[Samba] Domain Admin can't create GPO

[basti]

I have setup an samba 4 AD DC.
The Domain Administrator SAMDOM\Administrator can't create GPO (access
denied).
SAMDOM\Administrator is member of Domain Admins group.

I have try
samba-tool ntacl sysvolreset
samba-tool dbcheck --cross-ncs --reset-well-known-acls --fix
samba-tool dbcheck --cross-ncs --fix

without success.