[Samba] Win Clients and DNS

Mon Nov 16 12:48:24 UTC 2015

See replies below

On 16.11.2015 12:39, Rowland Penny wrote:
> On 16/11/15 11:19, Viktor Trojanovic wrote:
>> So I ran a samba-tool ntacl sysvolcheck, and the following error 
>> message came up:
>>
>> --------------------snip--------------------
>> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught 
>> exception - ProvisioningError: DB ACL on GPO directory 
>> /var/lib/samba/sysvol/samdom.com/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Scripts/Startup 
>> O:BAG:DUD:(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;;0x001f01ff;;;BA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) 
>> does not match expected value 
>> O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) 
>> from GPO object
>>   File "/usr/lib/python2.7/site-packages/samba/netcmd/__init__.py", 
>> line 175, in _run
>>     return self.run(*args, **kwargs)
>>   File "/usr/lib/python2.7/site-packages/samba/netcmd/ntacl.py", line 
>> 249, in run
>>     lp)
>>   File 
>> "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", line 
>> 1733, in checksysvolacl
>>     direct_db_access)
>>   File 
>> "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", line 
>> 1684, in check_gpos_acl
>>     domainsid, direct_db_access)
>>   File 
>> "/usr/lib/python2.7/site-packages/samba/provision/__init__.py", line 
>> 1650, in check_dir_acl
>>     raise ProvisioningError('%s ACL on GPO directory %s %s does not 
>> match expected value %s from GPO object' % 
>> (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl, acl))
>> --------------------snip--------------------
>>
>> The GPO directory in question is the Default Domain Policy.
>>
>> Any idea what happened here? I never touched the DDD, it's still on 
>> version 0, and I never did any changes to those files either. I 
>> manually checked the ACL, without having made a diff on it, it looks 
>> pretty much the same like the ACL on the other containers.
>>
>> Is it safe to run sysvolreset?
>>
>> Viktor
>>
>> On 16.11.2015 09:34, L.P.H. van Belle wrote:
>>> I guest,
>>>
>>> incorrect rights on you sysvol,
>>> Try : samba-tool ntacl sysvolreset
>>> And check the share rights.
>>>
>>> By default this should work out of the box.
>>> Did you change the sysvol rights?
>>>
>>>
>>> Greetz,
>>>
>>> Louis
>>>
>>>
>>>> -----Oorspronkelijk bericht-----
>>>> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Ole Traupe
>>>> Verzonden: maandag 16 november 2015 9:25
>>>> Aan: samba at lists.samba.org
>>>> Onderwerp: Re: [Samba] Win Clients and DNS
>>>>
>>>> Viktor, can you manually check whether you have DNS records for 
>>>> your Win
>>>> clients?
>>>>
>>>> In the DNS settings for your Win clients' network adapters you can
>>>> uncheck that the current address shall be registered in DNS.
>>>>
>>>> Ole
>>>>
>>>>
>>>> Am 16.11.2015 um 01:31 schrieb Viktor Trojanovic:
>>>>> I have an AD with 1 Samba DC and 5 Windows 10 clients. The DC and the
>>>>> clients all have a fixed IPv4 address.
>>>>>
>>>>> In the windows event viewer, I constantly see the following warning:
>>>>>
>>>>> Event 8019, DNS Client Events
>>>>> ------------------------------------------
>>>>> The system failed to register host (A or AAA) resource records (RRs)
>>>>> for network adapter with settings:
>>>>>
>>>>> Adapter Name: {someGUID}
>>>>> Host Name: Client-PC
>>>>> Primary Domain Suffix: SAMDOM.COM
>>>>> DNS Server list:
>>>>>      192.168.0.1
>>>>> Sent update to server: <?>
>>>>> IP Addresses:
>>>>>     192.168.0.15
>>>>> ------------------------------------------
>>>>>
>>>>> Is it necessary to manually make some entries in DNS for the client
>>>>> machines? I didn't see anything about that in the Wiki.
>>>>>
>>>>> I'm trying to figure out if this is connected to another problem I'm
>>>>> facing. A machine based GPO is not executed because "the file
>>>>> \\SAMDOM.COM\SysVol\[...]\gpt.ini from a domain controller could not
>>>>> be read", and as one of the possible reasons for the error, name
>>>>> resolution is mentioned. I can access the file just fine once I'm
>>>>> logged in so I really don't know what the issue is here.
>>>>>
>>>>> Thanks,
>>>>> Viktor
>>>>>
>>>>
>>>> -- 
>>>> To unsubscribe from this list go to the following URL and read the
>>>> instructions:  https://lists.samba.org/mailman/options/samba
>>>
>>>
>>
>>
>
> Firstly, have you changed anything on the DC after provision? I don't 
> mean adding users or groups, but anything else?
>
> I think if you examine what samba-tool thinks is different, you will 
> find that it is only these:
>
> O:BAG:DUD and O:DAG:DAD
>
> To turn these into English :-)
>
> O = owner
> BA = BUILTIN\Administrators
> G = group
> DU = Domain Users
> DA = Domain Administrators
>
> BA becoming DA is fairly common and I don't think is relevant
> But somehow DA has become DU
>
Yes, those are the ACL's I see, BA is the owner, DA has full rights, DU 
can read.

> That is why I asked if you have changed anything.
>
No, I haven't. Please also check my new thread about the ACL issue.

> Now as for do your computers A and PTR records need to be added to AD, 
> try this on the DC:
>
> ping -c1 member1
>
> where 'member1' is the hostname of one of your workstations, it should 
> return something like this:
>
> PING member1.samdom.example.com (192.168.0.2) 56(84) bytes of data.
> 64 bytes from 192.168.0.2: icmp_seq=1 ttl=64 time=0.261 ms
>
>
>
This is making things even more confusing.. if I enter the DNS records, 
then the command nslookup clientname will provide the correct IP 
address. Ping doesn't work for half of the clients but it doesn't work 
even using the IP address. Seems like the firewall is blocking it which 
is again really weird because I didn't make any changes and all clients 
are exactly the same.