[Samba] The security ID structure is invalid, while changing delegation of a GPO

[Luis Peromarta]

Hi,

I’m running Samba 4.21.1 on Debian Bookworm and encountering a problem with GPO management.

When I create a new, initially empty GPO and modify the delegation settings to deny “Apply policy” for the Domain Admins group, the GPO management console in Windows crashes immediately.

After reopening the console, selecting the newly created GPO results in the error:
“The specified server cannot perform the requested operation.”

Additionally, clicking on “Delegation” again triggers another error:
“The security ID structure is invalid.”

I have reproduced the issue in 2 different ADs (both 4.21.1)

Has anyone experienced this issue, or can provide guidance on how to resolve it?

Thanks!