[Samba] Permission denied on GPT.ini (Event ID 1058)

[Ryan Ashley]

Sorry it has been a while, but error 87I was not near the client in
question for an extended period. I have now been by and spent a day, and
somewhat fixed the issue. How? I turned off the second DC. After
gpupdate couldn't talk to DC02, it tried DC01 and updated. It fixed
every little issue on the entire domain.

Now for the nitty-gritty. I tried using psexec as described in the
previous post and it succeeded, so both machine accounts AND user
accounts can open and read the gpt.ini file, despite the error being
logged. This is with both DCs on, before I shut the second one down.

I have a script on a cron job which runs once every 15min. It copies
over the sysvol from the primary DC and then does a sysvolreset to reset
the permissions per the second controller's IDs. I only edit group
policy on the main DC for this reason. Perhaps this is where my issue
lies? Maybe we just need DFS support or NTFRS between DCs. Either way my
suspicion is that despite the sysvolreset, something isn't right. What
are your thoughts? I am currently running on only the primary DC.

Lead IT/IS Specialist
Reach Technology FP, Inc

On 04/21/2016 11:13 AM, mj wrote:
> Hi,
> 
> How to test access with a machine account:
> 
> * Install psexec from
> http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx
> * open a cmd.cmd as administrator
> * type:
>   psexec -i -s cmd.exe
> * In the new cmd (running as the computer account) type:
> 
> echo %username%
> 
> Now check if you can access the gpo folders.
> 
> Perhaps this way you can check / verify if machine accounts actually
> access the required files.
> 
> MJ
>