similar to: Permission denied on GPT.ini (Event ID 1058)

Complete event id of : > But still, events log show a warning about kerberos ticket from LsaSrv > source and right after a permission denied on GPT.ini And a getfacl of the problem GPO SID please, i'll check. And a output of ipconfig /all on the problem pc. And question, dedicated IP or dhcp IP? Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba

Ok, where your pc's get the DNS info from? Server : AD-DC + DNS Or Server : AD-DC + Some other server with DNS Can you give the output of dig NS your.domain.tld and tel us what what is. > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Sébastien Le Ray > Verzonden: dinsdag 29 maart 2016 16:31 > Aan: samba at

I hate 'me too' replies - but I have also been struggling with this for some years in my multi-DC environment. (yes, replicated sysvol via lsyncd + rsync; permissions looked identical via getfacl last time I checked). Sometimes a client machine will run gpupdate just fine; other times it will fail, seemingly randomly. My next step was going to be to run wireshark on a client machine to

I dont read any france but translators work ok. ;-) pfew.. Ok any firewalling on the DC's? if so, open TCP and UDP port 88. Or try short without firewalls on, on the DC's. Other options to try is recude the MaxPacketSize in windows. Looks like a to big package which is rejected. Ow and above is also needed on the DNS port 53. Open tcp and udp. If the upd packages are to big,

Sorry for my delayed response, my job has had me out of state for a while. I wanted to add that I am not getting the Kerberos error in my event logs. It just flat out claims that it cannot read gpt.ini for some reason. This happens randomly, whether dc01 or dc02 is the logon server, and the strange part is that most PCs can work fine, but one or two randomly won't. In other words, if pc1 and

Ok, same as im running. DC => (replicated zones) => Slave DNS << == Client pc's. Have you tried to reset the network id manualy from withing windows. ( where you change/add the computer to the network ) The button "change network-id." I have seen these things also with pc's which are wrongly syspreped. Which cases same SID's for the pc's. But

Hai, Yeah, you have probely one of these 2 problems. ( or both ) 1) This is probely because your "computer" *(user) does not have any acces. Recheck you permissions on the share and and folders for that specific policie. 2) Connections specific suffic and/or network suffic is wrong. Check if you pc is setup correct with dhcp. Ipconfig /all ( check these, and make sure you have

new thread, old issue been fiddling off-list with tips from Louis over the last days, and putting it back to the list to ask for help from others: 2 samba-4.9.11 DCs 1 samba-4.8.12 DM file server GPOs not working cleanly anymore tried to resync completely etc etc - right now I test gpupdate/gpresult on an older (not productive) W2008R2 server which I use for editing stuff via RSAT/MMC I

To see which DC is used by Windows client: open a MSDOS console, type "set", look for LOGONSERVER=\\<your_dc> <your_dc> is the DC used to connect on. If issue comes from one DC I would have on sysvol synchronisation between DC, ACL on all sysvol, DNS entries (but I don't think that's a DNS issue if you have only GPO issue). 2016-03-29 14:51 GMT+02:00 Sébastien Le

Hello Sébastien Le Ray, The PC reply the following... The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one or more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller). The

Dear Sébastien, Sorry for the delay, Please check on the log below. As for the word "存取被拒。" it should translate to Access Deny... Please help. - <Event xmlns="*http://schemas.microsoft.com/win/2004/08/events/event <http://schemas.microsoft.com/win/2004/08/events/event>*"> - <System> <Provider Name="*Microsoft-Windows-GroupPolicy*"

Hi all, An user queried whether the error "Your profile was not synchronised with the server" was a big problem, so I had a look into it.? This only happens on one computer, all non-admin users has this problem, the Samba admin account don't have this problem.? Looking into the windows error log, we get plenty of messages of the below:

I'm not an expert in idmap (at all in fact :p) but I thought idmap stuffs were here to replace RFC2307 UID/GID declared into AD/LDAP objects. In others words, if you configure correctly idmap into smb.conf I expect you don't need any more declaring UID/GID for machine accounts. Anyway here my machines get access to their GPO: I tested one computer's GPO this morning, the one giving

2016-04-04 14:20 GMT+02:00 Rowland penny <rpenny at samba.org>: > On 04/04/16 10:23, mathias dufresne wrote: > >> SOA means "this DNS se'rver can modify the zone". >> > > No it doesn't, it stands for 'Start Of Authority' and contains who to > contact for the domain records. > Rowland... thank you again Captain Obvious. Yes SOA means

I would appreciate it if you can change the host value in the /etc/nsswitch.conf file from *hosts:* to *files wins dns * and try again by restarting the server, since the error occurs whenever I restart the server. However, If I change the host value which is *hosts: * in the /etc/nsswitch.conf file to *files dns wins *and restart the server everything runs perfectly, when the alignment of

On 03/23/2016 03:12 PM, Sébastien Le Ray wrote: > And did you add those IDs to the sysvol share permissions? > I guess you used samba-tool since I cannot find any gid/uid fields in RSAT I added them using LAM, because yes: using RSAT i also could not. (lam: www.ldap-account-manager.org/)

Ok, what is the windows event log telling you. You should see an error. What is the description and event id. Gr. Louis > -----Oorspronkelijk bericht----- > Van: Mueller [mailto:mueller at tropenklinik.de] > Verzonden: dinsdag 15 maart 2016 10:31 > Aan: 'L.P.H. van Belle'; samba at lists.samba.org > Onderwerp: AW: [Samba] Windows 10 does not register dns in samba

SOA means "this DNS se'rver can modify the zone". Using Bind-DLZ all DNS servers can modify the AD zones, they all reply "I am the SOA" when you ask them about SOA for AD zones. Using Internal DNS I expect all DNS servers can modify the AD zones also (that's internal stuff) but even if they can modify the AD zone locally that's is not the process chosen by Samba

Dear All, I am running a two location SOHO network with a Microsoft AD on a Windows 2008 R2 server. In detail, the infrastructure is as follows: Primary location: - 1 DC on Windows 2008 R2 hardware server - 1 DC on Windows 2008 R2 virtual server - 2 DC on Windows 2016 virtual servers (forest functional level 2008) - 1 DC on Samba 4.6.2 on Debian Jessie Secondary location: - 1 DC on Samba 4.6.3

Hi all, Thank you Mark for these precisions. I did switch a DC to --dns-backend=NONE using samba-tool domain join. This removed dns-<DCname> user for this DC and associated keytab. We changed /etc/resolv.conf to use another DC - one with Bind running - as nameserver. Stopping there, running samba_dnsupdate gave error "NOTAUTH". As we want our DC being able to push into DNS