[Samba] Replication of permissions on AD Directory not automatic
acrow at integrafin.co.uk
Wed Nov 16 14:17:24 UTC 2016
I've been testing Samba 4.5.1 extensively as an AD DC. We have 3 DC set
up, and replication of users, groups, OUs, DNS etc has been working fine.
However we wanted to add some custom attributes and a class to the
schema (an assortment of string and numericalString) for our own
purposes. This also worked fine (and the Schema replication worked), but
some oddness happened when we wanted to restrict access to one of these
The class was added to the "user" AD class as an auxiliary, and then the
following procedure was used:
To add anonymous access to the Public Information, Phone and Mail, and
our additional attributes (excepting the restricted one). Then a deny
ACL for "Everyone" and "Anonymous Logon" was added recursively for the
restricted attribute at the root of the domain tree on descendent User
This seemed to work on the server that ADSI edit was connected to when
tested with ldapsearch, but *not* on the other two DCs. They behaved as
if no ACLs had been changed. When I connected ADSI edit to the other DCs
I could see that the ACLs seemed to be present at the domain root, but
were not propagating down the tree even though the inherit box was
checked on subordinates.
I had to do:
samba-tool drs replicate s4-dc-01 s4-dc-02 DC=my,DC=ifa,DC=net --full-sync
(where s4-dc-02 was the "working" DC) and all seemed to be fixed, both
using ldapsearch and ADSI Edit.
Is it a known issue that ACLs aren't completely replicated? Or is it
that "custom" attributes cause problems with ACLs (even though they are
applied as auxiliary to the "user" AD class.
Otherwise everything is working 100% correctly (showrepl gives no errors).
This message is intended only for the addressee and may contain
confidential information. Unless you are that person, you may not
disclose its contents or use it in any way and are requested to delete
the message along with any attachments and notify us immediately.
This email is not intended to, nor should it be taken to, constitute advice.
The information provided is correct to our knowledge & belief and must not
be used as a substitute for obtaining tax, regulatory, investment, legal or
any other appropriate advice.
"Transact" is operated by Integrated Financial Arrangements Ltd.
29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608 5300.
(Registered office: as above; Registered in England and Wales under
number: 3727592). Authorised and regulated by the Financial Conduct
Authority (entered on the Financial Services Register; no. 190856).
More information about the samba