similar to: GPO - Computer Policies are not applied

Hi root at dc1:~ # samba-tool dbcheck --cross-ncs --reset-well-known-acls --fix --yes ...some error information... Checked 3647 objects (2 errors) root at dc1:~ # samba-tool dbcheck --cross-ncs --reset-well-known-acls --fix Checking 3647 objects Checked 3647 objects (0 errors) root at dc1:~ # getfacl /usr/local/samba/var/locks/sysvol/ getfacl: Removing leading '/' from absolute path

OK, there is a discussion over on samba-technical about nss_winbind and the question about Administrator being mapped to 0 was raised. Now I have always thought that it should, but in fairness, I decided to see what happens when it isn't, so I removed Administrator from idmap.ldb and restarted samba. Before restarting samba, I checked a few things, on the DC, getfacl returned this for

On 20/02/15 21:27, Davor Vusir wrote: > > Rowland Penny skrev den 2015-02-19 18:15: >> OK, there is a discussion over on samba-technical about nss_winbind >> and the question about Administrator being mapped to 0 was raised. >> Now I have always thought that it should, but in fairness, I decided >> to see what happens when it isn't, so I removed Administrator

Thank you both, Rowland and Louis. I'll try to answer you both and give you more info about our domain. Generally: In the past, we have Samba 3.5 NT4 domain on SLES server (designed ages before, never upgraded). In 2015 I finally decided to migrate to Samba 4 AD. In those day it was 4.2. samba-tool ntacl sysvolcheck was ok, no errors. AD worked (and working) as expected. This summer, I

Hai, Ok, i expected a bit different outputs. On my DC, i use /home/samba/sysvol and /home/samba/netlogon. This is what i expected. getfacl /home/samba/ getfacl: Removing leading '/' from absolute path names # file: home/samba/ # owner: root # group: BUILTIN\134administrators user::rwx user:root:rwx group::rwx group:BUILTIN\134administrators:rwx

cool! root at dc1:~ # wbinfo -r richard.h 10001 3000008 10000 10014 10004 10005 3000005 3000009 3000000 -----Original Message----- From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of lingpanda101 via samba Sent: 12 January 2017 22:57 To: samba at lists.samba.org Subject: Re: [Samba] Samba 4.5.3 AD DC - issues with sysvol when setting up Group Policies On 1/12/2017 3:47 PM,

On 22/06/16 13:44, lingpanda101 at gmail.com wrote: > On 6/22/2016 8:19 AM, L.P.H. van Belle wrote: >> And dont forget : >> https://wiki.samba.org/index.php/Idmap_config_ad >> >> I also noticed and incorrect mapping, which "looks" like rights >> issues like in the thead here. ( it is imo not a right issue.. ) read >> on.. >> >>

On Thu, 14 Jun 2018 09:39:46 +0200 "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote: > And i did read the Comment to for Rowland below, > On debian you need : > libnss-winbind libpam-winbind to be installed. > I think you miss one of these. They are the glue that connects Samba to nsswitch and allows 'getent passwd username' to work. Without

Hai, I suggest, start reading here, it explains all. https://lists.samba.org/archive/samba/2018-February/213690.html The script in that thread is not changing anything by default. I suggest try it and post the output. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens > Rowland Penny via samba > Verzonden:

Hello Luis tomorrow i'm not in office, reply to you thursday One question : who is owner and whats rights for dir     /home     /home/samba     /home/samba/sysvol because, from windows client, user into domain admins, when i change in security tab, explorer always crash bye Il 06/11/2018 17:16, L.P.H. van Belle via samba ha scritto: > Ok, next, > > From a windows pc connect to

And dont forget : https://wiki.samba.org/index.php/Idmap_config_ad I also noticed and incorrect mapping, which "looks" like rights issues like in the thead here. ( it is imo not a right issue.. ) read on.. NTDOMAIN\enterprise read-only domain controllers:x:3000202: NTDOMAIN\domain admins:x:10001:NTDOMAIN\administrator NTDOMAIN\domain users:x:10000: NTDOMAIN\domain guests:x:10002:

Hi here are the commands in the order I ran them: root at dc1:~ # systemctl stop samba root at dc1:~ # net cache flush root at dc1:~ # samba-tool ntacl sysvolreset root at dc1:~ # net cache flush root at dc1:~ # samba-tool ntacl sysvolcheck root at dc1:~ # systemctl start samba root at dc1:~ # smbclient //localhost/sysvol -UAdministrator -c 'ls' Enter Administrator's password:

Hello Rowland, Thanks for your quick response. We are syncing only sysvol from first Domain Controller, but not idmap.ldb. Do we need to sync idmap.ldb as well? -- Thanks & Regards, Anantha Raghava Do not print this e-mail unless required. Save Paper & trees. On 12/07/18 6:20 PM, Rowland Penny via samba wrote: > On Thu, 12 Jul 2018 18:13:47 +0530 > Anantha Raghava via samba

On 03/07/15 15:18, Ryan Ashley wrote: > The only Unix client I can think of would be the Buffalo NAS. It runs > Samba3 and hosts various shares via SMB. DNS is handled by BIND9 on the > Samba4 DC. DNS does work and the domain name resolves to the IP address > of the server. DHCP is also handled on the DC. As for the GPO's, they're > in the correct place as far as I can tell.

On 02/07/15 16:55, Ryan Ashley wrote: > Rowland, here is what I found in the ldb. > > # record 68 > dn: CN=S-1-5-32-544 > cn: S-1-5-32-544 > objectClass: sidMap > objectSid: S-1-5-32-544 > type: ID_TYPE_BOTH > xidNumber: 3000000 > distinguishedName: CN=S-1-5-32-544 > > # record 70 > dn: CN=S-1-5-32-549 > cn: S-1-5-32-549 > objectClass: sidMap >

Also, I'm not sure whether this has any relevance to the problem but I did at one point try to set up a secondary AD server but was struggling to get it going so demoted it using "Demote an Offline Domain Controller" from this page https://wiki.samba.org/index.php/Demote_a_Samba_AD_DC I also went through the "Verifying the Demotion" checks on this page and all looked

> On 29.09.2017 11:44 Rowland Penny wrote: > Have you set up the libnss_winbind links, PAM and /etc/nsswitch.conf ? Yes, I had modified two lines in /etc/nsswitch.conf: passwd: files winbind group: files winbind No, I had not seen a pointer to libnss, but now did ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib/i386-linux-gnu/ ln -s

On 03/07/15 15:58, Ryan Ashley wrote: > They left a PC on, so I got the info. The info pissed me off, but not > because of the issue. This time it worked flawlessly, but I got the > error from the event log from prior attempts. First, today's results. > > C:\Users\reachfp.KIGM>gpupdate > Updating Policy... > > User Policy update has completed successfully. >

On 01/12/14 17:46, steve wrote: > On 01/12/14 18:25, Rowland Penny wrote: >> On 01/12/14 17:16, steve wrote: >>> On 01/12/14 18:11, Rowland Penny wrote: >>>> On 01/12/14 17:09, steve wrote: >>>>> On 01/12/14 17:31, Greg Zartman wrote: >>>>>> On Mon, Dec 1, 2014 at 1:33 AM, Rowland Penny >>>>>> <rowlandpenny at

Imo, this is a left over of an old bug, just remove the file Registry.po imo, i'll bet its never used. The computer looks for Registry.pol not Registry.po. > -rwxrwx--- 1 root users 958 2014-09-13 04:01 Registry.po* > -rwxrwx--- 1 3000000 users 958 2014-09-13 04:01 Registry.pol* Look at the date 2014, and i do remember something about this. But... What does getfacl say about