search for: 3000127

Hello, Since I updated recently my samba DC's, I've noticed some werid behaviour on windows stations (seems random?) with some GPO's not being applied from time to time (reboot or even logoff-login usually does the trick). When policy is not applied and I run "gpupdate" on windows client  I'm getting output, that policy xxx (Default domain policy) could not be

..., when more than 1 user/group is added at a time, before they manage to replicate to other DC's, then order in which local idmapping is done might be different on DC's.  I tested it yesterday in test environment: I added 2 users to DC3 with no UID, and on DC3 and DC2 they were mapped to 3000127 (1st) 3000128 (2nd), and on DC1 1st(3000128 and 2nd 3000127. Then, obviously, when I applied ACL for user 1st, after sysvol rsynced to dc2 and dc3, they had messed up mappings - copying idmap.ldb from DC1 again solved this issue. So question: how can You prevent such scenario? Are you supposed...