[Samba] after edit gpo with RSAT sysvol acls are invalid

[Giuseppe Arvati]

Il 08/09/2026 18:23, Rowland Penny via samba ha scritto:
> On Tue, 8 Sep 2026 17:53:30 +0200
> Giuseppe Arvati via samba <samba at lists.samba.org> wrote:
>
>>> I notice you are using rfc2307 for idmap, have you given Domain
>>> Admins a gidNumber attribute ?
>> No
>>
> Hmm, that is the usual problem, giving Domain Admins a gidNumber turns
> it into a Unix group.
>
> Can you post the output of:
>
> getent passwd Domain\ Admins
>
> getent group Domain\ Admins
>
> getent passwd Administrators
>
> getent group Administrators
>
> samba-tool ntacl sysvolcheck
>
> Rowland
>
>
>
>
getent passwd Domain\ Admins
APAM-AD\domain admins:*:3000004:3000004::/home/APAM-AD/domain 
admins:/bin/false

getent group Domain\ Admins
APAM-AD\domain admins:x:3000004:

getent passwd Administrators
APAM-AD\administrators:*:3000205:3000205::/home/APAM-AD/administrators:/bin/false

getent group Administrators
APAM-AD\administrators:x:3000205:

samba-tool ntacl sysvolcheck ( no error )

but if I modifify a gpo a get an error

Usually I use ga.admin user to log on RSAT tool which is member of 
APAM-AD\domain admins group

getent passwd ga.admin
APAM-AD\ga.admin:*:3000037:100::/home/APAM-AD/ga.admin:/bin/false

groups ga.admin
ga.admin : users APAM-AD\ga.admin APAM-AD\domain admins APAM-AD\denied 
rodc password replication group BUILTIN\administrators BUILTIN\users

getent group Domain\ users
APAM-AD\domain users:x:100:

The primary group of ga.admin is Domain users and when I modify the 
policy it change owner:group

from APAM-AD\domain admins : APAM-AD\domain admins

to  BUILTIN\Adminstrators : users

and sysvolcheck fails

Should ga.admin have APAM-AD\domain admins as primary group instead of 
Domain users ?

But from Win11 RSAT the primary posix group of a user is disabled


Thank you