[Samba] after edit gpo with RSAT sysvol acls are invalid

[Rowland Penny]

On Tue, 8 Sep 2026 14:36:51 +0200
Giuseppe Arvati via samba <samba at lists.samba.org> wrote:

> Hello,
> 
> every time I try to edit gpo with RSAT tools the sysvol acl become
> invalid
> 
> After gpo modification the Registry.pol owner and group become
> 
> # owner: BUILTIN\\administrators
> # group: users
> 
> 
> # file: 
> var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol
> # owner: BUILTIN\\administrators
> # group: users
> user::rwx
> user:NT\040Authority\\system:rwx
> user:NT\040Authority\\authenticated\040users:r-x
> user:APAM-AD\\domain\040admins:rwx
> user:APAM-AD\\enterprise\040admins:rwx
> user:NT\040Authority\\enterprise\040domain\040controllers:r-x
> group::---
> group:users:---
> group:BUILTIN\\administrators:rwx
> group:NT\040Authority\\system:rwx
> group:NT\040Authority\\authenticated\040users:r-x
> group:APAM-AD\\domain\040admins:rwx
> group:APAM-AD\\enterprise\040admins:rwx
> group:NT\040Authority\\enterprise\040domain\040controllers:r-x
> mask::rwx
> other::---
> 
> after sysvolreset the same file
> 
> # owner: APAM-AD\\domain admins
> # group: APAM-AD\\domain admins
> 
> # file: 
> var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol
> # owner: APAM-AD\\domain\040admins
> # group: APAM-AD\\domain\040admins
> user::rwx
> user:NT\040Authority\\system:rwx
> user:NT\040Authority\\authenticated\040users:r-x
> user:APAM-AD\\enterprise\040admins:rwx
> user:NT\040Authority\\enterprise\040domain\040controllers:r-x
> group::rwx
> group:NT\040Authority\\system:rwx
> group:NT\040Authority\\authenticated\040users:r-x
> group:APAM-AD\\domain\040admins:rwx
> group:APAM-AD\\enterprise\040admins:rwx
> group:NT\040Authority\\enterprise\040domain\040controllers:r-x
> mask::rwx
> other::---
> 
> I use RSAT gpo editor logged with a user member of APAM-AD\\domain
> admins
> 
> I have some problems to distribute gpo to clients ( sync time, .. )
> and I think it cound dipend of some misconfiguration somewhere (
> sysvol access right ? )
> 
> I saw same problem in older posts but without a clear solution
> 
> Actual configuration is 1 DC and 2 DM as file server
> 
> The DC was intalled at the and of 2025 with 4.23/deb12 and regularly 
> updated every time
> 
> Actual version is 4.24.5-Debian-4.24.5+dfsg-1~bpo13+1
> 
> Below my DC smb.conf

No it isn't, it looks like the output of 'testparm' to me and you
shouldn't run testparm on a Samba AD DC, you should run 'samba-tool
testparm'.

> 
> # Global parameters
> [global]
>          ad dc functional level = 2016
>          disable netbios = Yes
>          disable spoolss = Yes
>          dns forwarder = 10.1.1.5
>          load printers = No
>          ntlm auth = mschapv2-and-ntlmv2-only
>          passdb backend = samba_dsdb
>          printcap name = /dev/null
>          realm = APAM-AD.APAM.LAN
>          restrict anonymous = 2
>          rpc server dynamic port range = 50000-55000
>          server role = active directory domain controller
>          server smb transports = 445
>          usershare max shares = 100
>          workgroup = APAM-AD
>          rpc_server:tcpip = no
>          rpc_daemon:spoolssd = embedded
>          rpc_server:spoolss = embedded
>          rpc_server:winreg = embedded
>          rpc_server:ntsvcs = embedded
>          rpc_server:eventlog = embedded
>          rpc_server:srvsvc = embedded
>          rpc_server:svcctl = embedded
>          rpc_server:default = external
>          winbindd:use external pipes = true
>          idmap_ldb:use rfc2307 = yes
>          idmap config * : backend = tdb
>          map archive = No
>          printing = bsd
>          vfs objects = dfs_samba4 acl_xattr
> 
> [sysvol]
>          path = /var/lib/samba/sysvol
>          read only = No
> 
> [netlogon]
>          path = /var/lib/samba/sysvol/apam-ad.apam.lan/scripts
>          read only = No
> 

I notice you are using rfc2307 for idmap, have you given Domain Admins
a gidNumber attribute ?

Rowland