Bug 14712 - GPO restored via samba-tool don't Copy or Backup in RSAT (invalid directory)
Summary: GPO restored via samba-tool don't Copy or Backup in RSAT (invalid directory)
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.11.6
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
Depends on:
Reported: 2021-05-21 13:59 UTC by klaas.tjebbes
Modified: 2021-05-25 04:15 UTC (History)
1 user (show)

See Also:

screenshots showing success and error (123.87 KB, image/png)
2021-05-21 13:59 UTC, klaas.tjebbes
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description klaas.tjebbes 2021-05-21 13:59:25 UTC
Created attachment 16621 [details]
screenshots showing success and error

* On Windows, using RSAT and create a new GPO named "test". Then modifiy it, change :
Computer Configuration -> Administrative Templates -> System -> Logon “Always Wait for the Network at Computer Startup and Logon” to “Enabled”

* On Samba AD-DC server :
samba-tool gpo listall
samba-tool gpo backup {84F33464-3199-48FE-80E4-2473B0BF9F49}
samba-tool gpo restore newtest /tmp/tmp8vpd5hvd/policy/\{84F33464-3199-48FE-80E4-2473B0BF9F49\}/ -U administrator --password=a

* On Windows, using RSAT, in "Group Policy Objects" :
right click on "newtest" and click "Copy"
right click on "Group Policy Objects" and click "Paste"

=> I get an error : "Invalid Directory".
=> also an error if I click "Backup" instead of "Copy" when right-clicking on "test" in the step above.

I was not able to figure out on the Windows side why, even using Powershell, debug and trace tools.

* However, I found that :
cd /home/sysvol/domseth.ac-test.fr/Policies/\{84F33464-3199-48FE-80E4-2473B0BF9F49\}/ # "test" GPO directory
getfattr -d -n user.DOSATTRIB -R . > ../test.attrs
cd ../\{6AC1786C-016F-11D2-945F-00C04FB984F9\}/ # "newtest" GPO directory
setfattr --restore=../test.attrs

I've played by editing "test.attrs" and searching which file(s) or directory(s) cause the problem...sometimes on file, sometimes a directory, not always the same...weird.

To be taken with care : I also found that if on Windows computer I leave RSAT open on the GPOs, and backup/restore on Samba server side, back to RSAT, "newtest" does not appear even if I click the little refresh icon (green circle arrows), I thus restart RSAT and then ! It works, "newtest" can be Copied or Backuped.

Attached, an image of two screenshots showing on top when "Copy" works on "test" and below when "Copy" fails on "newtest"

Here some informations on the Samba server and Windows OS used.

Windows 10 20.H2 up-to-date, fresh install.

root@dc1:~# cat /etc/lsb-release 

root@dc1:~# dpkg -l|grep samba
ii  python3-samba                        2:4.11.6+dfsg-0ubuntu1.8          amd64        Python 3 bindings for Samba
ii  samba                                2:4.11.6+dfsg-0ubuntu1.8          amd64        SMB/CIFS file, print, and login server for Unix
ii  samba-common                         2:4.11.6+dfsg-0ubuntu1.8          all          common files used by both the Samba server and client
ii  samba-common-bin                     2:4.11.6+dfsg-0ubuntu1.8          amd64        Samba common files used by both the server and the client
ii  samba-dsdb-modules:amd64             2:4.11.6+dfsg-0ubuntu1.8          amd64        Samba Directory Services Database
ii  samba-libs:amd64                     2:4.11.6+dfsg-0ubuntu1.8          amd64        Samba core libraries
ii  samba-vfs-modules:amd64              2:4.11.6+dfsg-0ubuntu1.8          amd64        Samba Virtual FileSystem plugins
Comment 1 klaas.tjebbes 2021-05-21 14:14:47 UTC
An error in the description, I don't know how to edit it.

It should be "newtest" instead of "test" in the sentence :
=> also an error if I click "Backup" instead of "Copy" when right-clicking on "newtest" in the step above.