samba - Nov 2025 - GPMC error 0x80070005 when saving "User Configuration > Preferences > Folders"

hello,

I am having a problem with Group Policy Management on my Samba AD DC.

*My Environment:*

   -

   *Samba Version:* Version 4.22.6-Debian-4.22.6+dfsg-0~~mjt+deb12
   -

   *OS:* Debian 12

*My Goal:* I am trying to create a simple GPO (User Configuration >
Preferences > Folders) to create a new folder for users at
%UserProfile%\DevRuns\bin.

*The Problem:* When I am in the Group Policy Management Editor and try to
save this new "Folders" setting, I get an "Access Denied"
error. The exact
message is: Error (0x80070005) occurred saving settings file. Access is
denied.

*Troubleshooting Steps I Have Taken:*

I assumed it was a SYSVOL permissions issue, so I ran the following
commands on my Debian server:

   1.

   First, I ran samba-tool ntacl sysvolcheck. It failed and reported a
   mismatch:

   ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
exception - ProvisioningError: DB ACL on GPO directory
/var/lib/samba/sysvol/campus.sertao.ifrs.edu.br/Policies/{301F7BDC-2E40-4E97-BD1D-BCB90E5D3DB0}/User/Preferences/Folders
O:BAG:DAD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;;;AU)(A;OICI;0x1200a9;;;ED)
does not match expected value
O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;OICI;0x1200a9;;;ED)
from GPO object
   ...

   2.

   Next, I ran samba-tool ntacl sysvolreset to fix the permissions.
   3.

   I ran samba-tool ntacl sysvolcheck again, and it completed with no
   errors. The permissions seemed to be fixed.
   4.

   I went back to Windows and tried to save the GPO setting again. It
   failed with the *exact same error: 0x80070005*.
   5.

   After the failed save, I ran samba-tool ntacl sysvolcheck one more time,
   and it reported the same ACL mismatch error as in step 1.

It seems that sysvolreset works, but the moment I try to save the GPO from
Windows, the save operation fails and breaks the ACLs again.

Has anyone seen this behavior? Is this a configuration I am missing?

Thank you for your help.
-- 
Elias Pereira

Hello,

There is probably a better way, but what I do when I have this issue is that I
do a chmod -R 777 on the policy folder
(/var/lib/samba/sysvol/campus.sertao.ifrs.edu.br/Policies/{301F7BDC-2E40-4E97-BD1D-BCB90E5D3DB0}
in your case). Then, I do my change. And after that, I do a samba-tool ntacl
sysvolreset to restore the permissions correctly.

Nicolas
> hello,
> 
> I am having a problem with Group Policy Management on my Samba AD DC.
> 
> *My Environment:*
> 
> ?? -
> 
> ?? *Samba Version:* Version 4.22.6-Debian-4.22.6+dfsg-0~~mjt+deb12
> ?? -
> 
> ?? *OS:* Debian 12
> 
> *My Goal:* I am trying to create a simple GPO (User Configuration >
Preferences > Folders) to create a new folder for users at
%UserProfile%\DevRuns\bin.
> 
> *The Problem:* When I am in the Group Policy Management Editor and try to
save this new "Folders" setting, I get an "Access Denied"
error. The exact message is: Error (0x80070005) occurred saving settings file.
Access is denied.
> 
> *Troubleshooting Steps I Have Taken:*
> 
> I assumed it was a SYSVOL permissions issue, so I ran the following
commands on my Debian server:
> 
> ?? 1.
> 
> ?? First, I ran samba-tool ntacl sysvolcheck. It failed and reported a
> ?? mismatch:
> 
> ?? ERROR(<class 'samba.provision.ProvisioningError'>):
uncaught
> exception - ProvisioningError: DB ACL on GPO directory
>
/var/lib/samba/sysvol/campus.sertao.ifrs.edu.br/Policies/{301F7BDC-2E40-4E97-BD1D-BCB90E5D3DB0}/User/Preferences/Folders
>
O:BAG:DAD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;;;AU)(A;OICI;0x1200a9;;;ED)
> does not match expected value
>
O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;OICI;0x1200a9;;;ED)
> from GPO object
> ?? ...
> 
> ?? 2.
> 
> ?? Next, I ran samba-tool ntacl sysvolreset to fix the permissions.
> ?? 3.
> 
> ?? I ran samba-tool ntacl sysvolcheck again, and it completed with no
> ?? errors. The permissions seemed to be fixed.
> ?? 4.
> 
> ?? I went back to Windows and tried to save the GPO setting again. It
> ?? failed with the *exact same error: 0x80070005*.
> ?? 5.
> 
> ?? After the failed save, I ran samba-tool ntacl sysvolcheck one more time,
> ?? and it reported the same ACL mismatch error as in step 1.
> 
> It seems that sysvolreset works, but the moment I try to save the GPO from
> Windows, the save operation fails and breaks the ACLs again.
> 
> Has anyone seen this behavior? Is this a configuration I am missing?
> 
> Thank you for your help.
> --
> Elias Pereira
> --