search for: sysvolrest

Hai, If you dont mind to share the OS and Samba version you are using? Because we dont see this much: > Thanks. Just ran "samba-tool ntacl sysvolrest" and that seems > to have fixed the issue. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > Marco Shmerykowsky PE via samba > Verzonden: maandag 21 januari 2019 20:21 > Aan: samba at lists.samba.org >...

Hello Marc, > Hi Anantha, > > Am 06.07.2017 um 10:02 schrieb Anantha Raghava via samba: >> Is there any way we can rebuild corrupt Default Domain Policy and >> Default Domain Controller Policy. > What is broken? Entire Default Domain and Default Domain Controller Policies along with other Polices that we had built are broken. >> In windows AD we can use dcgpofix

...ere getting applied. All of a sudden, we are finding that GPO applying process is erratic. Sometime it applies and sometimes not. We have edited the Default Policy using Windows RAST tool. Thinking that ACLs on "Sysvol" are incorrect, we reset the SYSVOL using "samba-tool ntacl sysvolrest" command. The problems are persisting. Many client workstations, do not get the policies. Another observation: The DNS,when queried for domain name throws up the domain controller address randomly. That is we have 3 Domain controllers and two of them are turned off for confirming whether...

...a first come basis, when a user or group first contacts a Samba DC it is allocated the next xidNumber, this is why you are not sure to get the same ID number on every DC. This is not a problem however, as each DC knows the xidNumber for the the group. So if you rsync sysvol between DCs and then run sysvolrest, the correct xidNumber for that DC will be set. You can also copy idmap.ldb between DCs as well, but I don't see the point. The only way to get consistent IDs for the users and groups that matter, is to use the winbind 'ad' backend. This means giving users a unique UidNumber and Domain...

<?xml version="1.0" encoding="utf-8"?> <Drives clsid="{8FDDCC1A-0C3C-43cd-A6B4-71A6DF20DA8C}"><Drive clsid="{935D1B74-9CB8-4e3c-9914-7DD559B7A417}" name="W:" status="W:" image="2" changed="2019-01-21 18:36:07" uid="{6524E6E3-E107-48CC-9973-406E16B5F34D}" userContext="1"

...9; needs to own directories in the extra policies added, it cannot do this if it has a gidNumber, this is because it is then only a group and a group in Unix cannot own anything. In your case, after you have recreated sysvol, I would run sysvolreset, then add your other policies and then never run sysvolrest again. Rowland

I was trying to update the group policy with gpupdate /force and was getting an error message saying can't connect to \\example.local\sysvol\example.local\Polices...etc So when I tried to navigate there I could not see the Polices folder. I ran samba-tool ntacl sysvolreset and tried again, rebooted...still nothing. Then instead of using example.local, I just used the IP, 192.168.0.3 and then

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hallo, when I do an "samba-tool gpo list username" I get an "faild access check on OU=name,......". But not if I do a "samba-tool gpo listall" then everything is ok. Is this normal? If I take "administrator" as username I didn't get this message. Stefan -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2

...re using Samba AD 4.6.3 and built it from source on >>> CentOS 7. The DNS back end is BIND 9.9.4 >> ..... >>> Thinking that ACLs on "Sysvol" are incorrect, we reset the >>> SYSVOL using "samba-tool ntacl sysvolrest" command. The >>> problems are persisting. Many client workstations, do not get >>> the policies. >> Add user system to sysvol, and dont run samba-tool ntacl sysvolreset again. >> Your GPOs should work fine, if not p...

Also, I'm not sure whether this has any relevance to the problem but I did at one point try to set up a secondary AD server but was struggling to get it going so demoted it using "Demote an Offline Domain Controller" from this page https://wiki.samba.org/index.php/Demote_a_Samba_AD_DC I also went through the "Verifying the Demotion" checks on this page and all looked