samba - Jul 2023 - Joining a new Samba AD DC

On Fri Jul 28 03:41:45 2023 Rowland Penny via samba <samba at
lists.samba.org> wrote:
> On 27/07/2023 23:03, Mark Foley via samba wrote:
> > On Tue Jul 25 15:34:15 2023 Rowland Penny <rpenny at samba.org>
wrote:
> > 
> >> On 25/07/2023 20:09, Mark Foley via samba wrote:
> >>
> >>> One of the recommended solutions was using rsync, similar to
what I theorized.
> >>> I'll try that and post back.
> > 
> > [deleted]
> > 
> > OK, I did the rsync method for SysVol replication. It appears to have
worked and
> > copied the ACLs as well.
> > 
> > I then ran the sysvolreset. It tool longer, but still gave some
errors, though
> > not as many:
> > 
> > # samba-tool ntacl sysvolreset
> > set_nt_acl_conn: init_files_struct failed:
NT_STATUS_OBJECT_NAME_NOT_FOUND
> > ERROR(runtime): uncaught exception - (3221225524, 'The object name
is not found.')
> >    File
"/usr/lib64/python3.9/site-packages/samba/netcmd/__init__.py", line
186, in _run
> >      return self.run(*args, **kwargs)
> >    File
"/usr/lib64/python3.9/site-packages/samba/netcmd/ntacl.py", line 412,
in run
> >      provision.setsysvolacl(samdb, netlogon, sysvol,
> >    File
"/usr/lib64/python3.9/site-packages/samba/provision/__init__.py", line
1754, in setsysvolacl
> >      set_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp,
use_ntvfs, passdb=s4_passdb)
> >    File
"/usr/lib64/python3.9/site-packages/samba/provision/__init__.py", line
1630, in set_gpos_acl
> >      setntacl(lp, root_policy_path, POLICIES_ACL, str(domainsid),
session_info,
> >    File
"/usr/lib64/python3.9/site-packages/samba/ntacls.py", line 228, in
setntacl
> >      smbd.set_nt_acl(
> > 
> > Is this ignorable? Fixable? It doesn't mean much to me.
> > 
> > Note that samba is not yet running, nor is the DNS working yet.
> > 
> > Thanks --Mark
> > 
>
> Samba stores the GPOs in sysvol and in AD. The way that sysvolreset 
> works is, it reads the GPOs in AD and then uses this information to set 
> the permissions for the GPOs on disk. It looks to me that you have more 
> GPO's in AD than you have on disk, it is trying to set the permissions 
> for a GPO that isn't on disk. I would compare sysvol on both machines.
>
> Rowland
After checking with the previous run, these sysvolreset errors are the same as
before, so syncing the sysvol didn't make any different. 

You wrote: "It looks to me that you have more GPO's in AD than you have
on
disk, ...". So, where are the "AD" versus "on disk"
GPOs located? Is one of
these locations /var/lib/samba/sysvol/hprs.local/policies/? I've
rsync'ed the
sysvol again. They are identical between the machines. 

Is this error possibly ignorable? I've checked and the rsync did copy the
ACL
attributes to the sysvol files and folders, so maybe this "ntacl
sysvolreset"
isn't really making any changes?

Thanks --Mark

On 28/07/2023 19:04, Mark Foley via samba wrote:
> 
> After checking with the previous run, these sysvolreset errors are the same
as
> before, so syncing the sysvol didn't make any different.
> 
> You wrote: "It looks to me that you have more GPO's in AD than you
have on
> disk, ...". So, where are the "AD" versus "on
disk" GPOs located? Is one of
> these locations /var/lib/samba/sysvol/hprs.local/policies/? I've
rsync'ed the
> sysvol again. They are identical between the machines.
> 
> Is this error possibly ignorable? I've checked and the rsync did copy
the ACL
> attributes to the sysvol files and folders, so maybe this "ntacl
sysvolreset"
> isn't really making any changes?
> 
> Thanks --Mark
> 
The Policies are stored in AD under 'CN=Policies,CN=System....', so to 
see them you need to run something like this (changed to match your 
setup) on a DC:

sudo ldbsearch -H /var/lib/samba/private/sam.ldb -b 
"CN=Policies,CN=System,DC=samdom,DC=example,DC=com" -s one dn

You should get lines like this:

dn: 
CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=samdom,DC=example,DC=com

There should be one for every GPO stored on disk in sysvol.

Rowland