samba - Mar 2026 - sysvolcheck problem after any changes in gpedit

I am experiencing a persistent issue with permission preservation in the 
SYSVOL directory on a Samba AD DC (Functional Level 2016). From that AD 
I replicate data (Sysvol and Idmap) to other Domain Controllers using 
|rsync|.

Every time I modify smth in gpmc.msc? ?from a Windows workstation, the 
ACLs in the SYSVOL directory become corrupted. Consequently, clients 
stop applying policies, and |samba-tool ntacl sysvolcheck| starts 
reporting errors.

The only current workaround is to manually run |samba-tool ntacl 
sysvolreset| after every single GPO change. Once executed, everything 
returns to normal, and |rsync| successfully replicates the corrected 
data to the remaining DCs. This is highly frustrating as every group 
policy? operation requires manual shell intervention on the server.

*OS:*?Debian 12

*File System:* BTRFS (mounted on /) - everything on one partition

SAMBA 4.22

*Current smb.conf:*

|[global]|

|ad dc functional level = 2016 server role = active directory domain 
controller realm = AAA.LAN workgroup = AAA netbios name = DC01 winbind 
enum users = yes winbind enum groups = yes [sysvol] path = 
/var/lib/samba/sysvol read only = No [netlogon] path = 
/var/lib/samba/sysvol/aaa.lan/scripts read only = No|

I would appreciate any suggestions on how to stabilize SYSVOL 
permissions in this environment.

sysvol, and idmap.ldb should be synced. See:

http://samba.bigbird.es/doku.php?id=samba:sync-idmap.ldb

Also, you should cron this on the PDC emulator FSMO owner at lest (no harm to do
in others too):

if ! samba-tool ntacl sysvolcheck; then samba-tool ntacl sysvolreset; fi

To run every so often.
On Mar 8, 2026 at 20:13 +0000, Piotr Adamcio via samba <samba at
lists.samba.org>, wrote:
> I am experiencing a persistent issue with permission preservation in the
> SYSVOL directory on a Samba AD DC (Functional Level 2016). From that AD
> I replicate data (Sysvol and Idmap) to other Domain Controllers using
> |rsync|.
>
> Every time I modify smth in gpmc.msc? ?from a Windows workstation, the
> ACLs in the SYSVOL directory become corrupted. Consequently, clients
> stop applying policies, and |samba-tool ntacl sysvolcheck| starts
> reporting errors.
>
> The only current workaround is to manually run |samba-tool ntacl
> sysvolreset| after every single GPO change. Once executed, everything
> returns to normal, and |rsync| successfully replicates the corrected
> data to the remaining DCs. This is highly frustrating as every group
> policy? operation requires manual shell intervention on the server.
>
> *OS:*?Debian 12
>
> *File System:* BTRFS (mounted on /) - everything on one partition
>
> SAMBA 4.22
>
> *Current smb.conf:*
>
> |[global]|
>
> |ad dc functional level = 2016 server role = active directory domain
> controller realm = AAA.LAN workgroup = AAA netbios name = DC01 winbind
> enum users = yes winbind enum groups = yes [sysvol] path >
/var/lib/samba/sysvol read only = No [netlogon] path >
/var/lib/samba/sysvol/aaa.lan/scripts read only = No|
>
> I would appreciate any suggestions on how to stabilize SYSVOL
> permissions in this environment.
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba

Piotr Adamcio via samba <samba at lists.samba.org> wrote:
> Every time I modify smth in gpmc.msc   from a Windows workstation, the
> ACLs in the SYSVOL directory become corrupted. Consequently, clients
> stop applying policies, and |samba-tool ntacl sysvolcheck| starts
> reporting errors.

Yes, this happens consistently, in my case over a number of domains and
functional levels. Any change to the sysvol by gpmc.msc results in samba-tool
ntacl sysvolcheck complaining until you run sysvolreset.
Side-by-side comparison of the ACL's that appear in the output of
sysvolcheck:

$ diff -y actual expected
O:DAG:DAD:PAI               | O:DAG:DAD:PAR
(A;OICI;FA;;;DA)              (A;OICI;FA;;;DA)
(A;OICI;FA;;;EA)              (A;OICI;FA;;;EA)
(A;OICIIO;FA;;;CO)            (A;OICIIO;FA;;;CO)
(A;OICI;FA;;;DA)              (A;OICI;FA;;;DA)
(A;OICI;FA;;;SY)              (A;OICI;FA;;;SY)
(A;OICI;0x1200a9;;;ED)        (A;OICI;0x1200a9;;;ED)
(A;OICI;0x1200a9;;;AU)        (A;OICI;0x1200a9;;;AU)
(A;OICI;0x1200a9;;;DC)        (A;OICI;0x1200a9;;;DC)
                           >
(OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;DC)
$ samba --version
Version 4.22.6-Debian-4.22.6+dfsg-0+deb13u1~bpo12+1

Work around this by setting up that cron job.