similar to: samba-tool ntacl sysvol check errors (samba 4.7.4 AD DC)

To answer my own question: I solved it (I think). There were 2 causes basically: 1) I had messed up idmap.ldb on DC's (one with PDC FSMO was fine, the other two had more-or-less wrong mappings). I simply: created hot backup of idmap.ldb on DC1, stopped samba on other dc's, and overwritten idmap.ldb there. the above solved issue of GPO not being accessed 2) sysvolcheck was a bit

Samba 4.4.2 I was doing some maintenance work and I noticed that sysvolcheck gave some error. I ran "samba-tool ntacl sysvolreset". Running sysvolcheck again still gives errors. I tried with several sysvol backups and the result is always the same. The affected policies are always "Default Domain Policy" and "Default Domain Controllers Policy". These policies

The principle was not made any changes to occur this problem. We infra have dc3 and dc4 ADDC. root at dc3:/etc/samba# samba -V Version 4.7.7-Debian (van-blle apt) Result of gpupdate /force in a joined computer client: C:\>gpupdate /force > Updating Policy... > User policy could not be updated successfully. The following errors were > encountered: > The processing of Group Policy

That's not a problem its just a ACL provisioning message as you can see the result was "DAG:DAD:PAI" but expected was "O:DAG:DAD:PAR" that's "normal" ;-) just ignore it or do a "samba-tool ntacl sysvolreset" Am 19.10.23 um 17:27 schrieb bd730c5053df9efb via samba: > Hi! > > I executed the command "samba-tool ntacl sysvolcheck"

Hi! I executed the command "samba-tool ntacl sysvolcheck" on a DC and I got the following I pasted below. The first DC was provisioned migrating from a samba NT4 PDC with an LDAP backend using the classic upgrade procedure. I haven't detected any problem but I wanted to make sure there isn't any problem I might not be seeing yet. ERROR(<class

Can anyone explain what is happening when I run / usr / local / samba / bin / samba-tool ntacl sysvolcheck it and an error? ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO file /usr/local/samba/var/locks/sysvol/tdsfs01.net/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/USER/Scripts/scripts.ini

Hi everyone. I ran into notorios gpo error on windows clients. When I go to my dc controller and run samba-tool ntacl sysvolcheck I get an error: ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO directory /usr/local/samba/var/locks/sysvol/tsnr.mtt/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}

On Sun, Oct 25, 2020 at 4:02 PM Rowland penny via samba <samba at lists.samba.org> wrote: > What do you mean by 'working domain' and 'non-working domain' ? > Do you have two domains ? Different sites, different companies, not related. The working one was also a classic upgrade but earlier on, pre 4.6.x. Just using it to compare. > I am also trying to understand why

On Sun, Oct 25, 2020 at 3:31 PM Rowland penny via samba <samba at lists.samba.org> wrote: > OK, if you look at the end of the permissions, there is a '+' sign, this > shows that extended acls set, to see these: > > getfacl /usr/local/samba/var/locks/sysvol The difference in acls is that the non-working domain includes: user:3000001:r-x user:3000002:rwx user:3000003:r-x

On my small, one DC AD setup, where I just followed the wiki and did not (!) make any other changes except for working on the AD through the RSAT, I ran samba-tool ntacl sysvolcheck and got the following output: --------------------snip-------------------- ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO directory

Dear All, I've recently upgrade from samba 4.1.x to samba 4.2.14 and found that GPO are having issue Specifically when I'm adding new using they *never *got the gpupdate success fully. When I run samba-tool ntacl sysvolcheck or samba-tool ntacl sysvolreset But don't seem to got it fix.. Any suggestion? Thank in advance. #samba-tool ntacl sysvolcheck Processing section

> You could try using a script Louis wrote, see here: > https://github.com/thctlo/samba4/blob/master/samba-check-set-sysvol.sh > > The 'idmap config' lines are nothing to worry about, you cannot set them on a DC, but, for some reason, testparm etc warns about > them. > > Rowland > Sorry, I should have said - I ran louis' script and set the acl's according

Hi all, We'er running a classicupgraded samba4 AD 4.1.6 sernet for a month or two now, and all is very well. :-) It has been classicupgraded using the same 4.1.6. Today I wanted to try GPO's and they are not applied. GPUpdate /force tells me: "Windows attempted to read the file blahblah\gpt.ini from a domain controller and was not successful". Taken from the mailinglist, I

Hello, this is a Samba AD Domain upgraded from Samba 3.x with classicupgrade. Debian 9.4 Samba: 4.7.6 (packages from tranquil.it) # cat /etc/samba/smb.conf [global] netbios name = DC1 realm = IWW.LAN server role = active directory domain controller workgroup = IWW idmap_ldb:use rfc2307 = yes dns forwarder = 172.16.1.12 dsdb:schema update

On 25/10/2020 20:20, Sonic wrote: > On Sun, Oct 25, 2020 at 4:02 PM Rowland penny via samba > <samba at lists.samba.org> wrote: >> What do you mean by 'working domain' and 'non-working domain' ? >> Do you have two domains ? > Different sites, different companies, not related. The working one was > also a classic upgrade but earlier on, pre 4.6.x. Just

> root at graz-dc-1b:~# samba --version > Version 4.5.8-Debian > root at graz-dc-1b:~# samba-tool ntacl sysvolreset && echo "no error" > no error > root at graz-dc-1b:~# samba-tool ntacl sysvolcheck > ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO directory

On 2017-08-24 12:27, Rowland Penny via samba wrote: > On Thu, 24 Aug 2017 12:03:42 +0200 > Sven Schwedas via samba <samba at lists.samba.org> wrote: > >>> root at graz-dc-1b:~# samba --version >>> Version 4.5.8-Debian >>> root at graz-dc-1b:~# samba-tool ntacl sysvolreset && echo "no error" >>> no error >>> root at

Hello all, I have recently discovered that my user cannot edit GPO's anymore. Every GPO I try to open, gets me the famous window "*The permissions for this GPO in the SYSVOL folder are inconsistent with those in Active Directory" * and then I get another window saying "Access is denied". I believe that this happened when I upgraded to 4.1.7 from 4.1.3, about 3 weeks ago,

I have upgraded Samba from a NT PDC to an AD DC about a week ago. Everything went pretty well until today. I've already configured about 25 GPO's (through RSAT on a Windows 10 machine) - but when I came to add more GPO's - it wouldn't let me with the above error message. My specs are: Samba 4.5.0 Slackware -current 64bit Kernel 4.4.20 The client machine is a Windows 10 Pro.

Dear, I'm having trouble handling GPO's my DC. Environment: Samba 4.4.5, primary and secondary DC. I am not allowed to edit the GPO's. The problem occurred after I edit the Default GPO in the primary DC, and then run the rsync to synchronize between the DC's. The following errors arise when squeegee commands: Note: I hid the actual domain name. # samba-tool gpo aclcheck