[Samba] Access Denied when creating a GPO with any other domain admins than administrator

[Antoine Vacher]

Hello,

I have a strange issue with Samba 4 as an AD DC regarding GPO creation.

I use the following packages on Debian wheezy:

dpkg -l | grep samba
ii  libsamba-credentials0:i386           4.0.0+dfsg1-1                i386         Samba Credentials management library
ii  libsamba-hostconfig0:i386            4.0.0+dfsg1-1                i386         Samba host configuration library
ii  libsamba-policy0:i386                4.0.0+dfsg1-1                i386         Samba policy management
ii  libsamba-util0:i386                  4.0.0+dfsg1-1                i386         Samba utility function library
ii  python-samba                         4.0.0+dfsg1-1                i386         Python bindings for Samba
rc  samba                                2:3.6.6-3                    i386         SMB/CIFS file, print, and login server for Unix
ii  samba-common                         2:3.6.10-1                   all          common files used by both the Samba server and client
ii  samba-common-bin                     2:3.6.10-1                   i386         common files used by both the Samba server and client
ii  samba-dsdb-modules                   4.0.0+dfsg1-1                i386         Samba Directory Services Database
ii  samba4                               4.0.0+dfsg1-1                i386         SMB/CIFS file, NT domain and active directory server (version 4)
ii  samba4-clients                       4.0.0+dfsg1-1                i386         client utilities from Samba 4
ii  samba4-common-bin                    4.0.0+dfsg1-1                i386         Samba 4 common files used by both the server and the client

I created an administrative account called "admin-domain" which is member of the following groups:
- Administrators
- Domain Admins
- Domain Users
- Group Policy Creator Owners

If I logon with the "administrator" account, then there is no problem to create a new GPO with the group policy management application from the windows 8 client.
However, if I logon with the "admin-domain" account, is is not possible to create a GPO. The error given is "Access Denied"

I checked and there is no problem for "admin-domain" to write in the sysvol share.
For me being member of Domain Admins and writing to sysvol rights shall be enough to write a GPO.

Apart from that, the GPO are correctly applied and I see no other issue.

I am sure missing something, but I can't figure out what... 

Thanks for your help.

Antoine