Created attachment 8758 [details] Output of the three runs of samba-tool dbcheck I have delegated the CN=Computer container to a group, so members of it can join computers to the domain. If I switch to 4.0.5 and then run the command # samba-tool dbcheck --reset-well-known-acls --fix it fixes many entries. After that, I still see this group on the CN=Computer container in ADUC, but members aren't able to join machines any more to the domain (access denied). If I run the command for the second time, again three fixes were done (one on CN=Computer again). Now the group was completely removed from the container (and of course can't join with members any more). If I run the command a third time, it says that nothing is to fix. Shouldn't be everything fixed at once?