[Samba] after edit gpo with RSAT sysvol acls are invalid

[Rowland Penny]

On Wed, 9 Sep 2026 18:02:19 +0200
Giuseppe Arvati via samba <samba at lists.samba.org> wrote:

> 
> I try to use Administrator user to modifiy a policy and got same
> result
> 
> before modification sysvolcheck ok and
> 
> -rwxrwx---+ 1 APAM-AD\domain admins APAM-AD\domain admins 2766  8 set 
> 11.45 
> /var/lib/samba/sysvol/apam-ad.apam.lan/Policies/31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol
> 
> and after modification
> 
> -rwxrwx---+ 1 BUILTIN\administrators users 2766  9 set 17.41 
> /var/lib/samba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol

Are you trying to modify one of the default policies ?
If so, can I suggest you stop and try creating a new policy instead.

> 
> and sysvolcheck fail
> 
> samba-tool ntacl sysvolcheck
> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
> exception - ProvisioningError: DB ACL on GPO file /var/lib/sa 
> mba/sysvol/apam-ad.apam.lan/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol 
> O:BAG:DUD:(A;;FA;;;DA)(A; 
> ;FA;;;EA)(A;;FA;;;BA)(A;;FA;;;SY)(A;;0x1200a9;;;AU)(A;;0x1200a9;;;ED) 
> does not match expected value O:DAG:DAD:P(A;OICI;FA; 
> ;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) 
> from GPO object
> 

You have been focusing on the owner:group , but the ACEs are also
totally different, though this could just be that you are modifying one
of the default policies and this is not to be recommended.

Rowland