I've been having issues with my sysvol, specifically it seems like https://bugzilla.samba.org/show_bug.cgi?id=14927 is showing up. Immediately after executing sysvolreset a sysvolcheck will fail with an error like this: ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO directory /var/lib/samba/sysvol/redacted.domain.internal/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9} O:LAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) does not match expected value O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) from GPO object File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 388, in _run return self.run(*args, **kwargs) ~~~~~~~~^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py", line 484, in run provision.checksysvolacl(samdb, netlogon, sysvol, ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^ domain_sid, ^^^^^^^^^^^ lp.get("realm").lower(), samdb.domain_dn(), ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ lp) ^^^ File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1890, in checksysvolacl check_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp, ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ direct_db_access) ^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1840, in check_gpos_acl check_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp, ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ domainsid, direct_db_access) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1783, in check_dir_acl raise ProvisioningError('%s ACL on GPO directory %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), path, fsacl_sddl, acl)) I'm running Samba 4.24.4 on Debian. Since the bug mentioned reports being fixed in 4.23+ I'm not sure it really is the same. Also I'm not noticing the RSAT GPMC error often mentioned (I did on a previous setup but not on this version). GPOs work and apply fine. They seem a bit finicky but GPOs are always finicky so maybe that's expected. Like with some other 14927 duplicates it will work when using --use-ntvfs but since that's not supported I expect other issues would crop up. My smb.conf below: # Global parameters [global] ad dc functional level = 2016 dns forwarder = 192.168.0.1 netbios name = SDC realm = REDACTED.DOMAIN.INTERNAL server role = active directory domain controller tls certfile = /etc/letsencrypt/live/dc2.redacted.domain.internal/fullchain.pem tls enabled = yes tls keyfile = /etc/letsencrypt/live/dc2.redacted.domain.internal/privkey.pem workgroup = REDACTED idmap_ldb:use rfc2307 = yes [sysvol] path = /var/lib/samba/sysvol read only = No [netlogon] path = /var/lib/samba/sysvol/dc2.redacted.domain.internal/scripts read only = No
(In reply to Julian Roßbach from comment #0) Can we just check something here ? You have in your smb.conf file, the following settings: netbios name = SDC realm = REDACTED.DOMAIN.INTERNAL path = /var/lib/samba/sysvol/dc2.redacted.domain.internal/scripts Does your DC have the short hostname 'dc2' ? If so why is the 'netbios name' set to 'SDC' ? Then in the python error output, there is this: DB ACL on GPO directory /var/lib/samba/sysvol/redacted.domain.internal/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9} Is the path in the netlogon part of the smb.conf file correct ? This could all just be bad sanitisation, but lets clear that up first.
(In reply to Rowland Penny from comment #1) Yes it is bad sanitisation. Both are errors made while copy-pasting. The real smb.conf does not have these errors. NetBIOS and DNS are matching and netlogon points to the correct dir.
(In reply to Julian Roßbach from comment #2) OK, if you look carefully at the two ACLs in the error, it is only different by one letter, the start of the found ACL is 'O:LAG:DA', but it expects 'O:DAG:DA' If we break that down, the 'O' stands for owner and 'LA' stands for 'Local Administrator' and 'DA' is 'Domain Admins', the 'G' stands for 'group'. I can think of one reason why this could be happening (there are probably others), you have given 'Domain Admins' a gidNumber. This, along with 'idmap_ldb:use rfc2307 = yes' in your smb.conf file, turns 'Domain Admins' into a Unix group. You are probably now thinking, 'what, Domain Admins is a group', well yes, but on a Samba AD DC it is a special group because it has to be. A Windows group can do something no Unix group can do, it can 'own' things. On a Samba AD DC this is allowed by mapping groups like Domain Admins to 'ID_TYPE_BOTH', making a group also a user. If you give Domain Admins a gidNumber, it breaks this mapping and as the group is not a user, sysvol gets 'root' aka 'Local Administrator' as the owner. If this is your case, you have two choices, remove the gidnumber from Domain Admins, or remove 'idmap_ldb:use rfc2307 = yes' from your smb.conf file. The former will just affect Domain Admins, the latter will affect all users, groups etc.
(In reply to Rowland Penny from comment #3) God, I was just thinking "I've read this somewhere don't I??". I did, what you just wrote is (courtesy of yourself) on the wiki page https://wiki.samba.org/index.php/Sysvolreset I just actively ignored it since the wiki tells one to. I don't actually actively use Domain Admins as a UNIX group, I just gave it an ID while I was at giving IDs to all built in Groups/Users that seemed important. I will report back once I've removed the ID
(In reply to Rowland Penny from comment #3) This worked. Removing the UNIX group from Domain Admins and doing another reset removed the error. But it still gives me that warm fuzzy feeling you get when one set of instructions tells you to ignore the other. Maybe the wiki should be updated in that regard? Either put the existing warning on a different page (the rfc2307 one?) or change the obsolote warning on the existing page.
(In reply to Julian Roßbach from comment #5) I have updated the wiki in a couple of places, hopefully this will help. Can I suggest that you raise things like this on the samba mailing list before opening a bug report in future.
(In reply to Rowland Penny from comment #6) Thank you, I will do that in the future.