From peter.alexander99 at gmail.com Tue Sep 1 16:28:25 2026 From: peter.alexander99 at gmail.com (Peter) Date: Tue, 1 Sep 2026 09:28:25 -0700 Subject: [Samba] Recent MS patch for W11 causing workstation login issues w/ Samba DCs? Message-ID: Hi! I have a bit of an odd issue and was wondering if anyone else had experienced this so far. Advice for logging settings would also be appreciated to try and figure out what is causing this issue. We have ~40 domain joined computers with Win11 24H2 (up to date on Windows Updates), but a handful of them started having interactive login issues after receiving KB5120998. Removing this patch resolves the issue, and reinstalling it causes the issue again. All computers have line of sight to the DC's, no firewalls (hardware or software) between the PCs and DCs. Pinging, DNS all works (and DNS servers are the DCs, and I am able to query all the AD related SRV records), clock is synced to DCs and verified w/ w32tm, nltest works, etc when the issue is happening. Oddly enough, I am still able to connect to an affected computer's C$ share when the issue is happening, even though the same credentials used can't login at the login screen nor via RDP. I don't see any errors in the samba logs with anything matching the computer name, IP address or user names involved. In some cases, I even see successful authentication entries on the DCs for a user account on an affected computer, for a corresponding rejected login at the computer login screen. All of our Samba DCs have the following logging settings: logging = file log file = /var/log/samba/log.%m log level = 1 \ full_audit:1@/var/log/samba/audit.log \ auth:5@/var/log/samba/auth.log \ auth_audit:5@/var/log/samba/auth_audit.log \ kerberos:3@/var/log/samba/kerberos.log full_audit:prefix = IP=%I - PROTO=%R - USER=%D\%u - MACHINE=%m - VOLUME=%S full_audit:success = connect opendir disconnect unlink mkdir rmdir open rename full_audit:failure = none The DCs are running Ubuntu 22.04LTS, fully updated, with their official Samba 4 package (4.15.13). These versions are set in concrete and can't change, although a test environment w/ newer Samba version could be done to see if the issue is reproducible under those circumstances. Peter From rpenny at samba.org Tue Sep 1 17:04:50 2026 From: rpenny at samba.org (Rowland Penny) Date: Tue, 1 Sep 2026 18:04:50 +0100 Subject: [Samba] Recent MS patch for W11 causing workstation login issues w/ Samba DCs? In-Reply-To: References: Message-ID: <20260901180450.77d407c3@debstation.samdom.example.com> On Tue, 1 Sep 2026 09:28:25 -0700 Peter via samba wrote: > Hi! I have a bit of an odd issue and was wondering if anyone else had > experienced this so far. Advice for logging settings would also be > appreciated to try and figure out what is causing this issue. > > We have ~40 domain joined computers with Win11 24H2 (up to date on > Windows Updates), but a handful of them started having interactive > login issues after receiving KB5120998. Removing this patch resolves > the issue, and reinstalling it causes the issue again. > > All computers have line of sight to the DC's, no firewalls (hardware > or software) between the PCs and DCs. Pinging, DNS all works (and DNS > servers are the DCs, and I am able to query all the AD related SRV > records), clock is synced to DCs and verified w/ w32tm, nltest works, > etc when the issue is happening. Oddly enough, I am still able to > connect to an affected computer's C$ share when the issue is > happening, even though the same credentials used can't login at the > login screen nor via RDP. I don't see any errors in the samba logs > with anything matching the computer name, IP address or user names > involved. In some cases, I even see successful authentication entries > on the DCs for a user account on an affected computer, for a > corresponding rejected login at the computer login screen. > > All of our Samba DCs have the following logging settings: > > logging = file > log file = /var/log/samba/log.%m > log level = 1 \ > full_audit:1@/var/log/samba/audit.log \ > auth:5@/var/log/samba/auth.log \ > auth_audit:5@/var/log/samba/auth_audit.log \ > kerberos:3@/var/log/samba/kerberos.log > full_audit:prefix = IP=%I - PROTO=%R - USER=%D\%u - > MACHINE=%m - VOLUME=%S > full_audit:success = connect opendir disconnect unlink mkdir > rmdir open rename > full_audit:failure = none > I wonder if you should be looking on the affected clients ? > The DCs are running Ubuntu 22.04LTS, fully updated, with their > official Samba 4 package (4.15.13). These versions are set in > concrete and can't change, That might be a problem, as I understand it, KB5120998 was released a few days ago, so if Samba requires fixing (it may be a Windows problem and they fix it), then any possible fixes will go into the latest version of Samba and may be backported to 4.23.x and if lucky to 4.22.x. Because you are running 4.15.3 you will have to rely on Ubuntu backporting such a fix. > although a test environment w/ newer > Samba version could be done to see if the issue is reproducible under > those circumstances. I would try with Debian 13 and Samba from backports, that will get you latest version of Samba, 4.24.5 at present. Rowland From peter.alexander99 at gmail.com Tue Sep 1 18:56:46 2026 From: peter.alexander99 at gmail.com (Peter) Date: Tue, 1 Sep 2026 11:56:46 -0700 Subject: [Samba] Recent MS patch for W11 causing workstation login issues w/ Samba DCs? In-Reply-To: <20260901180450.77d407c3@debstation.samdom.example.com> References: <20260901180450.77d407c3@debstation.samdom.example.com> Message-ID: Thanks Roland. I have looked on the clients but have not found any obvious clues. Event Viewer reports a bad user name or password under the Event Viewer "Security" logs. No errors or warnings under Applications or System. As I mentioned before, I've done all the normal tests for generic AD client checks and tests I could think of. I was mainly hoping to see if anyone else had a similar experience, as I went through a similar situation a few years ago with KB5028166, however, that affected all of our workstations instantly, rather than just a handful, and I have not been able to identify any relevant differences between the computers "broken" by KB5120998 and those running fine with this update. They're all the same brand and model of computer, same specs, same OS installation process, same AD OU and GPOs, and mostly the same end-user software. Unfortunately, the server OS distribution and version is not a variable on which I have any wiggle room, but I may be able to get an exception for using the upstream build/repo version of Samba if it can run or be compiled against our "non-negotiable-set-in-concrete" versions of openssl, gnu tls, etc until Ubuntu 24.04 gets approved/certified. I may have to set up a test DC and network to test this if the issue becomes more widespread. In the meantime, I am testing and setting up tooling to enable more verbose logging on affected workstations, as I expect this patch will eventually be rolled up into other superseding patches. Peter On Tue, Sep 1, 2026 at 10:05?AM Rowland Penny via samba < samba at lists.samba.org> wrote: > On Tue, 1 Sep 2026 09:28:25 -0700 > Peter via samba wrote: > > > Hi! I have a bit of an odd issue and was wondering if anyone else had > > experienced this so far. Advice for logging settings would also be > > appreciated to try and figure out what is causing this issue. > > > > We have ~40 domain joined computers with Win11 24H2 (up to date on > > Windows Updates), but a handful of them started having interactive > > login issues after receiving KB5120998. Removing this patch resolves > > the issue, and reinstalling it causes the issue again. > > > > All computers have line of sight to the DC's, no firewalls (hardware > > or software) between the PCs and DCs. Pinging, DNS all works (and DNS > > servers are the DCs, and I am able to query all the AD related SRV > > records), clock is synced to DCs and verified w/ w32tm, nltest works, > > etc when the issue is happening. Oddly enough, I am still able to > > connect to an affected computer's C$ share when the issue is > > happening, even though the same credentials used can't login at the > > login screen nor via RDP. I don't see any errors in the samba logs > > with anything matching the computer name, IP address or user names > > involved. In some cases, I even see successful authentication entries > > on the DCs for a user account on an affected computer, for a > > corresponding rejected login at the computer login screen. > > > > All of our Samba DCs have the following logging settings: > > > > logging = file > > log file = /var/log/samba/log.%m > > log level = 1 \ > > full_audit:1@/var/log/samba/audit.log \ > > auth:5@/var/log/samba/auth.log \ > > auth_audit:5@/var/log/samba/auth_audit.log \ > > kerberos:3@/var/log/samba/kerberos.log > > full_audit:prefix = IP=%I - PROTO=%R - USER=%D\%u - > > MACHINE=%m - VOLUME=%S > > full_audit:success = connect opendir disconnect unlink mkdir > > rmdir open rename > > full_audit:failure = none > > > > I wonder if you should be looking on the affected clients ? > > > The DCs are running Ubuntu 22.04LTS, fully updated, with their > > official Samba 4 package (4.15.13). These versions are set in > > concrete and can't change, > > That might be a problem, as I understand it, KB5120998 was released a > few days ago, so if Samba requires fixing (it may be a Windows > problem and they fix it), then any possible fixes will go into the > latest version of Samba and may be backported to 4.23.x and if lucky to > 4.22.x. Because you are running 4.15.3 you will have to rely on Ubuntu > backporting such a fix. > > > although a test environment w/ newer > > Samba version could be done to see if the issue is reproducible under > > those circumstances. > > I would try with Debian 13 and Samba from backports, that will get you > latest version of Samba, 4.24.5 at present. > > Rowland > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba > From bjacke at samba.org Tue Sep 1 22:01:03 2026 From: bjacke at samba.org (=?UTF-8?Q?Bj=C3=B6rn_Jacke?=) Date: Wed, 2 Sep 2026 00:01:03 +0200 Subject: [Samba] [Announce] Samba 4.23.12 Available for Download Message-ID: Release Announcements --------------------- This is the latest stable release of the Samba 4.23 release series. Changes since 4.23.11 --------------------- o Ralph Boehme * BUG 15978: leases torture test flappy (marked flappy) o Volker Lendecke * BUG 16225: dns client problems related to EDNS usage o Andr?as Leroux * BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP when packet is larger than 4k o Stefan Metzmacher * BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP when packet is larger than 4k * BUG 16077: witness test flappy needs to be fixed * BUG 16194: autobuild failures need to be reported in a more verbose way * BUG 16199: ndr_{push,pull,print}_{timeval,timespec} encode/decode the value twice * BUG 16223: DNS scavenging happens even if fAging is FALSE * BUG 16226: samba-tool dns zoneoptions $DC_SERVER_IP _msdcs.addom.samba.example.com -P --aging=1 gives WERR_INTERNAL_DB_ERROR o Noel Power * BUG 15957: Double free of glue object and core in pthreadpool_tevent_register_ev * BUG 15958: pthreadpool_tevent has race conditions accessing both pthreadpool_tevent.jobs list and pthreadpool_tevent.glue_list o Noel Power * BUG 15958: pthreadpool_tevent has race conditions accessing both pthreadpool_tevent.jobs list and pthreadpool_tevent.glue_list o Anoop C S * BUG 16188: Build failure with cmocka >= 2.0: cm_print_error() conflicts with cmocka.h macro o Andreas Schneider * BUG 16144: Incorrect behavior on stream create-disposition when prior handle is closed * BUG 16188: Build failure with cmocka >= 2.0: cm_print_error() conflicts with cmocka.h macro o Martin Schwenke * BUG 16082: An inactive node can run recovery resulting in inconsistent databases o Shachar Sharon * BUG 16225: dns client problems related to EDNS usage o Jennifer Sutton * BUG 16225: dns client problems related to EDNS usage ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical:matrix.org matrix room, or #samba-technical IRC channel on irc.libera.chat. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ================ Download Details ================ The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from: https://download.samba.org/pub/samba/stable/ The release notes are available online at: https://www.samba.org/samba/history/samba-4.23.12.html Our Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/) --Enjoy The Samba Team -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature.asc Type: application/pgp-signature Size: 236 bytes Desc: OpenPGP digital signature URL: From bjacke at samba.org Sun Sep 6 15:40:10 2026 From: bjacke at samba.org (=?UTF-8?Q?Bj=C3=B6rn_Jacke?=) Date: Sun, 6 Sep 2026 17:40:10 +0200 Subject: [Samba] [Announce] Samba 4.25.0rc2 Available for Download Message-ID: <2a252337-2cbe-49ee-8043-e914f46882a1@samba.org> Release Announcements ===================== This is the second release candidate of Samba 4.25. This is *not* intended for production environments and is designed for testing purposes only. Please report any defects via the Samba bug reporting system at https://bugzilla.samba.org/. Samba 4.25 will be the next version of the Samba suite. UPGRADING ========= NEW FEATURES/CHANGES ==================== SMB3 Persistent Handles (Experimental) -------------------------------------- Samba now includes experimental support for SMB3 Persistent Handles, a fundamental building block for Transparent Failover. Persistent Handles allow SMB clients to reconnect after a server restart or outage while retaining valid file handles. Samba persists all necessary handle state to durable on-disk storage so that open files can be reconstructed when clients reconnect. This enables applications that depend on uninterrupted file access, such as virtual machine storage and clustered database workloads, to tolerate temporary server failures without having to reopen files. Persistent Handles are advertised through the SMB3 protocol capability SMB2_CAP_PERSISTENT_HANDLES. To make use of them on a share, both the global "smb3 persistent handles" option and the per-share "continuous availability" option must be enabled. Because Persistent Handles require Samba to maintain SMB state, they are only available on shares configured for SMB-exclusive access. Specifically, they require: kernel oplocks = no kernel share modes = no posix locking = no These settings disable interoperability with local POSIX file access and NFS clients on the affected share. Administrators should be aware that Persistent Handles incur a significant performance cost. File handle metadata is synchronously persisted to durable storage for every open, update, lease, and close operation, increasing latency compared to traditional SMB file serving. For this reason, the feature is intended only for workloads that require Continuous Availability semantics and is not recommended for general-purpose file servers. This feature is currently considered experimental. Cluster-wide rate limiting in vfs_aio_ratelimit ------------------------------------------------ The vfs_aio_ratelimit VFS module has been extended with cluster-wide coordination. When Samba clustering is enabled, the configured per-share rate limits are now enforced as a global ceiling across the entire cluster rather than per-node. Each share's limits are tracked and enforced independently. Coordination is handled by a new per-node daemon, ratelimitd, which aggregates activity from all smbd processes on the node and broadcasts node-level summaries to the rest of the cluster via Samba's messaging layer. To enable this feature, Samba must be built with --with-ratelimitd. JSON Audit logging ------------------ The two leading spaces before the opening '{' on JSON audit log lines have been removed. And any embedded new line characters '\n' are converted to spaces. Domain encryption types changed to AES by default ------------------------------------------------- The default value of the smb.conf option ?kdc default domain supported enctypes? now corresponds to ?aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96? (both AES encryption types) if the domain functional level is 2008 or higher. This addresses CVE-2026-20833. CTDB changes ------------ * CTDB's locations for locks, PID files and sockets now use ctdb/ subdirectories of the Samba locations configured at build time. This means that the relevant top-level Samba configure options (--with-lockdir, --with-piddir, --with-sockets-dir) are now also used by CTDB. The standalone CTDB build does not support these options. However, it is generally only used for developer/standalone testing. * The CTDB initscript (ctdb.init) has been moved to ctdb/doc/examples. This recognises that it isn't installed by default so it is basically unmaintained and untested. * Monitoring of (infrastructure) hosts is now supported. A good use of this is to monitor DNS servers. See the NETWORK MONITORING section in ctdb-script.options(5) for more details. * The detect_init_style() script function and associated CTDB_INIT_STYLE variable are deprecated, so will be removed in a future release. Use the new, more general CTDB_PLATFORM_STYLE variable instead. This may affect site-local CTDB (event) scripts. See ctdb.sysconfig(5) for more details. Cluster functional level ------------------------ Samba now maintains a cluster functional level, a cluster wide value that is kept as persistent global state and shared by all nodes. It is similar in spirit to the domain and forest functional levels known from Active Directory. The purpose of the functional level is to allow controlled upgrades of a cluster. New database formats, new internal messages and other changes that affect the communication between nodes are gated behind an explicit raise of the cluster functional level. As long as the level has not been raised, all nodes keep writing and sending the old formats, so that nodes running different Samba versions can interoperate during a rolling upgrade. A level consists of a major and a minor number, e.g. "1.0". Samba 4.25 implements the initial level 1.0, which is currently also the only defined level. On a non-clustered server the highest supported level is always activated automatically, there is nothing to configure or maintain. On a cluster the currently active level is stored persistently in cluster_level.tdb. On a fresh cluster it is initialized with the highest level supported by the second node that starts up. From then on the level never changes on its own, it is only raised when an administrator explicitly asks for it. A node that does not support the currently active level refuses to start, which keeps a node running an incompatible Samba version from joining the cluster. Once all nodes of a cluster have been upgraded to a new Samba version, the administrator can raise the cluster functional level. The new 'net clusterlevel' subcommands are available for this: net clusterlevel features List the cluster functional levels supported by the installed binaries. net clusterlevel show Show the currently active cluster functional level. net clusterlevel showall Show the levels supported by each node of the cluster, together with the currently active level and the highest level that could be activated. net clusterlevel upgrade [--test] [--apply] Raise the active cluster functional level to the highest level supported by all nodes. With --test (the default) only checks and reports whether the upgrade would be possible, --apply performs the actual upgrade. Note that raising the cluster functional level is a one way operation, there is no way to lower it again. It should only be done once all nodes have been upgraded and the new version has proven to work. The current implementation is deliberately strict: an upgrade is only possible if all nodes announce the exact same set of supported levels, which in practice means that all nodes run the same Samba version. Also note that this change only prepares for the future. It is not designed help with upgrades from older versions before 4.25 to 4.25 as a target. However vendors are free to use their own backports and use custom levels >= 0.1 and < 1.0. REMOVED FEATURES ================ smb.conf changes ================ Parameter Name Description Default -------------- ----------- ------- allow dcerpc auth level connect deprecated kdc default domain supported enctypes New default AES encryption types (if supported by domain) CHANGES SINCE 4.25.0rc1 ======================= o Stefan Metzmacher * BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP when packet is larger than 4k * BUG 16194: autobuild failures need to be reported in a more verbose way * BUG 16219: samba-cluster-support should depend on ndr-samba * BUG 16223: DNS scavenging happens even if fAging is FALSE * BUG 16226: samba-tool dns zoneoptions $DC_SERVER_IP _msdcs.addom.samba.example.com -P --aging=1 gives WERR_INTERNAL_DB_ERROR o Jennifer Sutton * BUG 16225: dns client problems related to EDNS usage KNOWN ISSUES ============ https://wiki.samba.org/index.php/Release_Planning_for_Samba_4.25#Release_blocking_bugs ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical:matrix.org matrix room, or #samba-technical IRC channel on irc.libera.chat If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ================ Download Details ================ The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from: https://download.samba.org/pub/samba/rc/ The release notes are available online at: https://download.samba.org/pub/samba/rc/samba-4.25.0rc2.WHATSNEW.txt Our Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/) --Enjoy The Samba Team -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature.asc Type: application/pgp-signature Size: 236 bytes Desc: OpenPGP digital signature URL: From giuseppe.arvati at gmail.com Tue Sep 8 12:36:51 2026 From: giuseppe.arvati at gmail.com (Giuseppe Arvati) Date: Tue, 8 Sep 2026 14:36:51 +0200 Subject: [Samba] after edit gpo with RSAT sysvol acls are invalid Message-ID: Hello, every time I try to edit gpo with RSAT tools the sysvol acl become invalid After gpo modification the Registry.pol owner and group become # owner: BUILTIN\\administrators # group: users # file: var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol # owner: BUILTIN\\administrators # group: users user::rwx user:NT\040Authority\\system:rwx user:NT\040Authority\\authenticated\040users:r-x user:APAM-AD\\domain\040admins:rwx user:APAM-AD\\enterprise\040admins:rwx user:NT\040Authority\\enterprise\040domain\040controllers:r-x group::--- group:users:--- group:BUILTIN\\administrators:rwx group:NT\040Authority\\system:rwx group:NT\040Authority\\authenticated\040users:r-x group:APAM-AD\\domain\040admins:rwx group:APAM-AD\\enterprise\040admins:rwx group:NT\040Authority\\enterprise\040domain\040controllers:r-x mask::rwx other::--- after sysvolreset the same file # owner: APAM-AD\\domain admins # group: APAM-AD\\domain admins # file: var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol # owner: APAM-AD\\domain\040admins # group: APAM-AD\\domain\040admins user::rwx user:NT\040Authority\\system:rwx user:NT\040Authority\\authenticated\040users:r-x user:APAM-AD\\enterprise\040admins:rwx user:NT\040Authority\\enterprise\040domain\040controllers:r-x group::rwx group:NT\040Authority\\system:rwx group:NT\040Authority\\authenticated\040users:r-x group:APAM-AD\\domain\040admins:rwx group:APAM-AD\\enterprise\040admins:rwx group:NT\040Authority\\enterprise\040domain\040controllers:r-x mask::rwx other::--- I use RSAT gpo editor logged with a user member of APAM-AD\\domain admins I have some problems to distribute gpo to clients ( sync time, .. ) and I think it cound dipend of some misconfiguration somewhere ( sysvol access right ? ) I saw same problem in older posts but without a clear solution Actual configuration is?1 DC and 2 DM as file server The DC was intalled at the and of 2025 with 4.23/deb12 and regularly updated every time Actual version is 4.24.5-Debian-4.24.5+dfsg-1~bpo13+1 Below my DC smb.conf # Global parameters [global] ? ? ? ? ad dc functional level = 2016 ? ? ? ? disable netbios = Yes ? ? ? ? disable spoolss = Yes ? ? ? ? dns forwarder = 10.1.1.5 ? ? ? ? load printers = No ? ? ? ? ntlm auth = mschapv2-and-ntlmv2-only ? ? ? ? passdb backend = samba_dsdb ? ? ? ? printcap name = /dev/null ? ? ? ? realm = APAM-AD.APAM.LAN ? ? ? ? restrict anonymous = 2 ? ? ? ? rpc server dynamic port range = 50000-55000 ? ? ? ? server role = active directory domain controller ? ? ? ? server smb transports = 445 ? ? ? ? usershare max shares = 100 ? ? ? ? workgroup = APAM-AD ? ? ? ? rpc_server:tcpip = no ? ? ? ? rpc_daemon:spoolssd = embedded ? ? ? ? rpc_server:spoolss = embedded ? ? ? ? rpc_server:winreg = embedded ? ? ? ? rpc_server:ntsvcs = embedded ? ? ? ? rpc_server:eventlog = embedded ? ? ? ? rpc_server:srvsvc = embedded ? ? ? ? rpc_server:svcctl = embedded ? ? ? ? rpc_server:default = external ? ? ? ? winbindd:use external pipes = true ? ? ? ? idmap_ldb:use rfc2307 = yes ? ? ? ? idmap config * : backend = tdb ? ? ? ? map archive = No ? ? ? ? printing = bsd ? ? ? ? vfs objects = dfs_samba4 acl_xattr [sysvol] ? ? ? ? path = /var/lib/samba/sysvol ? ? ? ? read only = No [netlogon] ? ? ? ? path = /var/lib/samba/sysvol/apam-ad.apam.lan/scripts ? ? ? ? read only = No Thank you for any advice Giuseppe From rpenny at samba.org Tue Sep 8 13:17:32 2026 From: rpenny at samba.org (Rowland Penny) Date: Tue, 8 Sep 2026 14:17:32 +0100 Subject: [Samba] after edit gpo with RSAT sysvol acls are invalid In-Reply-To: References: Message-ID: <20260908141732.436c3095@debstation.samdom.example.com> On Tue, 8 Sep 2026 14:36:51 +0200 Giuseppe Arvati via samba wrote: > Hello, > > every time I try to edit gpo with RSAT tools the sysvol acl become > invalid > > After gpo modification the Registry.pol owner and group become > > # owner: BUILTIN\\administrators > # group: users > > > # file: > var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol > # owner: BUILTIN\\administrators > # group: users > user::rwx > user:NT\040Authority\\system:rwx > user:NT\040Authority\\authenticated\040users:r-x > user:APAM-AD\\domain\040admins:rwx > user:APAM-AD\\enterprise\040admins:rwx > user:NT\040Authority\\enterprise\040domain\040controllers:r-x > group::--- > group:users:--- > group:BUILTIN\\administrators:rwx > group:NT\040Authority\\system:rwx > group:NT\040Authority\\authenticated\040users:r-x > group:APAM-AD\\domain\040admins:rwx > group:APAM-AD\\enterprise\040admins:rwx > group:NT\040Authority\\enterprise\040domain\040controllers:r-x > mask::rwx > other::--- > > after sysvolreset the same file > > # owner: APAM-AD\\domain admins > # group: APAM-AD\\domain admins > > # file: > var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol > # owner: APAM-AD\\domain\040admins > # group: APAM-AD\\domain\040admins > user::rwx > user:NT\040Authority\\system:rwx > user:NT\040Authority\\authenticated\040users:r-x > user:APAM-AD\\enterprise\040admins:rwx > user:NT\040Authority\\enterprise\040domain\040controllers:r-x > group::rwx > group:NT\040Authority\\system:rwx > group:NT\040Authority\\authenticated\040users:r-x > group:APAM-AD\\domain\040admins:rwx > group:APAM-AD\\enterprise\040admins:rwx > group:NT\040Authority\\enterprise\040domain\040controllers:r-x > mask::rwx > other::--- > > I use RSAT gpo editor logged with a user member of APAM-AD\\domain > admins > > I have some problems to distribute gpo to clients ( sync time, .. ) > and I think it cound dipend of some misconfiguration somewhere ( > sysvol access right ? ) > > I saw same problem in older posts but without a clear solution > > Actual configuration is?1 DC and 2 DM as file server > > The DC was intalled at the and of 2025 with 4.23/deb12 and regularly > updated every time > > Actual version is 4.24.5-Debian-4.24.5+dfsg-1~bpo13+1 > > Below my DC smb.conf No it isn't, it looks like the output of 'testparm' to me and you shouldn't run testparm on a Samba AD DC, you should run 'samba-tool testparm'. > > # Global parameters > [global] > ? ? ? ? ad dc functional level = 2016 > ? ? ? ? disable netbios = Yes > ? ? ? ? disable spoolss = Yes > ? ? ? ? dns forwarder = 10.1.1.5 > ? ? ? ? load printers = No > ? ? ? ? ntlm auth = mschapv2-and-ntlmv2-only > ? ? ? ? passdb backend = samba_dsdb > ? ? ? ? printcap name = /dev/null > ? ? ? ? realm = APAM-AD.APAM.LAN > ? ? ? ? restrict anonymous = 2 > ? ? ? ? rpc server dynamic port range = 50000-55000 > ? ? ? ? server role = active directory domain controller > ? ? ? ? server smb transports = 445 > ? ? ? ? usershare max shares = 100 > ? ? ? ? workgroup = APAM-AD > ? ? ? ? rpc_server:tcpip = no > ? ? ? ? rpc_daemon:spoolssd = embedded > ? ? ? ? rpc_server:spoolss = embedded > ? ? ? ? rpc_server:winreg = embedded > ? ? ? ? rpc_server:ntsvcs = embedded > ? ? ? ? rpc_server:eventlog = embedded > ? ? ? ? rpc_server:srvsvc = embedded > ? ? ? ? rpc_server:svcctl = embedded > ? ? ? ? rpc_server:default = external > ? ? ? ? winbindd:use external pipes = true > ? ? ? ? idmap_ldb:use rfc2307 = yes > ? ? ? ? idmap config * : backend = tdb > ? ? ? ? map archive = No > ? ? ? ? printing = bsd > ? ? ? ? vfs objects = dfs_samba4 acl_xattr > > [sysvol] > ? ? ? ? path = /var/lib/samba/sysvol > ? ? ? ? read only = No > > [netlogon] > ? ? ? ? path = /var/lib/samba/sysvol/apam-ad.apam.lan/scripts > ? ? ? ? read only = No > I notice you are using rfc2307 for idmap, have you given Domain Admins a gidNumber attribute ? Rowland From giuseppe.arvati at gmail.com Tue Sep 8 15:53:30 2026 From: giuseppe.arvati at gmail.com (Giuseppe Arvati) Date: Tue, 8 Sep 2026 17:53:30 +0200 Subject: [Samba] after edit gpo with RSAT sysvol acls are invalid In-Reply-To: <20260908141732.436c3095@debstation.samdom.example.com> References: <20260908141732.436c3095@debstation.samdom.example.com> Message-ID: <494dfd58-dc27-4944-9a1c-acb371975bac@gmail.com> Il 08/09/2026 15:17, Rowland Penny via samba ha scritto: > On Tue, 8 Sep 2026 14:36:51 +0200 > Giuseppe Arvati via samba wrote: > >> Hello, >> >> every time I try to edit gpo with RSAT tools the sysvol acl become >> invalid >> >> After gpo modification the Registry.pol owner and group become >> >> # owner: BUILTIN\\administrators >> # group: users >> >> >> # file: >> var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol >> # owner: BUILTIN\\administrators >> # group: users >> user::rwx >> user:NT\040Authority\\system:rwx >> user:NT\040Authority\\authenticated\040users:r-x >> user:APAM-AD\\domain\040admins:rwx >> user:APAM-AD\\enterprise\040admins:rwx >> user:NT\040Authority\\enterprise\040domain\040controllers:r-x >> group::--- >> group:users:--- >> group:BUILTIN\\administrators:rwx >> group:NT\040Authority\\system:rwx >> group:NT\040Authority\\authenticated\040users:r-x >> group:APAM-AD\\domain\040admins:rwx >> group:APAM-AD\\enterprise\040admins:rwx >> group:NT\040Authority\\enterprise\040domain\040controllers:r-x >> mask::rwx >> other::--- >> >> after sysvolreset the same file >> >> # owner: APAM-AD\\domain admins >> # group: APAM-AD\\domain admins >> >> # file: >> var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol >> # owner: APAM-AD\\domain\040admins >> # group: APAM-AD\\domain\040admins >> user::rwx >> user:NT\040Authority\\system:rwx >> user:NT\040Authority\\authenticated\040users:r-x >> user:APAM-AD\\enterprise\040admins:rwx >> user:NT\040Authority\\enterprise\040domain\040controllers:r-x >> group::rwx >> group:NT\040Authority\\system:rwx >> group:NT\040Authority\\authenticated\040users:r-x >> group:APAM-AD\\domain\040admins:rwx >> group:APAM-AD\\enterprise\040admins:rwx >> group:NT\040Authority\\enterprise\040domain\040controllers:r-x >> mask::rwx >> other::--- >> >> I use RSAT gpo editor logged with a user member of APAM-AD\\domain >> admins >> >> I have some problems to distribute gpo to clients ( sync time, .. ) >> and I think it cound dipend of some misconfiguration somewhere ( >> sysvol access right ? ) >> >> I saw same problem in older posts but without a clear solution >> >> Actual configuration is?1 DC and 2 DM as file server >> >> The DC was intalled at the and of 2025 with 4.23/deb12 and regularly >> updated every time >> >> Actual version is 4.24.5-Debian-4.24.5+dfsg-1~bpo13+1 >> >> Below my DC smb.conf > No it isn't, it looks like the output of 'testparm' to me and you > shouldn't run testparm on a Samba AD DC, you should run 'samba-tool > testparm'. >> # Global parameters >> [global] >> ? ? ? ? ad dc functional level = 2016 >> ? ? ? ? disable netbios = Yes >> ? ? ? ? disable spoolss = Yes >> ? ? ? ? dns forwarder = 10.1.1.5 >> ? ? ? ? load printers = No >> ? ? ? ? ntlm auth = mschapv2-and-ntlmv2-only >> ? ? ? ? passdb backend = samba_dsdb >> ? ? ? ? printcap name = /dev/null >> ? ? ? ? realm = APAM-AD.APAM.LAN >> ? ? ? ? restrict anonymous = 2 >> ? ? ? ? rpc server dynamic port range = 50000-55000 >> ? ? ? ? server role = active directory domain controller >> ? ? ? ? server smb transports = 445 >> ? ? ? ? usershare max shares = 100 >> ? ? ? ? workgroup = APAM-AD >> ? ? ? ? rpc_server:tcpip = no >> ? ? ? ? rpc_daemon:spoolssd = embedded >> ? ? ? ? rpc_server:spoolss = embedded >> ? ? ? ? rpc_server:winreg = embedded >> ? ? ? ? rpc_server:ntsvcs = embedded >> ? ? ? ? rpc_server:eventlog = embedded >> ? ? ? ? rpc_server:srvsvc = embedded >> ? ? ? ? rpc_server:svcctl = embedded >> ? ? ? ? rpc_server:default = external >> ? ? ? ? winbindd:use external pipes = true >> ? ? ? ? idmap_ldb:use rfc2307 = yes >> ? ? ? ? idmap config * : backend = tdb >> ? ? ? ? map archive = No >> ? ? ? ? printing = bsd >> ? ? ? ? vfs objects = dfs_samba4 acl_xattr >> >> [sysvol] >> ? ? ? ? path = /var/lib/samba/sysvol >> ? ? ? ? read only = No >> >> [netlogon] >> ? ? ? ? path = /var/lib/samba/sysvol/apam-ad.apam.lan/scripts >> ? ? ? ? read only = No >> root at dc2:~# samba-tool testparm INFO 2026-09-08 17:45:18,313 pid:75355 /usr/lib/python3/dist-packages/samba/netcmd/testparm.py #87: Loaded smb config files from /etc/samba/smb.conf INFO 2026-09-08 17:45:18,313 pid:75355 /usr/lib/python3/dist-packages/samba/netcmd/testparm.py #88: Loaded services file OK. # Global parameters [global] ? ? ? ? ad dc functional level = 2016 ? ? ? ? disable netbios = Yes ? ? ? ? disable spoolss = Yes ? ? ? ? dns forwarder = 10.1.1.5 ? ? ? ? netbios name = DC2 ? ? ? ? ntlm auth = mschapv2-and-ntlmv2-only ? ? ? ? printcap name = /dev/null ? ? ? ? realm = APAM-AD.APAM.LAN ? ? ? ? restrict anonymous = 2 ? ? ? ? rpc server dynamic port range = 50000-55000 ? ? ? ? server role = active directory domain controller ? ? ? ? server smb transports = 445 ? ? ? ? usershare max shares = 100 ? ? ? ? workgroup = APAM-AD ? ? ? ? idmap_ldb:use rfc2307 = yes [sysvol] ? ? ? ? path = /var/lib/samba/sysvol ? ? ? ? read only = No [netlogon] ? ? ? ? path = /var/lib/samba/sysvol/apam-ad.apam.lan/scripts ? ? ? ? read only = No > I notice you are using rfc2307 for idmap, have you given Domain Admins > a gidNumber attribute ? No Which check can I do to give you more useful informations ? thank you > > Rowland > From rpenny at samba.org Tue Sep 8 16:23:32 2026 From: rpenny at samba.org (Rowland Penny) Date: Tue, 8 Sep 2026 17:23:32 +0100 Subject: [Samba] after edit gpo with RSAT sysvol acls are invalid In-Reply-To: <494dfd58-dc27-4944-9a1c-acb371975bac@gmail.com> References: <20260908141732.436c3095@debstation.samdom.example.com> <494dfd58-dc27-4944-9a1c-acb371975bac@gmail.com> Message-ID: <20260908172332.7fbd6121@debstation.samdom.example.com> On Tue, 8 Sep 2026 17:53:30 +0200 Giuseppe Arvati via samba wrote: > > > I notice you are using rfc2307 for idmap, have you given Domain > > Admins a gidNumber attribute ? > > No > Hmm, that is the usual problem, giving Domain Admins a gidNumber turns it into a Unix group. Can you post the output of: getent passwd Domain\ Admins getent group Domain\ Admins getent passwd Administrators getent group Administrators samba-tool ntacl sysvolcheck Rowland From giuseppe.arvati at gmail.com Wed Sep 9 06:48:45 2026 From: giuseppe.arvati at gmail.com (Giuseppe Arvati) Date: Wed, 9 Sep 2026 08:48:45 +0200 Subject: [Samba] after edit gpo with RSAT sysvol acls are invalid In-Reply-To: <20260908172332.7fbd6121@debstation.samdom.example.com> References: <20260908141732.436c3095@debstation.samdom.example.com> <494dfd58-dc27-4944-9a1c-acb371975bac@gmail.com> <20260908172332.7fbd6121@debstation.samdom.example.com> Message-ID: Il 08/09/2026 18:23, Rowland Penny via samba ha scritto: > On Tue, 8 Sep 2026 17:53:30 +0200 > Giuseppe Arvati via samba wrote: > >>> I notice you are using rfc2307 for idmap, have you given Domain >>> Admins a gidNumber attribute ? >> No >> > Hmm, that is the usual problem, giving Domain Admins a gidNumber turns > it into a Unix group. > > Can you post the output of: > > getent passwd Domain\ Admins > > getent group Domain\ Admins > > getent passwd Administrators > > getent group Administrators > > samba-tool ntacl sysvolcheck > > Rowland > > > > getent passwd Domain\ Admins APAM-AD\domain admins:*:3000004:3000004::/home/APAM-AD/domain admins:/bin/false getent group Domain\ Admins APAM-AD\domain admins:x:3000004: getent passwd Administrators APAM-AD\administrators:*:3000205:3000205::/home/APAM-AD/administrators:/bin/false getent group Administrators APAM-AD\administrators:x:3000205: samba-tool ntacl sysvolcheck ( no error ) but if I modifify a gpo a get an error Usually I use ga.admin user to log on RSAT tool which is member of APAM-AD\domain admins group getent passwd ga.admin APAM-AD\ga.admin:*:3000037:100::/home/APAM-AD/ga.admin:/bin/false groups ga.admin ga.admin : users APAM-AD\ga.admin APAM-AD\domain admins APAM-AD\denied rodc password replication group BUILTIN\administrators BUILTIN\users getent group Domain\ users APAM-AD\domain users:x:100: The primary group of ga.admin is Domain users and when I modify the policy it change owner:group from?APAM-AD\domain admins : APAM-AD\domain admins to??BUILTIN\Adminstrators : users and sysvolcheck fails Should ga.admin have APAM-AD\domain admins as primary group instead of Domain users ? But from Win11 RSAT the primary posix group of a user is disabled Thank you From rpenny at samba.org Wed Sep 9 15:03:16 2026 From: rpenny at samba.org (Rowland Penny) Date: Wed, 9 Sep 2026 16:03:16 +0100 Subject: [Samba] after edit gpo with RSAT sysvol acls are invalid In-Reply-To: References: <20260908141732.436c3095@debstation.samdom.example.com> <494dfd58-dc27-4944-9a1c-acb371975bac@gmail.com> <20260908172332.7fbd6121@debstation.samdom.example.com> Message-ID: <20260909160316.3368ae43@debstation.samdom.example.com> On Wed, 9 Sep 2026 08:48:45 +0200 Giuseppe Arvati via samba wrote: > Il 08/09/2026 18:23, Rowland Penny via samba ha scritto: > > On Tue, 8 Sep 2026 17:53:30 +0200 > > Giuseppe Arvati via samba wrote: > > > >>> I notice you are using rfc2307 for idmap, have you given Domain > >>> Admins a gidNumber attribute ? > >> No > >> > > Hmm, that is the usual problem, giving Domain Admins a gidNumber > > turns it into a Unix group. > > > > Can you post the output of: > > > > getent passwd Domain\ Admins > > > > getent group Domain\ Admins > > > > getent passwd Administrators > > > > getent group Administrators > > > > samba-tool ntacl sysvolcheck > > > > Rowland > > > > > > > > > getent passwd Domain\ Admins > APAM-AD\domain admins:*:3000004:3000004::/home/APAM-AD/domain > admins:/bin/false > > getent group Domain\ Admins > APAM-AD\domain admins:x:3000004: > > getent passwd Administrators > APAM-AD\administrators:*:3000205:3000205::/home/APAM-AD/administrators:/bin/false > > getent group Administrators > APAM-AD\administrators:x:3000205: Everything looks correct there. > > samba-tool ntacl sysvolcheck ( no error ) > > but if I modifify a gpo a get an error > > Usually I use ga.admin user to log on RSAT tool which is member of > APAM-AD\domain admins group > > getent passwd ga.admin > APAM-AD\ga.admin:*:3000037:100::/home/APAM-AD/ga.admin:/bin/false > > groups ga.admin > ga.admin : users APAM-AD\ga.admin APAM-AD\domain admins > APAM-AD\denied rodc password replication group BUILTIN\administrators > BUILTIN\users > > getent group Domain\ users > APAM-AD\domain users:x:100: '100' is the Unix ID for the Unix group users, the idmap backend on a Samba AD DC maps Domain Users to the ID '100': dn: CN=S-1-5-21-627072207-2265849604-124128874-513 cn: S-1-5-21-627072207-2265849604-124128874-513 objectClass: sidMap objectSid: S-1-5-21-627072207-2265849604-124128874-513 type: ID_TYPE_GID xidNumber: 100 distinguishedName: CN=S-1-5-21-627072207-2265849604-124128874-513 > > The primary group of ga.admin is Domain users and when I modify the > policy it change owner:group > > from?APAM-AD\domain admins : APAM-AD\domain admins > > to??BUILTIN\Adminstrators : users > > and sysvolcheck fails > > Should ga.admin have APAM-AD\domain admins as primary group instead > of Domain users ? Not sure doing that would help, you would have to add ga.admin to Domain Users or Windows will complain and I think the group would still get changed to 'users'. Could this be an inheritance problem ? Rowland From bjacke at samba.org Wed Sep 9 15:18:36 2026 From: bjacke at samba.org (=?UTF-8?Q?Bj=C3=B6rn_Jacke?=) Date: Wed, 9 Sep 2026 17:18:36 +0200 Subject: [Samba] [Announce] Samba 4.24.7 Available for Download Message-ID: Release Announcements --------------------- This is the latest stable release of the Samba 4.24 release series. Changes since 4.24.6 -------------------- o Ralph Boehme * BUG 16097: POSIX ACL backend silently discards erros when processing NT ACLs with non-canonical ordering o Volker Lendecke * BUG 16225: dns client problems related to EDNS usage o Andr?as Leroux * BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP when packet is larger than 4k o Stefan Metzmacher * BUG 15988: Samba internal DNS service doesn't handle switch from UDP to TCP when packet is larger than 4k * BUG 16194: autobuild failures need to be reported in a more verbose way * BUG 16223: DNS scavenging happens even if fAging is FALSE * BUG 16226: samba-tool dns zoneoptions $DC_SERVER_IP _msdcs.addom.samba.example.com -P --aging=1 gives WERR_INTERNAL_DB_ERROR o Andreas Schneider * BUG 16144: Incorrect behavior on stream create-disposition when prior handle is closed o Martin Schwenke * BUG 16082: An inactive node can run recovery resulting in inconsistent databases o Shachar Sharon * BUG 16225: dns client problems related to EDNS usage o Jennifer Sutton * BUG 16225: dns client problems related to EDNS usage ####################################### Reporting bugs & Development Discussion ####################################### Please discuss this release on the samba-technical mailing list or by joining the #samba-technical:matrix.org matrix room, or #samba-technical IRC channel on irc.libera.chat. If you do report problems then please try to send high quality feedback. If you don't provide vital information to help us track down the problem then you will probably be ignored. All bug reports should be filed under the Samba 4.1 and newer product in the project's Bugzilla database (https://bugzilla.samba.org/). ====================================================================== == Our Code, Our Bugs, Our Responsibility. == The Samba Team ====================================================================== ================ Download Details ================ The uncompressed tarballs and patch files have been signed using GnuPG (ID AA99442FB680B620). The source code can be downloaded from: https://download.samba.org/pub/samba/stable/ The release notes are available online at: https://www.samba.org/samba/history/samba-4.24.7.html Our Code, Our Bugs, Our Responsibility. (https://bugzilla.samba.org/) --Enjoy The Samba Team -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature.asc Type: application/pgp-signature Size: 236 bytes Desc: OpenPGP digital signature URL: From giuseppe.arvati at gmail.com Wed Sep 9 16:02:19 2026 From: giuseppe.arvati at gmail.com (Giuseppe Arvati) Date: Wed, 9 Sep 2026 18:02:19 +0200 Subject: [Samba] after edit gpo with RSAT sysvol acls are invalid In-Reply-To: <20260909160316.3368ae43@debstation.samdom.example.com> References: <20260908141732.436c3095@debstation.samdom.example.com> <494dfd58-dc27-4944-9a1c-acb371975bac@gmail.com> <20260908172332.7fbd6121@debstation.samdom.example.com> <20260909160316.3368ae43@debstation.samdom.example.com> Message-ID: <69cd298f-6794-47a2-a086-86b7c3a694c4@gmail.com> Il 09/09/2026 17:03, Rowland Penny via samba ha scritto: > On Wed, 9 Sep 2026 08:48:45 +0200 > Giuseppe Arvati via samba wrote: > >> Il 08/09/2026 18:23, Rowland Penny via samba ha scritto: >>> On Tue, 8 Sep 2026 17:53:30 +0200 >>> Giuseppe Arvati via samba wrote: >>> >>>>> I notice you are using rfc2307 for idmap, have you given Domain >>>>> Admins a gidNumber attribute ? >>>> No >>>> >>> Hmm, that is the usual problem, giving Domain Admins a gidNumber >>> turns it into a Unix group. >>> >>> Can you post the output of: >>> >>> getent passwd Domain\ Admins >>> >>> getent group Domain\ Admins >>> >>> getent passwd Administrators >>> >>> getent group Administrators >>> >>> samba-tool ntacl sysvolcheck >>> >>> Rowland >>> >>> >>> >>> >> getent passwd Domain\ Admins >> APAM-AD\domain admins:*:3000004:3000004::/home/APAM-AD/domain >> admins:/bin/false >> >> getent group Domain\ Admins >> APAM-AD\domain admins:x:3000004: >> >> getent passwd Administrators >> APAM-AD\administrators:*:3000205:3000205::/home/APAM-AD/administrators:/bin/false >> >> getent group Administrators >> APAM-AD\administrators:x:3000205: > Everything looks correct there. > >> samba-tool ntacl sysvolcheck ( no error ) >> >> but if I modifify a gpo a get an error >> >> Usually I use ga.admin user to log on RSAT tool which is member of >> APAM-AD\domain admins group >> >> getent passwd ga.admin >> APAM-AD\ga.admin:*:3000037:100::/home/APAM-AD/ga.admin:/bin/false >> >> groups ga.admin >> ga.admin : users APAM-AD\ga.admin APAM-AD\domain admins >> APAM-AD\denied rodc password replication group BUILTIN\administrators >> BUILTIN\users >> >> getent group Domain\ users >> APAM-AD\domain users:x:100: > '100' is the Unix ID for the Unix group users, the idmap backend on a > Samba AD DC maps Domain Users to the ID '100': > > dn: CN=S-1-5-21-627072207-2265849604-124128874-513 > cn: S-1-5-21-627072207-2265849604-124128874-513 > objectClass: sidMap > objectSid: S-1-5-21-627072207-2265849604-124128874-513 > type: ID_TYPE_GID > xidNumber: 100 > distinguishedName: CN=S-1-5-21-627072207-2265849604-124128874-513 > >> The primary group of ga.admin is Domain users and when I modify the >> policy it change owner:group >> >> from?APAM-AD\domain admins : APAM-AD\domain admins >> >> to??BUILTIN\Adminstrators : users >> >> and sysvolcheck fails >> >> Should ga.admin have APAM-AD\domain admins as primary group instead >> of Domain users ? > Not sure doing that would help, you would have to add ga.admin to > Domain Users or Windows will complain and I think the group would still > get changed to 'users'. Could this be an inheritance problem ? > > Rowland > Hello Rowland, I try to use Administrator user to modifiy a policy and got same result before modification sysvolcheck ok and -rwxrwx---+ 1 APAM-AD\domain admins APAM-AD\domain admins 2766? 8 set 11.45 /var/lib/samba/sysvol/apam-ad.apam.lan/Policies/31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol and after modification -rwxrwx---+ 1 BUILTIN\administrators users 2766? 9 set 17.41 /var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol and sysvolcheck fail samba-tool ntacl sysvolcheck ERROR(): uncaught exception - ProvisioningError: DB ACL on GPO file /var/lib/sa mba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol O:BAG:DUD:(A;;FA;;;DA)(A; ;FA;;;EA)(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;AU)(A;;0x1200a9;;;ED) does not match expected value O:DAG:DAD:P(A;OICI;FA; ;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) from GPO object Shoud sysvol share need a special security permission configuration ? now is: authenticated users ( read execute, view folder, read ) Administrators ( all except special authorization ) Server operator ( same as authenticated users ) System ( all except special authorization ) Thank you From rpenny at samba.org Wed Sep 9 16:35:20 2026 From: rpenny at samba.org (Rowland Penny) Date: Wed, 9 Sep 2026 17:35:20 +0100 Subject: [Samba] after edit gpo with RSAT sysvol acls are invalid In-Reply-To: <69cd298f-6794-47a2-a086-86b7c3a694c4@gmail.com> References: <20260908141732.436c3095@debstation.samdom.example.com> <494dfd58-dc27-4944-9a1c-acb371975bac@gmail.com> <20260908172332.7fbd6121@debstation.samdom.example.com> <20260909160316.3368ae43@debstation.samdom.example.com> <69cd298f-6794-47a2-a086-86b7c3a694c4@gmail.com> Message-ID: <20260909173520.75babc1c@debstation.samdom.example.com> On Wed, 9 Sep 2026 18:02:19 +0200 Giuseppe Arvati via samba wrote: > > I try to use Administrator user to modifiy a policy and got same > result > > before modification sysvolcheck ok and > > -rwxrwx---+ 1 APAM-AD\domain admins APAM-AD\domain admins 2766? 8 set > 11.45 > /var/lib/samba/sysvol/apam-ad.apam.lan/Policies/31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol > > and after modification > > -rwxrwx---+ 1 BUILTIN\administrators users 2766? 9 set 17.41 > /var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol Are you trying to modify one of the default policies ? If so, can I suggest you stop and try creating a new policy instead. > > and sysvolcheck fail > > samba-tool ntacl sysvolcheck > ERROR(): uncaught > exception - ProvisioningError: DB ACL on GPO file /var/lib/sa > mba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol > O:BAG:DUD:(A;;FA;;;DA)(A; > ;FA;;;EA)(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;AU)(A;;0x1200a9;;;ED) > does not match expected value O:DAG:DAD:P(A;OICI;FA; > ;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) > from GPO object > You have been focusing on the owner:group , but the ACEs are also totally different, though this could just be that you are modifying one of the default policies and this is not to be recommended. Rowland From samba at lindenberg.one Wed Sep 9 21:03:00 2026 From: samba at lindenberg.one (Joachim Lindenberg) Date: Wed, 9 Sep 2026 23:03:00 +0200 Subject: [Samba] replication issue..? Message-ID: <001c01dd409e$99466200$cbd32600$@lindenberg.one> I am experiencing a replication issue. A computer joined is existing in DC cobra only, and missing in DC boa. Replication was not broken from day one, but now samba-tool drs showrepl shows ?Last success @ NTTIME(0)? in many places. The output is very long as I have a total of four DCs, two of them offsite and offline for different intervals. Before taking any corrective measures w.r.t. replication configuration, I wanted to achieve that cobra contains all data if possible. Therefore I tried to manually replicate objects without --full-sync. That turns out to work for three naming contexts and fails for the most relevant (w.r.t. missing computer object). root at boa:/var/log/samdom# samdom-tool drs replicate boa.samdom.example.org cobra.samdom.example.org CN=Configuration,dc=samdom,dc=example,dc=org Replicate from cobra.samdom.example.org to boa.samdom.example.org was successful. root at boa:/var/log/samdom# samdom-tool drs replicate boa.samdom.example.org cobra.samdom.example.org CN=DomainDnsZone,dc=samdom,dc=example,dc=org Replicate from cobra.samdom.example.org to boa.samdom.example.org was successful. root at boa:/var/log/samdom# samdom-tool drs replicate boa.samdom.example.org cobra.samdom.example.org CN=Schema,CN=Configuration,dc=samdom,dc=example,dc=org Replicate from cobra.samdom.example.org to boa.samdom.example.org was successful. root at boa:/var/log/samdom# samdom-tool drs replicate boa.samdom.example.org cobra.samdom.example.org dc=samdom,dc=example,dc=org ERROR(): DsReplicaSync failed - drsException: DsReplicaSync failed (58, 'WERR_BAD_NET_RESP') As only one naming context fails, I assume network is ok. root at cobra:/home/joachim# samdom-tool dbcheck --cross-ncs Checking 4306 objects Checked 4306 objects (0 errors) root at boa:/var/log/samdom# samdom-tool dbcheck --cross-ncs Checking 4296 objects WARNING: no target object found for GUID comporgnt link lastKnownParent in deleted object CN=2024-12-21T14:34:46\+01:00{F7D41B5A-7F71-4932-845A-27194999D48C}\0ADEL:448a9c07-572c-48d6-bf27-20969b734541,CN=Deleted Objects,DC=samdom,DC=example,DC=org - ;;CN=MEDION\0ADEL:5ffeb1e7-e89e-4b5a-902e-24c833791e9b,CN=Deleted Objects,DC=samdom,DC=example,DC=org Not removing dangling one-way link on deleted object (tombstone garbage collection in progress?) WARNING: no target object found for GUID comporgnt link lastKnownParent in deleted object CN=2024-12-21T14:34:43\+01:00{1E2ADC40-1B84-49F2-938B-86BA1C4C97A6}\0ADEL:7f0943b7-4c3b-46fa-aba3-86a9595f5bff,CN=Deleted Objects,DC=samdom,DC=example,DC=org - ;;CN=MEDION\0ADEL:5ffeb1e7-e89e-4b5a-902e-24c833791e9b,CN=Deleted Objects,DC=samdom,DC=example,DC=org Not removing dangling one-way link on deleted object (tombstone garbage collection in progress?) Checked 4296 objects (0 errors) What may cause the 'WERR_BAD_NET_RESP'? At least searching didn?t tell me that the error is caused by the dangling objects. How can I replicate potentially missing objects or verify there are none missing in cobra? And once I have everything on cobra, how can I repair replication? Or is the recommendation to rejoin? Thanks, Joachim From rpenny at samba.org Thu Sep 10 06:41:06 2026 From: rpenny at samba.org (Rowland Penny) Date: Thu, 10 Sep 2026 07:41:06 +0100 Subject: [Samba] replication issue..? In-Reply-To: <001c01dd409e$99466200$cbd32600$@lindenberg.one> References: <001c01dd409e$99466200$cbd32600$@lindenberg.one> Message-ID: <20260910074106.32ee9b55@debstation.samdom.example.com> On Wed, 9 Sep 2026 23:03:00 +0200 Joachim Lindenberg via samba wrote: > I am experiencing a replication issue. A computer joined is existing > in DC cobra only, and missing in DC boa. Replication was not broken > from day one, but now samba-tool drs showrepl shows ?Last success @ > NTTIME(0)? in many places. The output is very long as I have a total > of four DCs, two of them offsite and offline for different intervals. It isn't a good idea for a DC to be offline for long, the time can be different when they come back online and then replication will not occur. Why do they go offline ? are they being turned off ? > > > > Before taking any corrective measures w.r.t. replication > configuration, I wanted to achieve that cobra contains all data if > possible. Therefore I tried to manually replicate objects without > --full-sync. That turns out to work for three naming contexts and > fails for the most relevant (w.r.t. missing computer object). > > > > root at boa:/var/log/samdom# samdom-tool drs replicate > boa.samdom.example.org cobra.samdom.example.org > CN=Configuration,dc=samdom,dc=example,dc=org > > Replicate from cobra.samdom.example.org to boa.samdom.example.org was > successful. > > root at boa:/var/log/samdom# samdom-tool drs replicate > boa.samdom.example.org cobra.samdom.example.org > CN=DomainDnsZone,dc=samdom,dc=example,dc=org > > Replicate from cobra.samdom.example.org to boa.samdom.example.org was > successful. > > root at boa:/var/log/samdom# samdom-tool drs replicate > boa.samdom.example.org cobra.samdom.example.org > CN=Schema,CN=Configuration,dc=samdom,dc=example,dc=org > > Replicate from cobra.samdom.example.org to boa.samdom.example.org was > successful. > > root at boa:/var/log/samdom# samdom-tool drs replicate > boa.samdom.example.org cobra.samdom.example.org > dc=samdom,dc=example,dc=org > > ERROR(): DsReplicaSync failed > - drsException: DsReplicaSync failed (58, 'WERR_BAD_NET_RESP') > > > > As only one naming context fails, I assume network is ok. > > > > root at cobra:/home/joachim# samdom-tool dbcheck --cross-ncs > > Checking 4306 objects > > Checked 4306 objects (0 errors) > > > > root at boa:/var/log/samdom# samdom-tool dbcheck --cross-ncs > > Checking 4296 objects > > WARNING: no target object found for GUID comporgnt link > lastKnownParent in deleted object > CN=2024-12-21T14:34:46\+01:00{F7D41B5A-7F71-4932-845A-27194999D48C}\0ADEL:448a9c07-572c-48d6-bf27-20969b734541,CN=Deleted > Objects,DC=samdom,DC=example,DC=org - > ;;CN=MEDION\0ADEL:5ffeb1e7-e89e-4b5a-902e-24c833791e9b,CN=Deleted > Objects,DC=samdom,DC=example,DC=org > > Not removing dangling one-way link on deleted object (tombstone > garbage collection in progress?) > > WARNING: no target object found for GUID comporgnt link > lastKnownParent in deleted object > CN=2024-12-21T14:34:43\+01:00{1E2ADC40-1B84-49F2-938B-86BA1C4C97A6}\0ADEL:7f0943b7-4c3b-46fa-aba3-86a9595f5bff,CN=Deleted > Objects,DC=samdom,DC=example,DC=org - > ;;CN=MEDION\0ADEL:5ffeb1e7-e89e-4b5a-902e-24c833791e9b,CN=Deleted > Objects,DC=samdom,DC=example,DC=org > > Not removing dangling one-way link on deleted object (tombstone > garbage collection in progress?) > > Checked 4296 objects (0 errors) > > > > What may cause the 'WERR_BAD_NET_RESP'? At least searching didn?t > tell me that the error is caused by the dangling objects. > > How can I replicate potentially missing objects or verify there are > none missing in cobra? I thought that everything was on 'cobra' and was missing from 'boa' > > And once I have everything on cobra, how can I repair replication? Or > is the recommendation to rejoin? It can often be quicker and easier to demote a faulty DC and replace it with a new one, but unless you stop the other DCs going offline, it may happen again. Rowland From samba at lindenberg.one Thu Sep 10 07:31:09 2026 From: samba at lindenberg.one (Joachim Lindenberg) Date: Thu, 10 Sep 2026 09:31:09 +0200 Subject: [Samba] replication issue..? In-Reply-To: <20260910074106.32ee9b55@debstation.samdom.example.com> References: <001c01dd409e$99466200$cbd32600$@lindenberg.one> <20260910074106.32ee9b55@debstation.samdom.example.com> Message-ID: <017501dd40f6$596dbf40$0c493dc0$@lindenberg.one> Rowland wrote: > It isn't a good idea for a DC to be offline for long, the time can be different when they come back online and then replication will not occur. Why do they go offline ? are they being turned off ? > ... > It can often be quicker and easier to demote a faulty DC and replace it with a new one, but unless you stop the other DCs going offline, it may happen again. One of them is sleeping frequently in order to save energy and noise, the other was at a location that I had to give up and am still looking for a new one. All systems have their time updated while coming online again. But what does "long" mean and don?t you consider this a replication bug? At least I am not aware this is a documented feature. And definitely I?d appreciate if you could answer my questions w.r.t. recovery. Joachim From rpenny at samba.org Thu Sep 10 08:11:34 2026 From: rpenny at samba.org (Rowland Penny) Date: Thu, 10 Sep 2026 09:11:34 +0100 Subject: [Samba] replication issue..? In-Reply-To: <017501dd40f6$596dbf40$0c493dc0$@lindenberg.one> References: <001c01dd409e$99466200$cbd32600$@lindenberg.one> <20260910074106.32ee9b55@debstation.samdom.example.com> <017501dd40f6$596dbf40$0c493dc0$@lindenberg.one> Message-ID: <20260910091134.04375812@debstation.samdom.example.com> On Thu, 10 Sep 2026 09:31:09 +0200 Joachim Lindenberg via samba wrote: > Rowland wrote: > > It isn't a good idea for a DC to be offline for long, the time can > > be different when they come back online and then replication will > > not occur. Why do they go offline ? are they being turned off ? ... > > It can often be quicker and easier to demote a faulty DC and > > replace it with a new one, but unless you stop the other DCs going > > offline, it may happen again. > > One of them is sleeping frequently in order to save energy and noise, I cannot recommend doing that, a DC should always be on, except for reboots or upgrades (which can lead to reboots), you can get lingering objects on the 'off' DC if something is deleted on an 'on' DC. > the other was at a location that I had to give up and am still > looking for a new one. Then demote it, forcibly if you must. > All systems have their time updated while > coming online again. But what does "long" mean and don?t you consider > this a replication bug? 'long' can be any extended period, but anything past the tombstone lifetime is probably fatal. I would not consider this a bug, just bad maintenance. > At least I am not aware this is a documented > feature. > > And definitely I?d appreciate if you could answer my questions w.r.t. > recovery. I am not sure that you can recover this and if you can, it will not be trivial, you appear to have carried out the easiest things. As I said, in cases like this, it is probably easier to demote the faulty DC and create a new one. Rowland