search for: grouppolicyobject

...fails and so does gpupdate, same errors > in the log as well. Can you tell the windows event id and description? And which group is set on sysvol in general on the share tab. And run CMD: gpresult /H gpreport.html gpreport.html ( browser will open ) At Computer details, check the applied GroupPolicyObjects. There you can see the security filters, which groups are use in/for the gpo objects. Repeat for User details. I dont need the computer/user details, but i do need the event id and description of the fails. Greetz, Louis

...preventing making error or resetting rights. > > - Do the same for Netlogon. Same settings as sysvol, since its a sub folder of sysvol. > > > - These steps are imo only done once, ( ! Or if you get errors again due to a reset or change in windows clients ) > Now first goto the GroupPolicyObjects, ( not the linked once's ) > Klik on every GPO object there, if you get any message, press ok, then its reset. > > Now, you need to check the GPO Objects that are assigned/linked to OU and/or groups. > > Just start in the top, and klik every object. > All my "normal&qu...

ok, do the following. set ignore systemacl to yes on sysvol and netlogon. login as dom\administrator computer manager, connect to dc. share sysvol, goto share security, reset to defalts. same for folder. goto gpo manager, klik on every gpo object, if one has wrong acl, you get a message to reset it, thats ok. now never samba-tool sysvol reset if you do, you might need to set share/file

...folder security. That helps preventing making error or resetting rights. - Do the same for Netlogon. Same settings as sysvol, since its a sub folder of sysvol. - These steps are imo only done once, ( ! Or if you get errors again due to a reset or change in windows clients ) Now first goto the GroupPolicyObjects, ( not the linked once's ) Klik on every GPO object there, if you get any message, press ok, then its reset. Now, you need to check the GPO Objects that are assigned/linked to OU and/or groups. Just start in the top, and klik every object. All my "normal" GPO Objects only have Aut...

...then folder security. That helps preventing making error or resetting rights. - Do the same for Netlogon. Same settings as sysvol, since its a sub folder of sysvol. - These steps are imo only done once, ( ! Or if you get errors again due to a reset or change in windows clients ) Now first goto the GroupPolicyObjects, ( not the linked once's ) Klik on every GPO object there, if you get any message, press ok, then its reset. Now, you need to check the GPO Objects that are assigned/linked to OU and/or groups. Just start in the top, and klik every object. All my "normal" GPO Objects only have Authen...

> It's needed after every GPO addition and edit. There must be a root > cause to hunt down somewhere. Or is it a bug in 4.13.0 ? Yes, and no. Yes, its a bug. No, in my opionion its an old setting thats just needs some updating. Try this. samba-tool ntacl set "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01