[Samba] GPO Editor says "Access denied" for Group Policy Objects

[Jakob Curdes]

.. we setup 2 new DCs replacing older DCs and joined them to the domain, 
then decommissioned the old DCs. I now discover that I cannot edit the 
GPO objects anymore.
"sysvolcheck" shows no errors. I read through some documentation but it 
sounds outdated to me. Any hints where I would start looking? Who should 
normally be the owner of the sysvol directory itself?

What I find strange is that on a domain member, getent group shows me 
all Domain groups, while on the DC these are not shown.
But that might be totally unrelated.

Any hints?

Thank you and best regards, Jakob Curdes