[Samba] Different LDAP query in different DC...

[Rowland Penny]

On Thu, 29 Nov 2018 11:51:17 +0100
Marco Gaiarin via samba <samba at lists.samba.org> wrote:

> > If it works locally, then something is getting in the way.
> > If it doesn't work locally, then there is something wrong with AD on
> > that computer.
> 
> Arnaud, in private email, suggest to check the sddl of that specific
> object.

First, I wish people wouldn't send private emails when replying to a
thread, it breaks the flow, but as I cannot make people reply on list,
I suppose I will have to put up wiyj it.

> 
> But how can i check that?
> 

You need to explicitly ask for it, for instance:

 ldbsearch -H /var/lib/samba/private/sam.ldb -b
 'dc=samdom,dc=example,dc=com' -s sub '(samaccountname=rowland)'
 nTSecurityDescriptor

Rowland