similar to: Default Domain Policy (was Re: Problems with sysvolcheck)

> > > Yes, There are three places where permissions are stored on sysvol (4 if you count in AD), the standard Linux permissions 'ugo', POSIX > ACLs as shown by getfacl and an EA (this is where the ACLs are stored when set from Windows). > > Try running 'samba-tool ntacl get /var/lib/samba/sysvol --as-sddl', this should produce something similar to this: >

GPOs are not synchronized, because I'm going to delete the zentyal domain, how can I delete delete all GPOs from AD y sysvol? and start over [root at srv-cds ~]# samba-tool gpo del {31B2F340-016D-11D2-945F-00C04FB984F9} GPO {31B2F340-016D-11D2-945F-00C04FB984F9} is linked to containers ERROR(ldb): Error removing GPO from container - LDAP error 50 LDAP_INSUFFICIENT_ACCESS_RIGHTS - El

so how can I synchronize GPOs stored under the sysvol directory and stored in AD. El 12/14/2017 a las 12:59 PM, Rowland Penny via samba escribió: > On Thu, 14 Dec 2017 12:25:29 -0500 > "Lic. Liusmer Martínez Q via samba" <samba at lists.samba.org> wrote: > >> GPOs are not synchronized, because I'm going to delete the zentyal >> domain, >> >>

Hello, I have problems getting GPOs applied on clients. Running the command samba-tool ntacl sysvolcheck I get a file not found error. I have tried to provision the domain in a virtual machine and transfer the sysvol files with rsync But the problem persists. samba version: 4.4.5 how could completely remove the default policy to try to fix the problem? Best regards, Santiago. --

On Wed, 20 May 2020 at 14:48, Roy Eastwood via samba <samba at lists.samba.org> wrote: > Yes, I get the similar output but it's not what sysvolcheck is expecting. Well I suppose sysvolcheck isn't happy with the > permissions, but as GPOs are able to be edited, changed and are applied to both computers and users then I assume this can be > ignored. I got the acl

Hello, Thanks for your answer I have tried to alter the default policies but the error persists ./samba-tool ntacl sysvolreset open: error=2 (No such file or directory) ERROR(runtime): uncaught exception - (-1073741823, 'Undetermined error') File "/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/__init__.py", line 175, in _run return self.run(*args, **kwargs)

Hi Rowland On 25 May 2018 at 16:09, Rowland Penny via samba <samba at lists.samba.org> wrote: > > The problem with sysvolcheck & sysvolreset is they have never used the > Owner, group and ACLs that windows uses. Having said that, as long as > no BULTIN or DOMAIN user or group (except Domain Users) has a uidNumber > or gidNumber AND you haven't added any extra GPOs,

On Thu, 22 Jun 2017 09:09:26 -0300 "Carlos A. P. Cunha" <carlos.hollow at gmail.com> wrote: > Hello! > > Does not really have to be done about it? : - | > > OK, lets be honest here, the ACLs Samba sets on sysvol are not the same that Windows does and when you add new GPOs, it gets worse. the 'Domain Admins' group needs to own directories in sysvol and if

I recently discovered that only the Default Domain Policy is being applied. All other GPOs seem to be ignored. All Sysvol filesystem objects have the right permissions. Both DCs are running Samba 4.4.3 over CentOS 7. There are no related errors in logs or Windows Event Viewer. Other policies did work before. I noticed that the corresponding filesystem objects were lastly placed on users’ desktops

> -----Original Message----- > On Mon, 29 Dec 2003, [ISO-8859-1] ?ncor Gonz?lez Sosa wrote: > > With Samba you can do only what you can do with NT4 using the > NTConfig.POL file. > > > You can copy the files Win2K creates in > c:\WINNT\SYSVOL\sysvol\domainname\profiles to a share called > "SYSVOL" under the path: >

On Wed, 30 Aug 2023 12:40:08 +0200 Peter Milesson via samba <samba at lists.samba.org> wrote: > > > On 30.08.2023 11:58, Rowland Penny via samba wrote: > > On Wed, 30 Aug 2023 09:49:05 +0200 > > Peter Milesson via samba <samba at lists.samba.org> wrote: > > > >> > >> On 29.08.2023 21:38, Andrew Bartlett via samba wrote: > >>>

On 30.08.2023 16:21, Rowland Penny via samba wrote: > On Wed, 30 Aug 2023 12:40:08 +0200 > Peter Milesson via samba <samba at lists.samba.org> wrote: > >> >> On 30.08.2023 11:58, Rowland Penny via samba wrote: >>> On Wed, 30 Aug 2023 09:49:05 +0200 >>> Peter Milesson via samba <samba at lists.samba.org> wrote: >>> >>>> On

On Wed, 30 Aug 2023 18:56:48 +0200 Peter Milesson via samba <samba at lists.samba.org> wrote: > > > On 30.08.2023 16:21, Rowland Penny via samba wrote: > > On Wed, 30 Aug 2023 12:40:08 +0200 > > Peter Milesson via samba <samba at lists.samba.org> wrote: > > > >> > >> On 30.08.2023 11:58, Rowland Penny via samba wrote: > >>> On

Hello, we have a strange problem with the "Default Domain Policy". Sometimes on different PC the drivmappings are not working. When we do a "gpupdate /force" we get an errormessage that the "default domain policy" is not working for both the user-GPOs and the machine-GPOs. We checked the permissions with "samba-tool ntacl sysvolcheck" and with

What have you joined it to ? zentyal 4.2.11, Samba version 4.3.4-Zentyal El 12/14/2017 a las 11:49 AM, Rowland Penny via samba escribió: > What have you joined it to ?

Hi Andrew and Louis, Found the issue: after rsync-ing the sysvol from our old decommissioned DCs, the sysvolreset/sysvolcheck DO work out. I tried to keep the things simple first, by NOT immediately importing our old sysvol contents, but first check with a default sysvol... I thought that the sysvolreset would just reset whatever is located under samba/sysvol, but I guess that it reads the

On 30.08.2023 19:17, Rowland Penny via samba wrote: > On Wed, 30 Aug 2023 18:56:48 +0200 > Peter Milesson via samba <samba at lists.samba.org> wrote: > >> >> On 30.08.2023 16:21, Rowland Penny via samba wrote: >>> On Wed, 30 Aug 2023 12:40:08 +0200 >>> Peter Milesson via samba <samba at lists.samba.org> wrote: >>> >>>> On

John, What I've done so far is mostly a hack. I've implemented some custom VBS scripts at login to install software (that only works part of the time because my method for granting the users admin priviledges is a UI based VBS hack which types the password in for them from an encrypted VBS script) and I've yet to implement any Windows policies as I've not been motivated enough to

Hi, After making progress with my scripts for software installation (thanks, Rowland!) I am on a bit of a mission to get things working again. I found that permissions on my sysvol share were somehow incorrect (group ownership was root, etc.) so I ran 'samba-tool ntacl sysvolreset'.. however this now fails with the following error. (I'm on Samba 4.5.0) user at dc2:~ $ sudo

> You could try using a script Louis wrote, see here: > https://github.com/thctlo/samba4/blob/master/samba-check-set-sysvol.sh > > The 'idmap config' lines are nothing to worry about, you cannot set them on a DC, but, for some reason, testparm etc warns about > them. > > Rowland > Sorry, I should have said - I ran louis' script and set the acl's according