[Samba] Continued Group Policy issues

[Rowland Penny]

On Fri, 20 Jul 2018 15:22:31 +0530
Anantha Raghava via samba <samba at lists.samba.org> wrote:

> Just to clarify, nscd or similar daemons are not running in our 
> environment. We use CentOS 7.5 minimal installation.
> Coming to using only "net cache flush", we will test it in our 
> environment and report back here.

This is strange, you shouldn't have to run 'net cache flush', you
didn't have to do this before, so it sounds like this could be what
Andrew calls a 'regression' and what I call a bug ;-)

> Find the sample script below. We add other DCs as needed to the same 
> script. To include, "net cache flush", we will have to modify this 
> script that runs on first DC or (DC1 or PDC ;-)
> 
> #!/bin/sh
> DIR="/usr/local/samba/var/locks/sysvol/test.com/Policies/"
> inotifywait -m -r -e moved_to -e modify -e delete -e create "$DIR" | 
> while read f
> do
>      echo $f
>      if [[ $f = *.* ]]; then
> {
> export PATH=/usr/local/samba/bin:/usr/local/samba/sbin:$PATH
> samba-tool ntacl sysvolreset &> /dev/null
> sleep 5
> rsync -XAavz --delete-after /usr/local/samba/var/locks/sysvol/ 
> dc1:/usr/local/samba/var/locks/sysvol
> 
>   }
>   fi
> done

Mine is a bit longer than that, it is over 100 lines of code and it
still isn't finished, but it is using the same basic format.

> I understand, there is no such thing as PDC. Server is just named
> that way as it handles PDC Emulator role. :-)
> 

I sort of thought that was the reason, but it can cause confusion. Some
person posts 'I am having problems with my PDC' without specifying what
it is, an actual PDC or a DC called 'PDC', for this reason, we suggest
not using 'PDC' as a DC name.

Rowland