[Samba] Sysvol permission issue - how to repair permanently?

[Rowland penny]

On 06/04/2021 15:44, L.P.H. van Belle via samba wrote:
> Hai Rowland,
>
> Yes, im aware of that.
>
> Only, i use "BAG" not "DAG"
>
> Both are correct, just because DAG is member of BAG, no setup is the same.
>
> It's a good attempt for the sysvolcheck fix but its not 100%..
> And yes, just, since i know it, i just dont run sysvolchecks normaly.. ;-)
> but i also dont have problems with my policies, all applies as needed where needed.


Yes, I understand, but it is the reason why sysvolreset and sysvolcheck 
do not work for you.

>
> now looking at that below.
>> O:BAG:DUD  << thats the wrong won. DUD "Domain Users" .. ?
> rights are not correct, as simple as that.
>
> Should be
> O:LAG:DAD .. OR O:BAG:DAD
>
> so, im asuming this was en "user" with elevated rights that runned GPMC
> and created the policies, or a user which was added to "domain admins" which is a big NO NO..


Yes, from my understanding 'DU' shouldn't be there, but I will get back 
to you on that.

Rowland