[Samba] samba linux gpo

[Peter Carlson]

On 10/21/22 09:10, David Mulder via samba wrote:
>
> On 10/21/22 10:03 AM, Peter Carlson via samba wrote:
>> Here is some preliminary testing with samba linux gpo.
>>
>> *Password and Security:*
>> Computer Configuration > Policies > OS Settings > Security Settings > 
>> Account Policy
>> OS Settings doesn't exist
>>
>> *GNOME:*
>> I cant find any gnome settings in RSAT
>
> You have to install the templates using the command `samba-tool gpo 
> admxload --admx-dir=/location/of/templates` and specify the location 
> of the GNOME Settings admx templates. See the samba source in 
> libgpo/admx. You can also install the chrome and firefox templates to 
> administer these:
>
> https://github.com/mozilla/policy-templates/releases
> https://dl.google.com/dl/edgedl/chrome/policy/policy_templates.zip

ok I did samba-tool gpo admxload to load the default samba template, 
Gnome wasn't there, so I copied the files down from github (gnome and 
samba).  and did: samba-tool gpo admxload -U Administrator 
--admx-dir=./admx, this loaded the new samba.admx (firewalld appeared) 
but doesn't appear to have loaded GNOME Settings.admx

root at nc1:~# tree admx
admx
├── EN-US
│   ├── GNOME Settings.adml
│   └── samba.adml
├── GNOME Settings.admx
└── samba.admx

1 directory, 4 files

looking in sysvol shows it got copied:
root at nc1:~# ls -l 
/var/lib/samba/sysvol/sa***nt.local/Policies/PolicyDefinitions/GNOME\ 
Settings.admx
-rwxrwx---+ 1 3000000 users 7748 Oct 21 18:00 
'/var/lib/samba/sysvol/sa***nt.local/Policies/PolicyDefinitions/GNOME 
Settings.admx'

Still no GNOME or OS Settings in RSAT

root at nc1:/var/lib/samba/sysvol/sa***nt.local/Policies/PolicyDefinitions# 
grep "Account Policy" *.admx
returns no files

Also, is removing definitions as simple as deleting the admx file and 
associated adml files from sysvol?

>
> Did you run `samba-gpupdate --force` after unlinking the policy? Don't 
> run `samba-gpupdate --force` with --rsop. RSoP is for displaying 
> policy, not applying it.
>
> Also, worst case you can run `samba-gpupdate --unapply` to forcefully 
> remove stuck policies.
>
ok, I ran just samba-gpudate --force and then ran  samba-gpudate --rsop 
and it is working correctly.  That might warrant a conflicting 
parameters error, or perhaps handle --force (update) first and then 
process --rsop