similar to: Continued Group Policy issues

Hi, We have been consistently having issues with GPO and they are not consistent. We are using version 4.6.3 with BIND DNS Backend. As suggested in some of our previous communications, when we run the samba-tool ntacl sysvolcheck it results in the error as detailed below. [root at dc1 ~]# samba-tool ntacl sysvolcheck lp_load_ex: refreshing parameters Initialising global parameters rlimit_max:

Hello Rowland, Thanks for your quick response. We are syncing only sysvol from first Domain Controller, but not idmap.ldb. Do we need to sync idmap.ldb as well? -- Thanks & Regards, Anantha Raghava Do not print this e-mail unless required. Save Paper & trees. On 12/07/18 6:20 PM, Rowland Penny via samba wrote: > On Thu, 12 Jul 2018 18:13:47 +0530 > Anantha Raghava via samba

Hi, We just upgraded the Samba-AD from version 4.6.5 to 4.7.5. The upgrade threw many challenges and I will write a separate mail explaining the workaround that we adapted to get over them. One of the main challenges is GPO. While the user policy applies properly, the computer policies are not getting applied, rather they are erratic, On some PCs within the same LAN, it works, while on some,

Hi, On Mon, 16 Jul 2018 17:37:21 +0530 > Anantha Raghava via samba <samba at lists.samba.org> wrote: > >> Hi, >> >> Thanks for clarification. >> >> However, we held back from implementing your suggestion and observed >> that after about 40 odd hours from the initial publishing of the >> policies, all clients connecting to any of the Domain

Hi, On two of our 4 Domain Controller Servers, the Group Policy Objects have developed some issues. Windows are reporting that Group Policy objects cannot be read. Any recommendation to reset the Group Policy Objects. We are taking daily backup using Samba_Backup script. In the past, there was a recommendation not use "samba-tool ntacl sysvolreset". Can we use it now. By the way

Hi, > On Fri, 20 Jul 2018 06:52:06 +0530 > Anantha Raghava via samba <samba at lists.samba.org> wrote: > >> Hi, >> >> On Mon, 16 Jul 2018 17:37:21 +0530 >>> Anantha Raghava via samba <samba at lists.samba.org> wrote: >>> >>>> Hi, >>>> >>>> Thanks for clarification. >>>> >>>>

HI, We have done something similar using inotify. On the DC1. we watch the "/usr/local/samba/var/locks/sysvol" folder and if there is any change, (add, modify or delete), we run "samba-tool ntacl sysvolreset" and we push those changes to other DCs using rsync. We have created a shell script that is put in rc.local so that this starts even if the server reboots. We chose

Hello Marc, > Hi Anantha, > > Am 06.07.2017 um 10:02 schrieb Anantha Raghava via samba: >> Is there any way we can rebuild corrupt Default Domain Policy and >> Default Domain Controller Policy. > What is broken? Entire Default Domain and Default Domain Controller Policies along with other Polices that we had built are broken. >> In windows AD we can use dcgpofix

Hi, Is there any way we can rebuild corrupt Default Domain Policy and Default Domain Controller Policy. In windows AD we can use dcgpofix utility to recreate the Default Domain and Domain Controller Policies. Something similar available in Samba AD DC? -- Thanks & Regards, Anantha Raghava Do not print this e-mail unless required. Save Paper & trees.

Hi, Thanks for clarification. However, we held back from implementing your suggestion and observed that after about 40 odd hours from the initial publishing of the policies, all clients connecting to any of the Domain Controllers started to get the policies. No client was throwing any error while applying the policies from any of the 4 Domain Controllers. Does it mean that

On Fri, 27 Apr 2018 22:40:41 +0100 Jonathan Hunter via samba <samba at lists.samba.org> wrote: > OK - some more detail I have found in the meantime. > > I have compiled & ran listxattr, and I can now see a difference > between a working and a broken file: > > me at dc2:~/download $ > sudo ./listxattr /usr/local/samba/var/locks/sysvol/ >

Hello James, Thanks for your suggestion. When we had two servers in the pool, we were pushing GPO using rsync from PDC at every 30 minutes. However when we added the two more domain controllers, our rsync script turned to be a pull from PDC every 30 minutes. Would this have made those policy objects inconsistent? We have set up sysvol replication using rsync unidirectional that is a push

Hello Andrew & Louis, Yesterday by around 1:30 PM we had the same issue. Samba AD kicked all of us out and RSAT did not connect to any domain controllers. /*Incidentally the RSAT that caused this error was running on Windows 7 Professional 64 Bit edition.*/ When I restarted the samba-ad-dc service, all started working well again. However, as mentioned again, I could not trace the error

Hi, But, all user/groups should have the same ids on all DCs right? That's what we had thought all these days? Suppose we sync the idmap.ldb along with sysvol, will it not call for restart of Samba-ad-dc service every time the changes to GPs are made? -- Thanks & Regards, Anantha Raghava Do not print this e-mail unless required. Save Paper & trees. On 12/07/18 6:42 PM,

Hi, We are using Samba AD 4.6.3 and built it from source on CentOS 7. The DNS back end is BIND 9.9.4 Initially all replications were working fine and all group policies were getting applied. All of a sudden, we are finding that GPO applying process is erratic. Sometime it applies and sometimes not. We have edited the Default Policy using Windows RAST tool. Thinking that ACLs on

On 6/22/2017 9:41 AM, Anantha Raghava via samba wrote: > Hi, > > No solutions to get out of this? > Not sure exactly what your issue is but based on your error Samba is reporting the following on that particular Policy; * Lost Allow Object and Container inheritance on each ACE. * Create Owner missing ACE and you have Built in Administrators with an ACE * You have the

Now, its getting more detailed for the samba devs and more out of my scope.   But a small last question from me. Are you moving OU's with users and are there GPO's liked to these OU's? If yes, detach the GPO link and try moving without GPO's attached.   Still errors? Are these users logged in or not? If still logged in, try an OU without users logged in.     I also did read

Hai, Im joining this one if you dont mind. My setup: Debian 8 (Jessie) ADDC's : samba 4.6.6 Member with profiles : samba 4.6.6 This problem is here seen also on a Windows7 Pro 64bit client. The client here, is related to the user profile, this one is having a corrupted user profile in my case. Due to this, my GPO fails and i see event id: 4098 , error code : 0x8007000E insufficions

Hello Andrew, A gentle reminder for the patch. Can you share the patch as you mentioned? -- Thanks & Regards, Anantha Raghava Do not print this e-mail unless required. Save Paper & trees. On 29/10/17 11:57 AM, Andrew Bartlett wrote: > On Sun, 2017-10-29 at 09:11 +0530, Anantha Raghava wrote: >> Hi, >> >> I did upgrade the server to Windows Server 2008 R2

Hello Marc, Upgrade DNS worked properly as you can see below. --------- samba_upgradedns --dns-backend=BIND9_DLZ Reading domain information DNS accounts already exist No zone file /usr/local/samba/private/dns/EXZA.LOCAL.zone # is this the culprit? DNS records will be automatically created DNS partitions already exist dns-dc account already exists See