Here are some findings (repeatable) for what editing of GPO's do.
Editing a GPO changes some bits in the ACL which breaks sysvolcheck,
at least on my setup. I don't know how significant this is, or if it
affects anything except annoying the beholder.
Anyway, I'd like to share this and get some opinion on it
Before GPO editing of policy
root at hp-ad1:/etc# samba-tool ntacl sysvolcheck
root at hp-ad1:/etc#
root at hp-ad1:/etc# /home/sysman/scripts/check-acl.sh hp-ad1
{025430EE-2775-4719-AE02-D8656FED70B0}
Enter HP\aostling's password:
REVISION:1
CONTROL:SR|PD|DR|DP
OWNER:HP\Domain Admins
GROUP:HP\Domain Admins
ACL:HP\Domain Admins:ALLOWED/OI|CI/FULL
ACL:HP\Enterprise Admins:ALLOWED/OI|CI/FULL
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL
ACL:HP\Domain Admins:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS:ALLOWED/OI|CI/READ
ACL:HP\HP_Roaming:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ
Doing a change to the user profile (policy
{025430EE-2775-4719-AE02-D8656FED70B0}) to set User Home drive ...
root at hp-ad1:/etc# /home/sysman/scripts/check-acl.sh hp-ad1
{025430EE-2775-4719-AE02-D8656FED70B0}
Enter HP\aostling's password:
REVISION:1
CONTROL:SR|PD|SI|DI|DP <------------------- SI inserted into
"CONTROL"
OWNER:HP\Domain Admins
GROUP:HP\Domain Admins
ACL:HP\Domain Admins:ALLOWED/OI|CI/FULL
ACL:HP\Enterprise Admins:ALLOWED/OI|CI/FULL
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL
ACL:HP\Domain Admins:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ
ACL:HP\Domain Users:ALLOWED/OI|CI/READ
sysvolcheck does not like that
root at hp-ad1:/etc# samba-tool ntacl sysvolcheck
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception
- ProvisioningError: DB ACL on GPO directory
/var/lib/samba/sysvol/hoganas-platslagaren.se/Policies/{025430EE-2775-4719-AE02-D8656FED70B0}
O:DAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;ED)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;DU)
does not match expected value
O:DAG:DAD:PAR(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;ED)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;DU)
from GPO object
File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line
186, in _run
return self.run(*args, **kwargs)
File "/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py", line
446, in run
lp)
File "/usr/lib/python3/dist-packages/samba/provision/__init__.py",
line 1877, in checksysvolacl
direct_db_access)
File "/usr/lib/python3/dist-packages/samba/provision/__init__.py",
line 1827, in check_gpos_acl
domainsid, direct_db_access)
File "/usr/lib/python3/dist-packages/samba/provision/__init__.py",
line 1769, in check_dir_acl
raise ProvisioningError('%s ACL on GPO directory %s %s does not
match expected value %s from GPO object' %
(acl_type(direct_db_access), path, fsacl_sddl, acl))
so lets fix it
root at hp-ad1:/etc# samba-tool ntacl sysvolreset
root at hp-ad1:/etc# /home/sysman/scripts/check-acl.sh hp-ad1
{025430EE-2775-4719-AE02-D8656FED70B0}
Enter HP\aostling's password:
REVISION:1
CONTROL:SR|PD|DR|DP <----------------------------------- SI gone
OWNER:HP\Domain Admins
GROUP:HP\Domain Admins
ACL:HP\Domain Admins:ALLOWED/OI|CI/FULL
ACL:HP\Enterprise Admins:ALLOWED/OI|CI/FULL
ACL:CREATOR OWNER:ALLOWED/OI|CI|IO/FULL
ACL:HP\Domain Admins:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\SYSTEM:ALLOWED/OI|CI/FULL
ACL:NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS:ALLOWED/OI|CI/READ
ACL:NT AUTHORITY\Authenticated Users:ALLOWED/OI|CI/READ
ACL:HP\Domain Users:ALLOWED/OI|CI/READ
root at hp-ad1:/etc# samba-tool ntacl sysvolcheck
root at hp-ad1:/etc#
RSAT GPO editor on Windows 10 Pro 20H2
Debian 10 with Lois repo files for Samba
Samba 4.14.4
The script I wrote
#!/bin/bash
share="//$1/sysvol"
gpo=$2
smbcacls $share /hoganas-platslagaren.se/Policies/$gpo -U aostling
--
------ -------------------- 8 ------------------ ------
"A wise man once told me - Any idiot can do backups, but it takes a
genius to successfully restore"
Anders ?stling
+46 768 716 165 (Mobil)
+46 431 45 56 01 (Hem)