[Samba] after edit gpo with RSAT sysvol acls are invalid

[Giuseppe Arvati]

Hello,

every time I try to edit gpo with RSAT tools the sysvol acl become invalid

After gpo modification the Registry.pol owner and group become

# owner: BUILTIN\\administrators
# group: users


# file: 
var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol
# owner: BUILTIN\\administrators
# group: users
user::rwx
user:NT\040Authority\\system:rwx
user:NT\040Authority\\authenticated\040users:r-x
user:APAM-AD\\domain\040admins:rwx
user:APAM-AD\\enterprise\040admins:rwx
user:NT\040Authority\\enterprise\040domain\040controllers:r-x
group::---
group:users:---
group:BUILTIN\\administrators:rwx
group:NT\040Authority\\system:rwx
group:NT\040Authority\\authenticated\040users:r-x
group:APAM-AD\\domain\040admins:rwx
group:APAM-AD\\enterprise\040admins:rwx
group:NT\040Authority\\enterprise\040domain\040controllers:r-x
mask::rwx
other::---

after sysvolreset the same file

# owner: APAM-AD\\domain admins
# group: APAM-AD\\domain admins

# file: 
var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol
# owner: APAM-AD\\domain\040admins
# group: APAM-AD\\domain\040admins
user::rwx
user:NT\040Authority\\system:rwx
user:NT\040Authority\\authenticated\040users:r-x
user:APAM-AD\\enterprise\040admins:rwx
user:NT\040Authority\\enterprise\040domain\040controllers:r-x
group::rwx
group:NT\040Authority\\system:rwx
group:NT\040Authority\\authenticated\040users:r-x
group:APAM-AD\\domain\040admins:rwx
group:APAM-AD\\enterprise\040admins:rwx
group:NT\040Authority\\enterprise\040domain\040controllers:r-x
mask::rwx
other::---

I use RSAT gpo editor logged with a user member of APAM-AD\\domain admins

I have some problems to distribute gpo to clients ( sync time, .. ) and 
I think it cound dipend of some misconfiguration somewhere ( sysvol 
access right ? )

I saw same problem in older posts but without a clear solution

Actual configuration is 1 DC and 2 DM as file server

The DC was intalled at the and of 2025 with 4.23/deb12 and regularly 
updated every time

Actual version is 4.24.5-Debian-4.24.5+dfsg-1~bpo13+1

Below my DC smb.conf

# Global parameters
[global]
         ad dc functional level = 2016
         disable netbios = Yes
         disable spoolss = Yes
         dns forwarder = 10.1.1.5
         load printers = No
         ntlm auth = mschapv2-and-ntlmv2-only
         passdb backend = samba_dsdb
         printcap name = /dev/null
         realm = APAM-AD.APAM.LAN
         restrict anonymous = 2
         rpc server dynamic port range = 50000-55000
         server role = active directory domain controller
         server smb transports = 445
         usershare max shares = 100
         workgroup = APAM-AD
         rpc_server:tcpip = no
         rpc_daemon:spoolssd = embedded
         rpc_server:spoolss = embedded
         rpc_server:winreg = embedded
         rpc_server:ntsvcs = embedded
         rpc_server:eventlog = embedded
         rpc_server:srvsvc = embedded
         rpc_server:svcctl = embedded
         rpc_server:default = external
         winbindd:use external pipes = true
         idmap_ldb:use rfc2307 = yes
         idmap config * : backend = tdb
         map archive = No
         printing = bsd
         vfs objects = dfs_samba4 acl_xattr

[sysvol]
         path = /var/lib/samba/sysvol
         read only = No

[netlogon]
         path = /var/lib/samba/sysvol/apam-ad.apam.lan/scripts
         read only = No

Thank you for any advice

Giuseppe