similar to: Permission denied on GPT.ini (Event ID 1058)

Hi, Yes using rsync followed by a samba-tool ntacl sysvolreset Regards Le 18/03/2016 18:29, lingpanda101 at gmail.com a écrit : > Are you currently replicating the sysvol folder between DC's? > > On 3/18/2016 1:23 PM, Sébastien Le Ray wrote: >> Hi list, >> >> Having a multi-DC Samba 4.1.17 (Debian) setup, we use Computer GPOs. >> >> Machines randomly

I just saw this thread while browsing my emails and I want to report that I get this frequently but randomly on every Samba4 domain I run. It is completely random in that it affects a PC today, but a week from now that same PC may work just fine. It may then affect a different PC which had no issues prior. Also, if I click the link to "gpt.ini" in the event log the file DOES open and I

On 3/18/2016 1:32 PM, Sébastien Le Ray wrote: > Hi, > > Yes using rsync followed by a samba-tool ntacl sysvolreset > > Regards > > > Le 18/03/2016 18:29, lingpanda101 at gmail.com a écrit : >> Are you currently replicating the sysvol folder between DC's? >> >> On 3/18/2016 1:23 PM, Sébastien Le Ray wrote: >>> Hi list, >>> >>>

Are you currently replicating the sysvol folder between DC's? On 3/18/2016 1:23 PM, Sébastien Le Ray wrote: > Hi list, > > Having a multi-DC Samba 4.1.17 (Debian) setup, we use Computer GPOs. > > Machines randomly encounter event 1058 (translation is roughly "GPO > processing failed. Windows failed to read file > \\domain\sysvol\domain\Policies\SomeGUID\gpt.ini

Le 18/03/2016 18:50, lingpanda101 at gmail.com a écrit : > Have you tried running 'gpresult /H GPReport.html' on the workstation > and see if it provides any details? You can also run 'Group Policy > Results' from within Microsoft Group Policy Management snap in. Yes, it show an error about maximum kerberos tickets exceeded but I take that for a generic error message…

Ok, try this. Gif the pc a uid and check again. If it works then, its a share or security right. Gpupdate /force works because at that point you "user"/user has a uid and gid. The error occurs at start up because the COMPUTERNAME$ doent have access to that gpt.ini. Resetting sysvol in that case doent help because the right on the gpt.ini is set by the group you assigned to the

Hai, Today i had a "about" same problem. Check the following. 1) Get the Policy id ( like ": {78732DBF-5381-497B-9B25-00A278270A1F} from PATH_TO_SYSVOL_FOLDER/Policies/ 2) run getfacl on the folder like : getfacl \{78751DBF-5381-497B-9B25-00A278270A1F\}/ here in my case i noticed the following. I had a user set on one specific policie, i changed that users to a newly

To see which DC is used by Windows client: open a MSDOS console, type "set", look for LOGONSERVER=\\<your_dc> <your_dc> is the DC used to connect on. If issue comes from one DC I would have on sysvol synchronisation between DC, ACL on all sysvol, DNS entries (but I don't think that's a DNS issue if you have only GPO issue). 2016-03-29 14:51 GMT+02:00 Sébastien Le

Le 18/03/2016 20:58, lingpanda101 at gmail.com a écrit : > On 3/18/2016 2:15 PM, Sébastien Le Ray wrote: >> >> >>> >>> Are you using Item level targeting in your GPO? >>> >> >> No > > When this error happens, can you confirm if you can manually navigate > to the file? Open file explorer and enter the UNC path. > > ie.

I'm not an expert in idmap (at all in fact :p) but I thought idmap stuffs were here to replace RFC2307 UID/GID declared into AD/LDAP objects. In others words, if you configure correctly idmap into smb.conf I expect you don't need any more declaring UID/GID for machine accounts. Anyway here my machines get access to their GPO: I tested one computer's GPO this morning, the one giving

Ok based on the MS link. Have you enabled under Computer Configuration in the navigation tree on the left side, navigate to Administrative Templates\System\Logon Enable "Always wait for the network at computer startup and logon" If not done yet. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Sébastien Le Ray

I hate 'me too' replies - but I have also been struggling with this for some years in my multi-DC environment. (yes, replicated sysvol via lsyncd + rsync; permissions looked identical via getfacl last time I checked). Sometimes a client machine will run gpupdate just fine; other times it will fail, seemingly randomly. My next step was going to be to run wireshark on a client machine to

Ok, where your pc's get the DNS info from? Server : AD-DC + DNS Or Server : AD-DC + Some other server with DNS Can you give the output of dig NS your.domain.tld and tel us what what is. > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Sébastien Le Ray > Verzonden: dinsdag 29 maart 2016 16:31 > Aan: samba at

I found this one. Check which one works for you. http://www.eventid.net/display-eventid-40960-source-LSASRV-eventno-8508-phase-1.htm Im sure this is not a samba configuration problem. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens L.P.H. van Belle > Verzonden: dinsdag 29 maart 2016 16:18 > Aan: samba at

Complete event id of : > But still, events log show a warning about kerberos ticket from LsaSrv > source and right after a permission denied on GPT.ini And a getfacl of the problem GPO SID please, i'll check. And a output of ipconfig /all on the problem pc. And question, dedicated IP or dhcp IP? Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba

I have an AD with 1 Samba DC and 5 Windows 10 clients. The DC and the clients all have a fixed IPv4 address. In the windows event viewer, I constantly see the following warning: Event 8019, DNS Client Events ------------------------------------------ The system failed to register host (A or AAA) resource records (RRs) for network adapter with settings: Adapter Name: {someGUID} Host Name:

Ok,   > I don't think so, I launch gpupdate using local admin account, so as I > understand it, only computer account is used (since local admin as no > existence on the domain) Why a local admin, please use a ?domain admin? ..   Test as follow. Open de security tab of the GPT.INI. Advanced settings, last tab, effective settings, At objecttype, deselect all, select

On 03/23/2016 03:12 PM, Sébastien Le Ray wrote: > And did you add those IDs to the sysvol share permissions? > I guess you used samba-tool since I cannot find any gid/uid fields in RSAT I added them using LAM, because yes: using RSAT i also could not. (lam: www.ldap-account-manager.org/)

So I ran a samba-tool ntacl sysvolcheck, and the following error message came up: --------------------snip-------------------- ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO directory /var/lib/samba/sysvol/samdom.com/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Scripts/Startup

Hi Sébastien, On 03/22/2016 04:04 PM, Sébastien Le Ray wrote: > Clicking on the link in the events viewer (which *never* fails) opens it > as the logged in user, that's why I'm convinced the issue is tied to > machine accounts handling I have had problems with machine accounts accessing sysvol folders on smba DCs. I solved this by adding a gid & uid to the machine accounts.