similar to: Samba 4.5.3 AD DC - issues with sysvol when setting up Group Policies

Hi Andrew, thanks so much for the feedback. Yes, you're 100% right. I'm new at this and originally changed the default GPO, however subsequently reset the default and created a new GPO. (so this getfacl output is post creation of a new GPO) The getfacl output is shown here: # getfacl /usr/local/samba/var/locks/sysvol/mydomain.com/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}

Hi James The output is as follows... wbinfo --gid-info=10013 => CT\domain admins:x:10013: wbinfo --gid-info=10014 => CT\domain users:x:10014: wbinfo --uid-info=3000000 => BUILTIN\administrators:*:3000000:3000000::/home/BUILTIN/administrators:/bin/false wbinfo --uid-info=3000008 => CT\domain admins:*:3000008:3000008::/home/CT/domain admins:/bin/false Yes I have set

On 1/12/2017 2:09 PM, Rowland Penny via samba wrote: > On Thu, 12 Jan 2017 20:46:15 +0200 > Richard via samba <samba at lists.samba.org> wrote: > >> Hi James >> >> The output is as follows... >> >> wbinfo --gid-info=10013 => CT\domain admins:x:10013: >> >> wbinfo --uid-info=3000008 => CT\domain >>

Hi Rowland, I've done the below and retried to log on as a normal user, but sadly: C:\> gpupdate /force still returns The processing of Group Policy failed. Windows attempted to read the file \\ct.mydomain.com\sysvol\ct.mydomain.com\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until

Hi here are the commands in the order I ran them: root at dc1:~ # systemctl stop samba root at dc1:~ # net cache flush root at dc1:~ # samba-tool ntacl sysvolreset root at dc1:~ # net cache flush root at dc1:~ # samba-tool ntacl sysvolcheck root at dc1:~ # systemctl start samba root at dc1:~ # smbclient //localhost/sysvol -UAdministrator -c 'ls' Enter Administrator's password:

Hi root at dc1:~ # samba-tool dbcheck --cross-ncs --reset-well-known-acls --fix --yes ...some error information... Checked 3647 objects (2 errors) root at dc1:~ # samba-tool dbcheck --cross-ncs --reset-well-known-acls --fix Checking 3647 objects Checked 3647 objects (0 errors) root at dc1:~ # getfacl /usr/local/samba/var/locks/sysvol/ getfacl: Removing leading '/' from absolute path

cool! root at dc1:~ # wbinfo -r richard.h 10001 3000008 10000 10014 10004 10005 3000005 3000009 3000000 -----Original Message----- From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of lingpanda101 via samba Sent: 12 January 2017 22:57 To: samba at lists.samba.org Subject: Re: [Samba] Samba 4.5.3 AD DC - issues with sysvol when setting up Group Policies On 1/12/2017 3:47 PM,

Also, I'm not sure whether this has any relevance to the problem but I did at one point try to set up a secondary AD server but was struggling to get it going so demoted it using "Demote an Offline Domain Controller" from this page https://wiki.samba.org/index.php/Demote_a_Samba_AD_DC I also went through the "Verifying the Demotion" checks on this page and all looked

Hai, ? im running samba 4.2.2 sernet on debian. ? when i run : samba-tool gpo aclcheck -UAdministrator ? im getting : ERROR: Invalid GPO ACL O:DAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) and it tells me it should be O:DAG:DAD:P?

Thanks Luis I've changed the smb.conf as you said, now it looks like this: root at ccdc-samba4:~# cat /etc/samba/smb.conf # Global parameters [global] workgroup = CCDC realm = CCDC.LAN netbios name = CCDC-SAMBA4 server role = active directory domain controller idmap_ldb:use rfc2307 = yes dns forwarder = 9.0.138.50 auth methods = sam,

Please read the reported bug and bjorn answer.. which does not help any to a solution of fix, or explenation. But the big question now is, does someone somewhere know what bjorn is talking about. i did search for "gencache" but no go here.. just from old documentation. https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/tdb.html gencache.tdb Generic caching database.

Colleagues, I come to seek help to solve this problem. I use Samba 4.4.5. I'm getting errors when running gpupdate / force on local desktops. I get the following error: User policy could not be updated successfully. The following errors were encountered: The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object

On 30/04/15 09:09, L.P.H. van Belle wrote: > ( sorry for mailing directly bjorn, but please have a look ) > > I still think this is a bug.. > > why not a bug: > If i do assign a UID/GID to a user, then yes, this wil work fine. > new users and groups sure.. but now im talking about the default domain groups.. > > why a bug: > User administrator and the domain groups

Hello, I have manually mounted the SYSVOL share, sync it with samba and run samba-tool ntacl sysvolreset. But I'm not sure if all windows policies are acceptable by samba because of errors logs: 2015/03/18 09:30:52.197934, 0] ../source3/smbd/oplock.c:338(oplock_timeout_handler) Oplock break failed for file myDomain.local/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/USER/Registry.pol --

Of course, the sysvol is located on a windows controller from the forest. mount -t cifs -o username=domain_admin_user //windowsDC.myDomain.local/SYSVOL /mnt/smb/sysvol and copied the files with -R --preserve to /usr/local/samba/var/locks/sysvol/ Below logs are provided from /usr/local/samba/var/log.smbd file. regards, On Wed, Mar 18, 2015 at 3:36 PM, Rowland Penny <rowlandpenny at

On 1/12/2017 11:41 AM, Richard via samba wrote: > Hi Andrew, > > thanks so much for the feedback. > > Yes, you're 100% right. I'm new at this and originally changed the default GPO, however subsequently reset the default and created a new GPO. (so this getfacl output is post creation of a new GPO) > > The getfacl output is shown here: > > # getfacl

Sorry, I have omitted to post the config file. # cat /usr/local/samba/etc/smb.conf [global] workgroup = myDomain realm = myDomain.local netbios name = DCLINUX server role = active directory domain controller dsdb:schema update allowed = yes [netlogon] path = /usr/local/samba/var/locks/sysvol/rcs-rds.local/scripts read only = No [sysvol]

hello list, I noticed that when I run the command gpupdate in the clients I get the following error C:>gpupdate Updating policy... Computer policy could not be updated successfully. The following errors were enc ountered: The processing of Group Policy failed. Windows attempted to read the file \eccm g.cupet.cusysvoldomainPolicies{31B2F340-016D-11D2-945F-00C04FB984F9} gpt.ini from a domain

Good Day All I have a current working configuration of sernet-samba-4.2.1, created by upgrading from a samba3 PDC using the classic upgrade. Now, I have added a windows 2008 machine to the domain and I'm using the AD snap in tools in order to browse the domain. I can see all the users and groups and they have been imported correctly. However I am able to remote desktop to the domain

> It's needed after every GPO addition and edit. There must be a root > cause to hunt down somewhere. Or is it a bug in 4.13.0 ? Yes, and no. Yes, its a bug. No, in my opionion its an old setting thats just needs some updating. Try this. samba-tool ntacl set "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01