[Samba] GPO Editor says "Access denied" for Group Policy Objects

[Rowland Penny]

On Thu, 25 Apr 2024 16:55:55 +0200
Jakob Curdes via samba <samba at lists.samba.org> wrote:

> .. we setup 2 new DCs replacing older DCs and joined them to the
> domain, then decommissioned the old DCs. I now discover that I cannot
> edit the GPO objects anymore.
> "sysvolcheck" shows no errors. I read through some documentation but
> it sounds outdated to me. Any hints where I would start looking? Who
> should normally be the owner of the sysvol directory itself?
> 
> What I find strange is that on a domain member, getent group shows me 
> all Domain groups, while on the DC these are not shown.
> But that might be totally unrelated.
> 
> Any hints?
> 

Without more info, Anything would be guess work, but a guess in the
dark would be to ask if you are using rfc2307 attributes and if so,
does Domain Admins have a gidNumber attribute ?

Rowland