(I am not getting emails from the samba list (I do not know why), this is copy
from web archive, sorry :-( )<br><br>On Fri, 22 Jun 2018 16:07:39
+0200
Michal via samba <<a
href='https://lists.samba.org/mailman/listinfo/samba'>samba at
lists.samba.org</a>> wrote:
>><i> Samba 4.8.2 as AD controller, installed from scratch (no
upgrade).
</i>>><i>
</i>>><i> I am getting "access denied" for GPO
objects and netlogon or sysvol
</i>>><i> shares both on Win7 and W10 clients.
</i>>><i>
</i>>><i> [<a
href='https://lists.samba.org/mailman/listinfo/samba'>root at
ad1</a> etc]# ll /usr/local/samba.ad/var/locks/
</i>>><i> total 1384
</i>>><i> -rw------- 1 root root 421888 May 17 08:30
account_policy.tdb
</i>>><i> -rw------- 1 root root 528384 May 17 08:30
registry.tdb
</i>>><i> -rw------- 1 root root 421888 May 17 08:29
share_info.tdb
</i>>><i> drwxrwx---+ 6 root 544 4096 Jun 1 16:38 sysvol
</i>>><i> -rw------- 1 root root 32768 Jun 22 15:40
winbindd_cache.tdb
</i>>><i> drwxr-x--- 2 root root 4096 Jun 22 15:40
winbindd_privileged
</i>>><i>
</i>>><i> [<a
href='https://lists.samba.org/mailman/listinfo/samba'>root at
ad1</a> etc]# ll /usr/local/samba.ad/var/locks/sysvol/
</i>>><i> total 32
</i>>><i> drwxrwx---+ 3 root 544 4096 May 17 08:21 ad.nemuh.cz
</i>>><i> drwxrwx---+ 4 root 544 4096 Jun 1 16:22 nemuh.cz
</i>>><i> drwxrwx---+ 4 root 544 4096 May 17 08:27 nspuh.cz
</i>>><i> drwxrwx---+ 4 root 544 4096 Jun 1 16:33 uhn.cz
</i>> Two questions, why do you have 4 directories under sysvol, when all
> that should be there (according to your smb.conf) is
'nemuh.cz'<br><br> I suppose these other directories was
created during my first attempts to install Samba AD some time ago. <br>I
run (repeatedly) samba-tool with some install parameters, then deleted smb.conf
and run samba-tool again<br> (I have had no knowledge about existence of
the var/locks/ structures before).<br><br>> The second question
is, where did '544' come from ?<br> No idea, sorry.
<br><br>> How did you install and provision Samba, did you
follow the Samba wiki
or some other web page ?<br> <br> The server is Centos and I did
not find AD ready Centos samba package. So I compiled samba from
sources<br>and install it myself (configure --prefix /usr/local/samba.ad
..., make, make install). <br> Then I run samba-tool (repeatedly, this
is my 1st samba ad installation) in "interactive" mode.
<br>I've read a lot of web pages, I can not say exactly what was the
last used "install" parameters for
samba-tool.<br><br><br>>><i> [global]
</i>>><i> netbios name = AD1
</i>>><i> realm = NEMUH.CZ
</i>>><i> server role = active directory domain
controller
</i>>><i> server services = s3fs, rpc, nbt, wrepl,
ldap, cldap, kdc,
</i>>><i> drepl, winbindd, ntp_signd, k
</i>>><i> server services = s3fs, rpc, nbt, wrepl,
ldap, cldap, kdc,
</i>>><i> drepl, winbindd, ntp_signd, k
</i>>><i> workgroup = UHN
</i>>><i> idmap_ldb:use rfc2307 = yes
</i>> Why are there two 'server services' lines ?<br> No idea. No
edit "by hand" of this file, as far as I remember.
<br><br>> And why do they both end with a 'k'
?<br> My fault, clipped long lines - they end with "... ntp_signd,
kcc, dnsupdate" <br> <br>> I also take it you are running
Bind9 as the dns server, is this running on the DC and is it set up correctly
?<br><br> Yes, bind as DNS, yes, running on the DC. Installed just
for this samba instance. I have been using bind on <br>my other servers
for years and I was hoping I have better control over DNS (no luck; I love bind9
text zones<br>files, but samba AD DNS is a f..ing blackbox, as black as
Samba's internal ldap server. Very annoying for me <br>after years
with openldap, used for Samba v3).<br><br> Thanks, Michal<br>