[Samba] samba linux gpo

Peter Carlson peter at howudodat.com
Fri Oct 21 18:10:10 UTC 2022

On 10/21/22 09:10, David Mulder via samba wrote:
> On 10/21/22 10:03 AM, Peter Carlson via samba wrote:
>> Here is some preliminary testing with samba linux gpo.
>> *Password and Security:*
>> Computer Configuration > Policies > OS Settings > Security Settings > 
>> Account Policy
>> OS Settings doesn't exist
>> *GNOME:*
>> I cant find any gnome settings in RSAT
> You have to install the templates using the command `samba-tool gpo 
> admxload --admx-dir=/location/of/templates` and specify the location 
> of the GNOME Settings admx templates. See the samba source in 
> libgpo/admx. You can also install the chrome and firefox templates to 
> administer these:
> https://github.com/mozilla/policy-templates/releases
> https://dl.google.com/dl/edgedl/chrome/policy/policy_templates.zip

ok I did samba-tool gpo admxload to load the default samba template, 
Gnome wasn't there, so I copied the files down from github (gnome and 
samba).  and did: samba-tool gpo admxload -U Administrator 
--admx-dir=./admx, this loaded the new samba.admx (firewalld appeared) 
but doesn't appear to have loaded GNOME Settings.admx

root at nc1:~# tree admx
├── EN-US
│   ├── GNOME Settings.adml
│   └── samba.adml
├── GNOME Settings.admx
└── samba.admx

1 directory, 4 files

looking in sysvol shows it got copied:
root at nc1:~# ls -l 
-rwxrwx---+ 1 3000000 users 7748 Oct 21 18:00 

Still no GNOME or OS Settings in RSAT

root at nc1:/var/lib/samba/sysvol/sa***nt.local/Policies/PolicyDefinitions# 
grep "Account Policy" *.admx
returns no files

Also, is removing definitions as simple as deleting the admx file and 
associated adml files from sysvol?

> Did you run `samba-gpupdate --force` after unlinking the policy? Don't 
> run `samba-gpupdate --force` with --rsop. RSoP is for displaying 
> policy, not applying it.
> Also, worst case you can run `samba-gpupdate --unapply` to forcefully 
> remove stuck policies.
ok, I ran just samba-gpudate --force and then ran  samba-gpudate --rsop 
and it is working correctly.  That might warrant a conflicting 
parameters error, or perhaps handle --force (update) first and then 
process --rsop

More information about the samba mailing list