we noticed a strange behavior change between samba version 4.16.11 and 4.17.0-rc1 and newer with samba-tool ntacl sysvol-reset.
When editing delegations are placed on a gpo for a group, the system acls are correctly placed by RSAT but a "samba-tool ntacl sysvol-reset" deletes them.
This problematic commit seems to be :
When we revert it works again.
*** This bug has been marked as a duplicate of bug 14927 ***