol
>>> >>     read only = No
>>> >>
>>> >> [sistemas]
>>> >>     path = /datos/grupos/sistemas
>>> >>     read only = No
>>> >>     valid users = +sistemas
>>> >>
>>> >>
>>> >> Is ok this? :
>>> >>
>>> >> root at DC02:/var/lib/samba# ls -l
>>> >> total 1404
>>> >> -rw-------   1 root root       421888 nov 21  2016
account_policy.tdb
>>> >> -rw-------   1 root root          696 nov 21  2016
group_mapping.tdb
>>> >> drwxr-x---   2 root root         4096 ene 24 21:04
ntp_signd
>>> >> drwxr-xr-x  10 root root         4096 nov 21  2016
printers
>>> >> drwxr-xr-x   7 root root         4096 jun  6 15:33 private
>>> >> -rw-------   1 root root       528384 nov 21  2016
registry.tdb
>>> >> -rw-------   1 root root       421888 nov 21  2016
share_info.tdb
>>> >> drwxrwx---+  3 root    3000000   4096 jun  6 15:19 sysvol
>>> >> <<<<----------  is okey ?
>>> >> drwxrwx--T   2 root sambashare   4096 nov 21  2016
usershares
>>> >> -rw-------   1 root root        32768 jun  5 22:54
winbindd_cache.tdb
>>> >> drwxr-x---   2 root root         4096 ene 24 21:04
winbindd_privileged
>>> >>
>>> >>
>>> >>
>>> >>
>>> >>
>>> >> I do not know where to look for the logs to apply the GPOs
>>> >>
>>> >
>>> > Not sure about the GPO (I don't use them), but the
owner:group on
>>> > sysvol is okay.
>>> >
>>> > Also, you cannot use 'valid users' on a DC, you need
to set the ACLs
>>> > from windows.
>>> >
>>> > Rowland
>>> >
>>> > --
>>> > To unsubscribe from this list go to the following URL and read
the
>>> > instructions:  https://lists.samba.org/mailman/options/samba
>>>
>>> Thanks you. I remove "valid user" but the error
continius.
>>>
>>> Add new information:
>>>
>>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar# samba-tool
gpo
>>> aclcheck
>>> ldb_wrap open of secrets.ldb
>>> GENSEC backend 'gssapi_spnego' registered
>>> GENSEC backend 'gssapi_krb5' registered
>>> GENSEC backend 'gssapi_krb5_sasl' registered
>>> GENSEC backend 'spnego' registered
>>> GENSEC backend 'schannel' registered
>>> GENSEC backend 'naclrpc_as_system' registered
>>> GENSEC backend 'sasl-EXTERNAL' registered
>>> GENSEC backend 'ntlmssp' registered
>>> GENSEC backend 'ntlmssp_resume_ccache' registered
>>> GENSEC backend 'http_basic' registered
>>> GENSEC backend 'http_ntlm' registered
>>> GENSEC backend 'krb5' registered
>>> GENSEC backend 'fake_gssapi_krb5' registered
>>> resolve_lmhosts: Attempting lmhosts lookup for name
>>> _ldap._tcp.CLINICAGUEMES.COM.AR<0x0>
>>> resolve_lmhosts: Attempting lmhosts lookup for name
>>> _ldap._tcp.CLINICAGUEMES.COM.AR<0x0>
>>> resolve_lmhosts: Attempting lmhosts lookup for name
>>> dc01.clinicaguemes.com.ar<0x20>
>>> resolve_lmhosts: Attempting lmhosts lookup for name
>>> dc01.clinicaguemes.com.ar<0x20>
>>> ERROR(runtime): uncaught exception - (-1073741766, '{Path Not
Found}
>>> The path %hs does not exist.')
>>>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
>>> line 175, in _run
>>>     return self.run(*args, **kwargs)
>>>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.py", line
>>> 1148, in run
>>>     fs_sd = conn.get_acl(sharepath, security.SECINFO_OWNER |
>>> security.SECINFO_GROUP | security.SECINFO_DACL,
>>> security.SEC_FLAG_MAXIMUM_ALLOWED)
>>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar#
>>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar#
>>>
>>>
>>> Excuse me. I'm not mean those erros.
>>>
>>> --
>>> To unsubscribe from this list go to the following URL and read the
>>> instructions:  https://lists.samba.org/mailman/options/samba
>>>
>>
>>
>>
>> --
>> Elias Pereira
>>
>
>

-- 
Elias Pereira

The firs awnser solved my problem.

Now i go for this!

Thanks you. !



2017-06-13 16:17 GMT-03:00 Elias Pereira <empbilly at gmail.com>:
> onnect_acl_xattr: setting 'inherit acls = true' 'dos filemode =
true' and
>> 'force unknown acl user = true' for service Unknown Service
(snum == -1)
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service Unknown Service
(snum == -1)
>> lp_load_ex: refreshing parameters
>
>
> What can understand about this error is that you are using permissions via
> posix and somehow this "unknown service" error is occurring.
>
> Remove "valid users = + systems" and set acls by windows
>
> https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs
>
> On Tue, Jun 13, 2017 at 11:17 AM, Epsilon Minus <theepsilonminus at
gmail.com
> > wrote:
>
>> Thanks Elias.
>>
>> But I run samba-tool ntacl sysvolreset and:
>>
>>
>> root at DC02:~# samba-tool ntacl sysvolreset
>> lp_load_ex: refreshing parameters
>> Initialising global parameters
>> Processing section "[global]"
>> Processing section "[netlogon]"
>> Processing section "[sysvol]"
>> Processing section "[sistemas]"
>> ldb_wrap open of idmap.ldb
>> lp_load_ex: refreshing parameters
>> Processing section "[global]"
>> Processing section "[netlogon]"
>> Processing section "[sysvol]"
>> Processing section "[sistemas]"
>> Module 'acl_xattr' loaded
>> Module 'dfs_samba4' loaded
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service Unknown Service
(snum == -1)
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service Unknown Service
(snum == -1)
>> lp_load_ex: refreshing parameters
>> Processing section "[global]"
>> Processing section "[netlogon]"
>> Processing section "[sysvol]"
>> Processing section "[sistemas]"
>> ldb_wrap open of idmap.ldb
>> ldb_wrap open of idmap.ldb
>>
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>> connect_acl_xattr: setting 'inherit acls = true' 'dos
filemode = true'
>> and 'force unknown acl user = true' for service sysvol
>>
>>
>> know that means?
>>
>>
>>
>> 2017-06-07 14:01 GMT-03:00 Elias Pereira <empbilly at gmail.com>:
>>
>>> Maybe this link help.
>>> https://wiki.samba.org/index.php/Updating_Samba#Fixing_Incor
>>> rect_Sysvol_and_Directory_ACLs
>>>
>>> On Tue, Jun 6, 2017 at 4:09 PM, Epsilon Minus via samba <
>>> samba at lists.samba.org> wrote:
>>>
>>>> 2017-06-06 15:54 GMT-03:00 Rowland Penny via samba <
>>>> samba at lists.samba.org>:
>>>> > On Tue, 6 Jun 2017 15:35:42 -0300
>>>> > Epsilon Minus via samba <samba at lists.samba.org>
wrote:
>>>> >
>>>> >> Hi. I have a problem applying GPO. I do not know where
to look
>>>> >> Reviewing I found this:
>>>> >>
>>>> >> # samba-tool ntacl sysvolcheck
>>>> >> lp_load_ex: refreshing parameters
>>>> >> Initialising global parameters
>>>> >> Processing section "[global]"
>>>> >> Processing section "[netlogon]"
>>>> >> Processing section "[sysvol]"
>>>> >> Processing section "[sistemas]"
>>>> >> ldb_wrap open of idmap.ldb
>>>> >> Module 'acl_xattr' loaded
>>>> >> Module 'dfs_samba4' loaded
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> connect_acl_xattr: setting 'inherit acls =
true' 'dos filemode >>>> true'
>>>> >> and 'force unknown acl user = true' for
service sysvol
>>>> >> #
>>>> >>
>>>> >>
>>>> >> My smb.conf:
>>>> >> oot at DC02:~# cat /etc/samba/smb.conf
>>>> >>
>>>> >> # Global parameters
>>>> >> [global]
>>>> >>     workgroup = CLINICAGUEMES
>>>> >>     realm = CLINICAGUEMES.COM.AR
>>>> >>     netbios name = DC02
>>>> >>     server role = active directory domain controller
>>>> >>     server services = s3fs, rpc, nbt, wrepl, ldap,
cldap, kdc, drepl,
>>>> >> winbindd, ntp_signd, kcc, dnsupdate
>>>> >>     idmap_ldb:use rfc2307 = yes
>>>> >>     ldap server require strong auth = No
>>>> >>     log level = 3
>>>> >>
>>>> >>     #### Deshabilito error en los logs por las
impresoras
>>>> >>     load printers = no
>>>> >>         printing = bsd
>>>> >>         printcap name = /dev/null
>>>> >>         disable spoolss = yes
>>>> >>
>>>> >>
>>>> >> [netlogon]
>>>> >>     path =
/var/lib/samba/sysvol/clinicaguemes.com.ar/scripts
>>>> >>     read only = No
>>>> >>
>>>> >> [sysvol]
>>>> >>     path = /var/lib/samba/sysvol
>>>> >>     read only = No
>>>> >>
>>>> >> [sistemas]
>>>> >>     path = /datos/grupos/sistemas
>>>> >>     read only = No
>>>> >>     valid users = +sistemas
>>>> >>
>>>> >>
>>>> >> Is ok this? :
>>>> >>
>>>> >> root at DC02:/var/lib/samba# ls -l
>>>> >> total 1404
>>>> >> -rw-------   1 root root       421888 nov 21  2016
account_policy.tdb
>>>> >> -rw-------   1 root root          696 nov 21  2016
group_mapping.tdb
>>>> >> drwxr-x---   2 root root         4096 ene 24 21:04
ntp_signd
>>>> >> drwxr-xr-x  10 root root         4096 nov 21  2016
printers
>>>> >> drwxr-xr-x   7 root root         4096 jun  6 15:33
private
>>>> >> -rw-------   1 root root       528384 nov 21  2016
registry.tdb
>>>> >> -rw-------   1 root root       421888 nov 21  2016
share_info.tdb
>>>> >> drwxrwx---+  3 root    3000000   4096 jun  6 15:19
sysvol
>>>> >> <<<<----------  is okey ?
>>>> >> drwxrwx--T   2 root sambashare   4096 nov 21  2016
usershares
>>>> >> -rw-------   1 root root        32768 jun  5 22:54
winbindd_cache.tdb
>>>> >> drwxr-x---   2 root root         4096 ene 24 21:04
>>>> winbindd_privileged
>>>> >>
>>>> >>
>>>> >>
>>>> >>
>>>> >>
>>>> >> I do not know where to look for the logs to apply the
GPOs
>>>> >>
>>>> >
>>>> > Not sure about the GPO (I don't use them), but the
owner:group on
>>>> > sysvol is okay.
>>>> >
>>>> > Also, you cannot use 'valid users' on a DC, you
need to set the ACLs
>>>> > from windows.
>>>> >
>>>> > Rowland
>>>> >
>>>> > --
>>>> > To unsubscribe from this list go to the following URL and
read the
>>>> > instructions: 
https://lists.samba.org/mailman/options/samba
>>>>
>>>> Thanks you. I remove "valid user" but the error
continius.
>>>>
>>>> Add new information:
>>>>
>>>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar#
samba-tool gpo
>>>> aclcheck
>>>> ldb_wrap open of secrets.ldb
>>>> GENSEC backend 'gssapi_spnego' registered
>>>> GENSEC backend 'gssapi_krb5' registered
>>>> GENSEC backend 'gssapi_krb5_sasl' registered
>>>> GENSEC backend 'spnego' registered
>>>> GENSEC backend 'schannel' registered
>>>> GENSEC backend 'naclrpc_as_system' registered
>>>> GENSEC backend 'sasl-EXTERNAL' registered
>>>> GENSEC backend 'ntlmssp' registered
>>>> GENSEC backend 'ntlmssp_resume_ccache' registered
>>>> GENSEC backend 'http_basic' registered
>>>> GENSEC backend 'http_ntlm' registered
>>>> GENSEC backend 'krb5' registered
>>>> GENSEC backend 'fake_gssapi_krb5' registered
>>>> resolve_lmhosts: Attempting lmhosts lookup for name
>>>> _ldap._tcp.CLINICAGUEMES.COM.AR<0x0>
>>>> resolve_lmhosts: Attempting lmhosts lookup for name
>>>> _ldap._tcp.CLINICAGUEMES.COM.AR<0x0>
>>>> resolve_lmhosts: Attempting lmhosts lookup for name
>>>> dc01.clinicaguemes.com.ar<0x20>
>>>> resolve_lmhosts: Attempting lmhosts lookup for name
>>>> dc01.clinicaguemes.com.ar<0x20>
>>>> ERROR(runtime): uncaught exception - (-1073741766, '{Path
Not Found}
>>>> The path %hs does not exist.')
>>>>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py",
>>>> line 175, in _run
>>>>     return self.run(*args, **kwargs)
>>>>   File
"/usr/lib/python2.7/dist-packages/samba/netcmd/gpo.py", line
>>>> 1148, in run
>>>>     fs_sd = conn.get_acl(sharepath, security.SECINFO_OWNER |
>>>> security.SECINFO_GROUP | security.SECINFO_DACL,
>>>> security.SEC_FLAG_MAXIMUM_ALLOWED)
>>>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar#
>>>> root at DC02:/var/lib/samba/sysvol/clinicaguemes.com.ar#
>>>>
>>>>
>>>> Excuse me. I'm not mean those erros.
>>>>
>>>> --
>>>> To unsubscribe from this list go to the following URL and read
the
>>>> instructions:  https://lists.samba.org/mailman/options/samba
>>>>
>>>
>>>
>>>
>>> --
>>> Elias Pereira
>>>
>>
>>
>
>
> --
> Elias Pereira
>