samba - May 2024 - GPO Editor says "Access denied" for Group Policy Objects

Hello all, to return to the original topic:

My original problem was that I could not edit GP objects with the GP 
Editor, even as Domain admin. I always got "access denied". A 
sysvolcheck returned no errors and the Windows "Security" tab for the 
object in question on the sysvol share looked correct.

I now found out that the group id of the sysvol folder (and everything 
below) was 3000000, while the "Administrators" group has the group ID 
3000002. I corrected the group ID assigned to the sysvol folder on both 
DCs and now I can edit the GP objects with the GPO editor.

I still do not understand why on my DCs "getent group" and
"getent user"
do not return the Windows groups and users, but that is probably a 
cosmetic thing as you can get all info via wbinfo and samba-tool.
Just for this case here it would then also display the group ownership 
of the sysvol folder. I have "winbind" in nsswitch .conf and no other 
special settings, on other similar DCs getent group returns the groups, 
not sure why it is not working here, but perhaps not important enough to 
invest more time.

I will correct the smb.conf of the member server to omit unneccessary 
bits with the next maintenance slot.

Hope this helps others, Jakob


Am 25.04.2024 um 21:11 schrieb Jakob Curdes via samba:
>
> Am 25.04.2024 um 19:59 schrieb Rowland Penny via samba:
>> I suspect that I forgot to set the idmap config on the DC(s)
>> accordingly?
>> Do not set idmap config lines on a Samba DC, they do not work, you must
>> use the 3000000 numbers or use rfc2307 attributes (uidNumber,
>> gidNumber, etc)
>>
>> Have you read this:
>>
>>
https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs#Granting_the_SeDiskOperatorPrivilege_Privilege
>>
>>
> Yes, but rereading it and the mail thread I think I will try to 
> sanitize my configs and then go through that page again. But I would 
> like to do this with hands-on to the domain as it is in production, so 
> this will have to wait until next week.
>
> I will try to heed your hints and get back with a result.
>
> Thank you and best regards, Jakob

On Thu, 2 May 2024 12:07:13 +0200
Jakob Curdes via samba <samba at lists.samba.org> wrote:
> Hello all, to return to the original topic:
> 
> My original problem was that I could not edit GP objects with the GP 
> Editor, even as Domain admin. I always got "access denied". A 
> sysvolcheck returned no errors and the Windows "Security" tab for
the
> object in question on the sysvol share looked correct.
> 
> I now found out that the group id of the sysvol folder (and
> everything below) was 3000000, while the "Administrators" group
has
> the group ID 3000002. I corrected the group ID assigned to the sysvol
> folder on both DCs and now I can edit the GP objects with the GPO
> editor.
The permissions set on the sysvol directory are:
O:LAG:BAD:P(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;SO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)

Which in a more readable form is:
Owner:LOCAL_ADMIN Group:BUILTIN_ADMINISTRATORS D:P(Allow;Full
control;;;BUILTIN_ADMINISTRATORS)(Allow;Read and
Execute,Inherited;;;SERVER_OPERATORS)(Allow;Full
control;;;LOCAL_SYSTEM)(Allow;Read and
Execute,Inherited;;;_AUTHENTICATED_USERS)

Now all that depends on the various users and groups having the same ID
on every DC, the problem with that is, you cannot depend on every DC
giving the same IDs to users and groups, they are handed out on a
'first come' basis. This is why you need to sync idmap.ldb from one DC
(usually the one holding the PDC_Emulator FSMO role) to all others.
 
> 
> I still do not understand why on my DCs "getent group" and
"getent
> user" do not return the Windows groups and users, but that is
> probably a cosmetic thing as you can get all info via wbinfo and
> samba-tool. Just for this case here it would then also display the
> group ownership of the sysvol folder. I have "winbind" in
nsswitch
> .conf and no other special settings, on other similar DCs getent
> group returns the groups, not sure why it is not working here, but
> perhaps not important enough to invest more time.
If you run 'getent group' and get no result, try:
getent group Domain\ Users

Does this return output ? If it doesn't, check that you have the
correct libnss winbind links installed and that /etc/nsswitch.conf is
setup correctly.

Rowland