Klaas TJEBBES
2021-May-20 14:19 UTC
[Samba] GPO created via samba-tool don't Copy or Backup in RSAT (invalid directory)
To illustrate, two images showing "test" (GPO made with RSAT) and "newtest" (made with 'samba-tool gpo backup/restore' from "test" GPO). Does someone reproduce this ? https://i.postimg.cc/QdDhRKb9/1.png https://i.postimg.cc/8CPDC8xT/2.png Le 20/05/2021 ? 13:32, Klaas TJEBBES via samba a ?crit?:> I've noticed that the GPO restored by "samba-tool gpo restore" is empty, > it has not been restored completely. > > Actually, the modification I made has not been restored : Computer > Configuration -> Strategies -> Administrative Templates -> System -> > Logon ?Always Wait for the Network at Computer Startup and Logon? to > ?Enabled? > > > Le 19/05/2021 ? 12:30, Klaas TJEBBES via samba a ?crit?: >> Hello. >> >> I am facing a problem with GPO managing on the Samba side. >> >> When I create a GPO named "test" using the RSAT on Windows, and make a >> modification in it (I did : Computer Configuration -> Administrative >> Templates -> System -> Logon ?Always Wait for the Network at Computer >> Startup and Logon? to ?Enabled?). I CAN Copy and Backup this GPO in >> RSAT (right clic on GPO and "Copy", right clic on "Group Policy >> Objects" and Paste). >> >> On the samba server, using "samba-tool gpo backup/restore", I backup >> and restore this "test" GPO under another name, "blabla" for example. >> ??samba-tool gpo backup {XXXXX-YYYYYY-ZZZZZZ-AAAAA-BBBB} >> ??samba-tool gpo restore blabla /tmp/... >> >> Back in the RSAT on Windows, this new "blabla" GPO can NOT be Copied >> or Backuped. The error is "invalid directory". >> >> I CLOSE THE RSAT. >> >> On the samba server, I go in the "test" GPO directory (in >> "/home/sysvol/domseth.ac-test.fr/Policies/{ID_TEST_GPO}") and do : >> ??getfattr -d -n user.DOSATTRIB -R . > ../test.attrs >> >> Then I go in the directory of the "blabla" GPO and do : >> ?? setfattr --restore=../test.attrs >> >> Then I return on the RSAT and now I can successful Copy and Backup >> "blabla" GPO. >> >> Why this problem ? Am I doing something wrong ? >> >> root at dc1:~# dpkg -l |grep samba >> ii? python3-samba??????????????????????? 2:4.11.6+dfsg-0ubuntu1.6 >> amd64??????? Python 3 bindings for Samba >> ii? samba??????????????????????????????? 2:4.11.6+dfsg-0ubuntu1.6 >> amd64??????? SMB/CIFS file, print, and login server for Unix >> ii? samba-common???????????????????????? 2:4.11.6+dfsg-0ubuntu1.6 >> all ????????? common files used by both the Samba server and client >> ii? samba-common-bin???????????????????? 2:4.11.6+dfsg-0ubuntu1.6 >> amd64??????? Samba common files used by both the server and the client >> ii? samba-dsdb-modules:amd64???????????? 2:4.11.6+dfsg-0ubuntu1.6 >> amd64??????? Samba Directory Services Database >> ii? samba-libs:amd64???????????????????? 2:4.11.6+dfsg-0ubuntu1.6 >> amd64??????? Samba core libraries >> ii? samba-vfs-modules:amd64????????????? 2:4.11.6+dfsg-0ubuntu1.6 >> amd64??????? Samba Virtual FileSystem plugins >> >> root at dc1:~# cat /etc/lsb-release >> DISTRIB_ID=Ubuntu >> DISTRIB_RELEASE=20.04 >> DISTRIB_CODENAME=focal >> DISTRIB_DESCRIPTION="Ubuntu 20.04.2 LTS" >> >> And Windows 10.20H2. >> >> >> Thank you, regards, >> ??Klaas >> >> >-- ~~~~~~~~~~~~~~~~~~~~~~~ - Klaas TJEBBES - Equipe EOLE - DSI - Dijon ~~~~~~~~~~~~~~~~~~~~~~~
Klaas TJEBBES
2021-May-20 15:03 UTC
[Samba] GPO created via samba-tool don't Copy or Backup in RSAT (invalid directory)
After doing a 'tree' in both directories I've noticed that I made a
mistake and that restore command should be :
samba-tool gpo restore newtest
/tmp/tmppofvkose/policy/\{F9003837-A727-443D-A2CE-AE0DBCCBC8A8\}/ -U
admin --password=a
instead of :
samba-tool gpo restore newtest /tmp/tmppofvkose/ -U admin --password=a
This way GPO parameters are copied as well. First I did it like that,
and I may have made too much tests the last days and at one time I began
to use the wrong /tmp path. So my apologies for this useless noise.
BUT this doesn't fix my first problem : I still cannot Copy/Paste or
Backup "newtest" GPO in RSAT, while Copy/Paste of "test" GPO
works fine :
https://i.postimg.cc/7YkQM39R/4.png
https://i.postimg.cc/q7h9Zk3D/5.png
- "test" GPO is made in RSAT.
- "newtest" GPO is made like this :
samba-tool gpo listall
samba-tool gpo backup {F9003837-A727-443D-A2CE-AE0DBCCBC8A8} # ID of
"test" GPO I got with "listall"
samba-tool gpo restore newtest
/tmp/tmppofvkose/policy/\{F9003837-A727-443D-A2CE-AE0DBCCBC8A8\}/ -U
admin --password=a #super strong password
Le 20/05/2021 ? 16:19, Klaas TJEBBES via samba a ?crit?:> To illustrate, two images showing "test" (GPO made with RSAT) and
> "newtest" (made with 'samba-tool gpo backup/restore' from
"test" GPO).
>
> Does someone reproduce this ?
>
> https://i.postimg.cc/QdDhRKb9/1.png
>
> https://i.postimg.cc/8CPDC8xT/2.png
>
>
> Le 20/05/2021 ? 13:32, Klaas TJEBBES via samba a ?crit?:
>> I've noticed that the GPO restored by "samba-tool gpo
restore" is
>> empty, it has not been restored completely.
>>
>> Actually, the modification I made has not been restored : Computer
>> Configuration -> Strategies -> Administrative Templates ->
System ->
>> Logon ?Always Wait for the Network at Computer Startup and Logon? to
>> ?Enabled?
>>
>>
>> Le 19/05/2021 ? 12:30, Klaas TJEBBES via samba a ?crit?:
>>> Hello.
>>>
>>> I am facing a problem with GPO managing on the Samba side.
>>>
>>> When I create a GPO named "test" using the RSAT on
Windows, and make
>>> a modification in it (I did : Computer Configuration ->
>>> Administrative Templates -> System -> Logon ?Always Wait for
the
>>> Network at Computer Startup and Logon? to ?Enabled?). I CAN Copy
and
>>> Backup this GPO in RSAT (right clic on GPO and "Copy",
right clic on
>>> "Group Policy Objects" and Paste).
>>>
>>> On the samba server, using "samba-tool gpo
backup/restore", I backup
>>> and restore this "test" GPO under another name,
"blabla" for example.
>>> ??samba-tool gpo backup {XXXXX-YYYYYY-ZZZZZZ-AAAAA-BBBB}
>>> ??samba-tool gpo restore blabla /tmp/...
>>>
>>> Back in the RSAT on Windows, this new "blabla" GPO can
NOT be Copied
>>> or Backuped. The error is "invalid directory".
>>>
>>> I CLOSE THE RSAT.
>>>
>>> On the samba server, I go in the "test" GPO directory (in
>>> "/home/sysvol/domseth.ac-test.fr/Policies/{ID_TEST_GPO}")
and do :
>>> ??getfattr -d -n user.DOSATTRIB -R . > ../test.attrs
>>>
>>> Then I go in the directory of the "blabla" GPO and do :
>>> ?? setfattr --restore=../test.attrs
>>>
>>> Then I return on the RSAT and now I can successful Copy and Backup
>>> "blabla" GPO.
>>>
>>> Why this problem ? Am I doing something wrong ?
>>>
>>> root at dc1:~# dpkg -l |grep samba
>>> ii? python3-samba??????????????????????? 2:4.11.6+dfsg-0ubuntu1.6
>>> amd64??????? Python 3 bindings for Samba
>>> ii? samba??????????????????????????????? 2:4.11.6+dfsg-0ubuntu1.6
>>> amd64??????? SMB/CIFS file, print, and login server for Unix
>>> ii? samba-common???????????????????????? 2:4.11.6+dfsg-0ubuntu1.6
all
>>> ????????? common files used by both the Samba server and client
>>> ii? samba-common-bin???????????????????? 2:4.11.6+dfsg-0ubuntu1.6
>>> amd64??????? Samba common files used by both the server and the
client
>>> ii? samba-dsdb-modules:amd64???????????? 2:4.11.6+dfsg-0ubuntu1.6
>>> amd64??????? Samba Directory Services Database
>>> ii? samba-libs:amd64???????????????????? 2:4.11.6+dfsg-0ubuntu1.6
>>> amd64??????? Samba core libraries
>>> ii? samba-vfs-modules:amd64????????????? 2:4.11.6+dfsg-0ubuntu1.6
>>> amd64??????? Samba Virtual FileSystem plugins
>>>
>>> root at dc1:~# cat /etc/lsb-release
>>> DISTRIB_ID=Ubuntu
>>> DISTRIB_RELEASE=20.04
>>> DISTRIB_CODENAME=focal
>>> DISTRIB_DESCRIPTION="Ubuntu 20.04.2 LTS"
>>>
>>> And Windows 10.20H2.
>>>
>>>
>>> Thank you, regards,
>>> ??Klaas
>>>
>>>
>>
>
--
~~~~~~~~~~~~~~~~~~~~~~~
- Klaas TJEBBES
- Equipe EOLE
- DSI
- Dijon
~~~~~~~~~~~~~~~~~~~~~~~