[Samba] Sysvol permission issue - how to repair permanently?

[Stefan Bellon]

On Sat, 03 Apr, Rowland penny via samba wrote:

> What version of Windows are you using ?

This is Windows Server 2016 Standard 1607.

> If you look closely at the above , you will see that it is expected
> that the ownership will be ' O:DAG:DA', but you have 'O:BAG:DU'
> 
> 'O' = owner
> 
> 'G' = group
> 
> 'DA' = Domain Admins'
> 
> 'BA' = BUILTIN\Administrators
> 
> 'DU' = Domain Users
> 
> I seem to remember that you have given Domain Admins a gidNumber,
> this will stop the group owning anything.

I think this is a misunderstanding. I did not give the "Domain Admins"
group a gidNumber. One of the users who is in the group "Domain Admins"
has a gidNumber (but 50, not 100). For the tests here, I used another
user from the "Domain Admins" group who does not have a gidNumber
attribute.

> > ID '100' Has SID 'S-1-5-21-37643267-2172530850-1818422998-1118'
> > with the name 'DS\developers 2'  
> 
> This is interesting, '100' is the Unix ID for the 'users' group and
> is usually mapped to Domain Users in idmap.ldb, I take it you created 
> 'developers', but did you give it a gidNumber attribute ?

Yes, "developers" is a group in our AD which happens to have gidNumber
100, however I don't understand why this is appearing here. The user
(of group "Domain Admins") that I used to perform the change in the
Test Group Policy is not a member of group "developers".

> > I really don't understand what I am seeing there.  
> 
> Fairly simple, the 'ID' is the Unix ID, the SID, is well the objects 
> domain SID , finally the 'name' is the objects name.

Yes, sorry, what I meant is not that I don't understand UIDs, SIDs and
cleartext names, but that I don't understand how and why the
"developers" (gidNumber 100) are appearing here.

> > What do I have to change in my setup in order to be able to edit
> > GPOs from Windows RSAT without breaking permissions on the Sysvol
> > share?  
> 
> Not sure, because I don't know how you got in this position in the
> first place, have you got any notes on how you installed the DC's, if
> so, send me a copy and I will see if there is something wrong.

Basically, I *really* followed the setup procedure explained here:
https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory

I however have not set up the original Samba 4.2 server which initially
provisioned the domain and to which I joined.

After I joined the domain with the new Samba 4.13.5 instances, I backed
up the idmap.db on the Samba 4.2 and copied it over to the two new DCs
("tdbbackup -s .bak /var/lib/samba/private/idmap.ldb").

Also, I rsync'ed the /var/lib/samba/sysvol from the old 4.2 instance to
the two new ones ("rsync -XAavz --delete-after").

But actually, I could completely wipe the sysvol folder and setup it
from scratch with the proper permissions without too much effort. I
just don't see any guide anywhere of how to start the sysvol folder
from scratch (and especially what to look out for, not to end up in the
same situation again).

Greetings,
Stefan

-- 
Stefan Bellon