[Samba] Problem sysvolreset

[Rowland Penny]

On Mon, 20 Mar 2017 16:36:34 +0100
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:

> Im questioning this because of the following. 
> 
> What is "Domain Admins" doing with rights on SYSVOL anyway.. ??
> 
> There should not be any "domain admins" at all on sysvol share and
> security rights. 

If you create a GPO on a 2102R2 DC, you get this on the GUID dir:

"O:DAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)"

O = owner
G = group
DA = Domain Admins

Rowland