samba - Mar 2023 - Missing features in RSAT Group Policy Manager (Debian as Samba PDC)

On 10/03/2023 15:58, David Mulder via samba wrote:
> 
> On 3/10/23 8:56 AM, Rowland Penny via samba wrote:
>>
>>
>> On 10/03/2023 15:46, David Mulder via samba wrote:
>>> On 3/10/23 8:35 AM, Dennis Binkhorst via samba wrote:
>>>> I have been testing a Debian 11 (i386) server with samba
>>>> 2:4.13.13+dfsg-1~deb11u5 running as an Active Directory
Controller.
>>>> This is
>>>> a stand-alone DC, meant for user authentication for a small
business
>>>> network. I use RSAT Features on Windows 11 Pro to manage Users,
Groups,
>>>> Machines etc., which works fine.
>>>>
>>>> I would like create a new GPO using the RSAT Group Policy
Manager to
>>>> change
>>>> Security Settings for all machines that are in a specific OU. 
>>>> However, when
>>>> I try to edit the new GPO I am unable to find *Account
Policies* and
>>>> *Local
>>>> Policies *under *"Computer Configuration / Policies /
Windows
>>>> Settings /
>>>> Security Settings*". This is also the case when using RSAT
from a
>>>> Windows
>>>> 10 Pro machine.
>>>>
>>>> These Policies do exist on the Windows 11 Pro machine itself
when I
>>>> open
>>>> *gpedit.msc*.
>>>>
>>>> Not sure if this is relevant, but I did download and install
the the
>>>> 22H2
>>>> ADMX Templates for Windows 11 to the Samba AD. They exists in
the
>>>> SYSVOL
>>>> directory.
>>>>
>>>> An example of a policy I'd like to set in the GPO is
*"Interactive
>>>> logon:
>>>> Message text for users attempting to log on"*.
>>>> P.S.: A suggestion made elsewhere was to upgrade samba to the
>>>> bullseye-backports version, so i did that.
>>>> Upgrading to *2:4.17.5+dfsg-1~bpo11+1 *did not change anything
for
>>>> my issue.
>>> Which RSAT are you referring to? There's the yast-based one I 
>>> created, and there is one Alt Linux is working on, IIRC.
>>>
>>
>> There is the one that small company produces, what's its name, oh I
>> know Microsoft LOL
>>
> Haha. I misunderstood the question. It didn't make sense to me that he 
> would be asking *us* about a missing feature in *MS* RSAT. :-)
He is asking because:

A) I told him too
B) Is it something that Samba should be providing and isn't
C) I know very little about GPO's, you appear to be our expert ;-)

If it isn't our problem, then at least he will know this.

Rowland

On 3/10/23 9:03 AM, Rowland Penny via samba wrote:
> He is asking because:
>
> A) I told him too
> B) Is it something that Samba should be providing and isn't
> C) I know very little about GPO's, you appear to be our expert ;-)
>
> If it isn't our problem, then at least he will know this.
>
So, to be clear. The problem is 'Account Policies' and 'Local
Policies'
are missing from "Computer Configuration / Policies / Windows Settings / 
Security Settings" in *MS* Group Policy Management Editor when run 
against a Samba ADDC?

The ADMX templates are irrelevant here, so that isn't the issue.

-- 
David Mulder
Labs Software Engineer, Samba
SUSE
1221 S Valley Grove Way, Suite 500
Pleasant Grove, UT 84062
(P)+1 385.208.2989
dmulder at suse.com
http://www.suse.com