[Samba] after edit gpo with RSAT sysvol acls are invalid

[Rowland Penny]

On Wed, 9 Sep 2026 08:48:45 +0200
Giuseppe Arvati via samba <samba at lists.samba.org> wrote:

> Il 08/09/2026 18:23, Rowland Penny via samba ha scritto:
> > On Tue, 8 Sep 2026 17:53:30 +0200
> > Giuseppe Arvati via samba <samba at lists.samba.org> wrote:
> >
> >>> I notice you are using rfc2307 for idmap, have you given Domain
> >>> Admins a gidNumber attribute ?
> >> No
> >>
> > Hmm, that is the usual problem, giving Domain Admins a gidNumber
> > turns it into a Unix group.
> >
> > Can you post the output of:
> >
> > getent passwd Domain\ Admins
> >
> > getent group Domain\ Admins
> >
> > getent passwd Administrators
> >
> > getent group Administrators
> >
> > samba-tool ntacl sysvolcheck
> >
> > Rowland
> >
> >
> >
> >
> getent passwd Domain\ Admins
> APAM-AD\domain admins:*:3000004:3000004::/home/APAM-AD/domain 
> admins:/bin/false
> 
> getent group Domain\ Admins
> APAM-AD\domain admins:x:3000004:
> 
> getent passwd Administrators
> APAM-AD\administrators:*:3000205:3000205::/home/APAM-AD/administrators:/bin/false
> 
> getent group Administrators
> APAM-AD\administrators:x:3000205:

Everything looks correct there.

> 
> samba-tool ntacl sysvolcheck ( no error )
> 
> but if I modifify a gpo a get an error
> 
> Usually I use ga.admin user to log on RSAT tool which is member of 
> APAM-AD\domain admins group
> 
> getent passwd ga.admin
> APAM-AD\ga.admin:*:3000037:100::/home/APAM-AD/ga.admin:/bin/false
> 
> groups ga.admin
> ga.admin : users APAM-AD\ga.admin APAM-AD\domain admins
> APAM-AD\denied rodc password replication group BUILTIN\administrators
> BUILTIN\users
> 
> getent group Domain\ users
> APAM-AD\domain users:x:100:

'100' is the Unix ID for the Unix group users, the idmap backend on a
Samba AD DC maps Domain Users to the ID '100':

dn: CN=S-1-5-21-627072207-2265849604-124128874-513
cn: S-1-5-21-627072207-2265849604-124128874-513
objectClass: sidMap
objectSid: S-1-5-21-627072207-2265849604-124128874-513
type: ID_TYPE_GID
xidNumber: 100
distinguishedName: CN=S-1-5-21-627072207-2265849604-124128874-513

> 
> The primary group of ga.admin is Domain users and when I modify the 
> policy it change owner:group
> 
> from APAM-AD\domain admins : APAM-AD\domain admins
> 
> to  BUILTIN\Adminstrators : users
> 
> and sysvolcheck fails
> 
> Should ga.admin have APAM-AD\domain admins as primary group instead
> of Domain users ?

Not sure doing that would help, you would have to add ga.admin to
Domain Users or Windows will complain and I think the group would still
get changed to 'users'. Could this be an inheritance problem ?

Rowland