[Samba] after edit gpo with RSAT sysvol acls are invalid

[Giuseppe Arvati]

Il 08/09/2026 15:17, Rowland Penny via samba ha scritto:
> On Tue, 8 Sep 2026 14:36:51 +0200
> Giuseppe Arvati via samba <samba at lists.samba.org> wrote:
>
>> Hello,
>>
>> every time I try to edit gpo with RSAT tools the sysvol acl become
>> invalid
>>
>> After gpo modification the Registry.pol owner and group become
>>
>> # owner: BUILTIN\\administrators
>> # group: users
>>
>>
>> # file:
>> var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol
>> # owner: BUILTIN\\administrators
>> # group: users
>> user::rwx
>> user:NT\040Authority\\system:rwx
>> user:NT\040Authority\\authenticated\040users:r-x
>> user:APAM-AD\\domain\040admins:rwx
>> user:APAM-AD\\enterprise\040admins:rwx
>> user:NT\040Authority\\enterprise\040domain\040controllers:r-x
>> group::---
>> group:users:---
>> group:BUILTIN\\administrators:rwx
>> group:NT\040Authority\\system:rwx
>> group:NT\040Authority\\authenticated\040users:r-x
>> group:APAM-AD\\domain\040admins:rwx
>> group:APAM-AD\\enterprise\040admins:rwx
>> group:NT\040Authority\\enterprise\040domain\040controllers:r-x
>> mask::rwx
>> other::---
>>
>> after sysvolreset the same file
>>
>> # owner: APAM-AD\\domain admins
>> # group: APAM-AD\\domain admins
>>
>> # file:
>> var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol
>> # owner: APAM-AD\\domain\040admins
>> # group: APAM-AD\\domain\040admins
>> user::rwx
>> user:NT\040Authority\\system:rwx
>> user:NT\040Authority\\authenticated\040users:r-x
>> user:APAM-AD\\enterprise\040admins:rwx
>> user:NT\040Authority\\enterprise\040domain\040controllers:r-x
>> group::rwx
>> group:NT\040Authority\\system:rwx
>> group:NT\040Authority\\authenticated\040users:r-x
>> group:APAM-AD\\domain\040admins:rwx
>> group:APAM-AD\\enterprise\040admins:rwx
>> group:NT\040Authority\\enterprise\040domain\040controllers:r-x
>> mask::rwx
>> other::---
>>
>> I use RSAT gpo editor logged with a user member of APAM-AD\\domain
>> admins
>>
>> I have some problems to distribute gpo to clients ( sync time, .. )
>> and I think it cound dipend of some misconfiguration somewhere (
>> sysvol access right ? )
>>
>> I saw same problem in older posts but without a clear solution
>>
>> Actual configuration is 1 DC and 2 DM as file server
>>
>> The DC was intalled at the and of 2025 with 4.23/deb12 and regularly
>> updated every time
>>
>> Actual version is 4.24.5-Debian-4.24.5+dfsg-1~bpo13+1
>>
>> Below my DC smb.conf
> No it isn't, it looks like the output of 'testparm' to me and you
> shouldn't run testparm on a Samba AD DC, you should run 'samba-tool
> testparm'.

>> # Global parameters
>> [global]
>>           ad dc functional level = 2016
>>           disable netbios = Yes
>>           disable spoolss = Yes
>>           dns forwarder = 10.1.1.5
>>           load printers = No
>>           ntlm auth = mschapv2-and-ntlmv2-only
>>           passdb backend = samba_dsdb
>>           printcap name = /dev/null
>>           realm = APAM-AD.APAM.LAN
>>           restrict anonymous = 2
>>           rpc server dynamic port range = 50000-55000
>>           server role = active directory domain controller
>>           server smb transports = 445
>>           usershare max shares = 100
>>           workgroup = APAM-AD
>>           rpc_server:tcpip = no
>>           rpc_daemon:spoolssd = embedded
>>           rpc_server:spoolss = embedded
>>           rpc_server:winreg = embedded
>>           rpc_server:ntsvcs = embedded
>>           rpc_server:eventlog = embedded
>>           rpc_server:srvsvc = embedded
>>           rpc_server:svcctl = embedded
>>           rpc_server:default = external
>>           winbindd:use external pipes = true
>>           idmap_ldb:use rfc2307 = yes
>>           idmap config * : backend = tdb
>>           map archive = No
>>           printing = bsd
>>           vfs objects = dfs_samba4 acl_xattr
>>
>> [sysvol]
>>           path = /var/lib/samba/sysvol
>>           read only = No
>>
>> [netlogon]
>>           path = /var/lib/samba/sysvol/apam-ad.apam.lan/scripts
>>           read only = No
>>
root at dc2:~# samba-tool testparm
INFO 2026-09-08 17:45:18,313 pid:75355 
/usr/lib/python3/dist-packages/samba/netcmd/testparm.py #87: Loaded smb 
config files from /etc/samba/smb.conf
INFO 2026-09-08 17:45:18,313 pid:75355 
/usr/lib/python3/dist-packages/samba/netcmd/testparm.py #88: Loaded 
services file OK.

# Global parameters
[global]
         ad dc functional level = 2016
         disable netbios = Yes
         disable spoolss = Yes
         dns forwarder = 10.1.1.5
         netbios name = DC2
         ntlm auth = mschapv2-and-ntlmv2-only
         printcap name = /dev/null
         realm = APAM-AD.APAM.LAN
         restrict anonymous = 2
         rpc server dynamic port range = 50000-55000
         server role = active directory domain controller
         server smb transports = 445
         usershare max shares = 100
         workgroup = APAM-AD
         idmap_ldb:use rfc2307 = yes

[sysvol]
         path = /var/lib/samba/sysvol
         read only = No

[netlogon]
         path = /var/lib/samba/sysvol/apam-ad.apam.lan/scripts
         read only = No

> I notice you are using rfc2307 for idmap, have you given Domain Admins
> a gidNumber attribute ?

No

Which check can I do to give you more useful informations ?

thank you

>
> Rowland
>