[Samba] Samba 4.2.14 GPO issue

[Min Wai Chan]

Hello Sébastien Le Ray,

The PC reply the following...

The processing of Group Policy failed. Windows could not resolve the user
name. This could be caused by one or more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another
domain controller has not replicated to the current domain controller).

The processing of Group Policy failed. Windows could not resolve the
computer name. This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another
domain controller has not replicated to the current domain controller).

To diagnose the failure, review the event log or run GPRESULT /H
GPReport.html from
the command line to access information about Group Policy results.

On Sun, Jul 24, 2016 at 3:56 PM, Sébastien Le Ray <sebastien-samba at orniz.org
> wrote:

> Hi,
>
> Do you have any specific error message in Windows events log concerning
> GPO?
>
> Regards
>
>
> Le 24/07/2016 à 05:40, Min Wai Chan a écrit :
>
>> Dear All,
>> I've recently upgrade from samba 4.1.x to samba 4.2.14 and found that GPO
>> are having issue
>>
>> Specifically when I'm adding new using they *never *got the gpupdate
>>
>> success fully.
>>
>> When I run samba-tool ntacl sysvolcheck or samba-tool ntacl sysvolreset
>>
>> But don't seem to got it fix..
>>
>> Any suggestion?
>>
>> Thank in advance.
>>
>> #samba-tool ntacl sysvolcheck
>> Processing section "[netlogon]"
>> Processing section "[sysvol]"
>> Processing section "[dfs]"
>> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception -
>> ProvisioningError: DB ACL on GPO directory /var/lib/samba/sysvol/
>> kl01.amtb-m.org.my/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}
>> <http://kl01.amtb-m.org.my/Policies/%7B6AC1786C-016F-11D2-945F-00C04FB984F9%7D>
>>
>> O:LAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)
>> does not match expected value
>>
>> O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)
>> from GPO object
>>    File "/usr/lib64/python2.7/site-packages/samba/netcmd/__init__.py",
>> line
>> 175, in _run
>>      return self.run(*args, **kwargs)
>>    File "/usr/lib64/python2.7/site-packages/samba/netcmd/ntacl.py", line
>> 249, in run
>>      lp)
>>    File "/usr/lib64/python2.7/site-packages/samba/provision/__init__.py",
>> line 1730, in checksysvolacl
>>      direct_db_access)
>>    File "/usr/lib64/python2.7/site-packages/samba/provision/__init__.py",
>> line 1681, in check_gpos_acl
>>      domainsid, direct_db_access)
>>    File "/usr/lib64/python2.7/site-packages/samba/provision/__init__.py",
>> line 1628, in check_dir_acl
>>      raise ProvisioningError('%s ACL on GPO directory %s %s does not match
>> expected value %s from GPO object' % (acl_type(direct_db_access), path,
>> fsacl_sddl, acl))
>>
>> Regards,
>> Min Wai
>>
>
>