[Samba] after edit gpo with RSAT sysvol acls are invalid

[Giuseppe Arvati]

Il 09/09/2026 17:03, Rowland Penny via samba ha scritto:
> On Wed, 9 Sep 2026 08:48:45 +0200
> Giuseppe Arvati via samba <samba at lists.samba.org> wrote:
>
>> Il 08/09/2026 18:23, Rowland Penny via samba ha scritto:
>>> On Tue, 8 Sep 2026 17:53:30 +0200
>>> Giuseppe Arvati via samba <samba at lists.samba.org> wrote:
>>>
>>>>> I notice you are using rfc2307 for idmap, have you given Domain
>>>>> Admins a gidNumber attribute ?
>>>> No
>>>>
>>> Hmm, that is the usual problem, giving Domain Admins a gidNumber
>>> turns it into a Unix group.
>>>
>>> Can you post the output of:
>>>
>>> getent passwd Domain\ Admins
>>>
>>> getent group Domain\ Admins
>>>
>>> getent passwd Administrators
>>>
>>> getent group Administrators
>>>
>>> samba-tool ntacl sysvolcheck
>>>
>>> Rowland
>>>
>>>
>>>
>>>
>> getent passwd Domain\ Admins
>> APAM-AD\domain admins:*:3000004:3000004::/home/APAM-AD/domain
>> admins:/bin/false
>>
>> getent group Domain\ Admins
>> APAM-AD\domain admins:x:3000004:
>>
>> getent passwd Administrators
>> APAM-AD\administrators:*:3000205:3000205::/home/APAM-AD/administrators:/bin/false
>>
>> getent group Administrators
>> APAM-AD\administrators:x:3000205:
> Everything looks correct there.
>
>> samba-tool ntacl sysvolcheck ( no error )
>>
>> but if I modifify a gpo a get an error
>>
>> Usually I use ga.admin user to log on RSAT tool which is member of
>> APAM-AD\domain admins group
>>
>> getent passwd ga.admin
>> APAM-AD\ga.admin:*:3000037:100::/home/APAM-AD/ga.admin:/bin/false
>>
>> groups ga.admin
>> ga.admin : users APAM-AD\ga.admin APAM-AD\domain admins
>> APAM-AD\denied rodc password replication group BUILTIN\administrators
>> BUILTIN\users
>>
>> getent group Domain\ users
>> APAM-AD\domain users:x:100:
> '100' is the Unix ID for the Unix group users, the idmap backend on a
> Samba AD DC maps Domain Users to the ID '100':
>
> dn: CN=S-1-5-21-627072207-2265849604-124128874-513
> cn: S-1-5-21-627072207-2265849604-124128874-513
> objectClass: sidMap
> objectSid: S-1-5-21-627072207-2265849604-124128874-513
> type: ID_TYPE_GID
> xidNumber: 100
> distinguishedName: CN=S-1-5-21-627072207-2265849604-124128874-513
>
>> The primary group of ga.admin is Domain users and when I modify the
>> policy it change owner:group
>>
>> from APAM-AD\domain admins : APAM-AD\domain admins
>>
>> to  BUILTIN\Adminstrators : users
>>
>> and sysvolcheck fails
>>
>> Should ga.admin have APAM-AD\domain admins as primary group instead
>> of Domain users ?
> Not sure doing that would help, you would have to add ga.admin to
> Domain Users or Windows will complain and I think the group would still
> get changed to 'users'. Could this be an inheritance problem ?
>
> Rowland
>
Hello Rowland,

I try to use Administrator user to modifiy a policy and got same result

before modification sysvolcheck ok and

-rwxrwx---+ 1 APAM-AD\domain admins APAM-AD\domain admins 2766  8 set 
11.45 
/var/lib/samba/sysvol/apam-ad.apam.lan/Policies/31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol

and after modification

-rwxrwx---+ 1 BUILTIN\administrators users 2766  9 set 17.41 
/var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol

and sysvolcheck fail

samba-tool ntacl sysvolcheck
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - 
ProvisioningError: DB ACL on GPO file /var/lib/sa 
mba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol 
O:BAG:DUD:(A;;FA;;;DA)(A; 
;FA;;;EA)(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;AU)(A;;0x1200a9;;;ED) 
does not match expected value O:DAG:DAD:P(A;OICI;FA; 
;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) 
from GPO object


Shoud sysvol share need a special security permission configuration ?

now is:

authenticated users ( read execute, view folder, read )

Administrators ( all except special authorization )

Server operator ( same as authenticated users )

System ( all except special authorization )


Thank you