samba - May 2018 - gpo problem

Hello,
we have a strange problem with the "Default Domain Policy". Sometimes
on
different PC the drivmappings are not working. When we do a "gpupdate
/force" we get an errormessage that the "default domain policy"
is not
working for both the user-GPOs and the machine-GPOs. We checked the
permissions with "samba-tool ntacl sysvolcheck" and with
"samba-tool gpo
aclcheck" and everything is ok no messages.
Up to this point we did not do any changes to this GPO. Other PC will
work correctly. Then we did a change to the GPO and replicated the GPO
to the other DC. After we made the change, the PC will get the
drivemappings. We can then reset the GPO, replicate it and it's still
working. We had this here with several PC but not with all.
Any one of you had this problem before and has a solution?

Stefan


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20180518/be757b5b/signature.sig>

On Fri, 18 May 2018 09:20:55 +0200
Stefan Kania via samba <samba at lists.samba.org> wrote:
> 
> Hello,
> we have a strange problem with the "Default Domain Policy".
Sometimes
> on different PC the drivmappings are not working. When we do a
> "gpupdate /force" we get an errormessage that the "default
domain
> policy" is not working for both the user-GPOs and the machine-GPOs.
> We checked the permissions with "samba-tool ntacl sysvolcheck"
and
> with "samba-tool gpo aclcheck" and everything is ok no messages.
> Up to this point we did not do any changes to this GPO. Other PC will
> work correctly. Then we did a change to the GPO and replicated the GPO
> to the other DC. After we made the change, the PC will get the
> drivemappings. We can then reset the GPO, replicate it and it's still
> working. We had this here with several PC but not with all.
> Any one of you had this problem before and has a solution?
> 
> Stefan
> 
> 
Not sure if I understand this ;-)

Have you modified the Default Domain Policy ?
If so, undo your changes and create a new policy, you shouldn't change
the two default policies.

Rowland

Am 18.05.2018 um 09:47 schrieb Rowland Penny via samba:
> On Fri, 18 May 2018 09:20:55 +0200
> Stefan Kania via samba <samba at lists.samba.org> wrote:
> 
>>
>> Hello,
>> we have a strange problem with the "Default Domain Policy".
Sometimes
>> on different PC the drivmappings are not working. When we do a
>> "gpupdate /force" we get an errormessage that the
"default domain
>> policy" is not working for both the user-GPOs and the
machine-GPOs.
>> We checked the permissions with "samba-tool ntacl
sysvolcheck" and
>> with "samba-tool gpo aclcheck" and everything is ok no
messages.
>> Up to this point we did not do any changes to this GPO. Other PC will
>> work correctly. Then we did a change to the GPO and replicated the GPO
>> to the other DC. After we made the change, the PC will get the
>> drivemappings. We can then reset the GPO, replicate it and it's
still
>> working. We had this here with several PC but not with all.
>> Any one of you had this problem before and has a solution?
>>
>> Stefan
>>
>>
> 
> Not sure if I understand this ;-)
> 
> Have you modified the Default Domain Policy ?
> If so, undo your changes and create a new policy, you shouldn't change
> the two default policies.
After setting up the new Domain "NO"! Never ever change the
"default
domain policy". Then we got the problem. I did a change to the policy.
Saved the change and then reset the change. Then the problem was solved.
Then all PC get all GPOs we created. Then there was another PC with the
errormessage about the "default doamin policy". Again, I change the
GPO,
saved it, then reseted the GPO, saved it. Restarted the PC and all GPOs
were working again.
> If so, undo your changes and create a new policy, you shouldn't change
> the two default policies.
I know  All other settings where made with new GPOs.
It's relay strange, Because all the PCs having the problem were working
before without any problem. This happened not to all PC only a few.

Stefan
> 
> Rowland
> 



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 181 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20180518/1730b07e/signature-0001.sig>