[Samba] strange gpo behaviour

[Ray Klassen]

-- 3 samba 4.10.2 DC's, binaries compiled from tarballs on Debian stretch
-- 2 DC's are on the same (main office) LAN, one is at another location 
vpn'ed to the main office

-- randomly windows 10 pc's will not be able to complete a gpupdate 
(repeated tries) with no consistency as to solutions. Sometimes the pc's 
can't connect to the \\dc\sysvol\local.somedomain.com
-- we've tried (and thought we had it)
	-- samba-tool ntacl sysvolreset
	-- synchronizing time (again) between servers, and between servers and pc's
	-- rebooting pc's

sometimes any of these measures seem to suddenly work and then not.

any pointers?

Ray