[Samba] GPMC error 0x80070005 when saving "User Configuration > Preferences > Folders"

[Elias Pereira]

I upgraded to Samba 4.23.x and it fixed the problem.

On Tue, Nov 4, 2025 at 10:29 AM Nicolas Martinussen <
nicolas.martinussen at joskin.com> wrote:

> Hello,
>
> There is probably a better way, but what I do when I have this issue is
> that I do a chmod -R 777 on the policy folder (/var/lib/samba/sysvol/
> campus.sertao.ifrs.edu.br/Policies/{301F7BDC-2E40-4E97-BD1D-BCB90E5D3DB0}
> <http://campus.sertao.ifrs.edu.br/Policies/%7B301F7BDC-2E40-4E97-BD1D-BCB90E5D3DB0%7D>
> in your case). Then, I do my change. And after that, I do a samba-tool
> ntacl sysvolreset to restore the permissions correctly.
>
> Nicolas
>
> > hello,
> >
> > I am having a problem with Group Policy Management on my Samba AD DC.
> >
> > *My Environment:*
> >
> >    -
> >
> >    *Samba Version:* Version 4.22.6-Debian-4.22.6+dfsg-0~~mjt+deb12
> >    -
> >
> >    *OS:* Debian 12
> >
> > *My Goal:* I am trying to create a simple GPO (User Configuration >
> Preferences > Folders) to create a new folder for users at
> %UserProfile%\DevRuns\bin.
> >
> > *The Problem:* When I am in the Group Policy Management Editor and try
> to save this new "Folders" setting, I get an "Access Denied" error. The
> exact message is: Error (0x80070005) occurred saving settings file. Access
> is denied.
> >
> > *Troubleshooting Steps I Have Taken:*
> >
> > I assumed it was a SYSVOL permissions issue, so I ran the following
> commands on my Debian server:
> >
> >    1.
> >
> >    First, I ran samba-tool ntacl sysvolcheck. It failed and reported a
> >    mismatch:
> >
> >    ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
> > exception - ProvisioningError: DB ACL on GPO directory
> > /var/lib/samba/sysvol/
> campus.sertao.ifrs.edu.br/Policies/{301F7BDC-2E40-4E97-BD1D-BCB90E5D3DB0}/User/Preferences/Folders
> <http://campus.sertao.ifrs.edu.br/Policies/%7B301F7BDC-2E40-4E97-BD1D-BCB90E5D3DB0%7D/User/Preferences/Folders>
> >
> O:BAG:DAD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;;;AU)(A;OICI;0x1200a9;;;ED)
> > does not match expected value
> >
> O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;OICI;0x1200a9;;;ED)
> > from GPO object
> >    ...
> >
> >    2.
> >
> >    Next, I ran samba-tool ntacl sysvolreset to fix the permissions.
> >    3.
> >
> >    I ran samba-tool ntacl sysvolcheck again, and it completed with no
> >    errors. The permissions seemed to be fixed.
> >    4.
> >
> >    I went back to Windows and tried to save the GPO setting again. It
> >    failed with the *exact same error: 0x80070005*.
> >    5.
> >
> >    After the failed save, I ran samba-tool ntacl sysvolcheck one more
> time,
> >    and it reported the same ACL mismatch error as in step 1.
> >
> > It seems that sysvolreset works, but the moment I try to save the GPO
> from
> > Windows, the save operation fails and breaks the ACLs again.
> >
> > Has anyone seen this behavior? Is this a configuration I am missing?
> >
> > Thank you for your help.
> > --
> > Elias Pereira
> > --



-- 
Elias Pereira