sysvolcheck problem after any changes in gpedit

I am experiencing a persistent issue with permission preservation in the 
SYSVOL directory on a Samba AD DC (Functional Level 2016). From that AD 
I replicate data (Sysvol and Idmap) to other Domain Controllers using 
|rsync|.

Every time I modify smth in gpmc.msc   from a Windows workstation, the 
ACLs in the SYSVOL directory become corrupted. Consequently, clients 
stop applying policies, and |samba-tool ntacl sysvolcheck| starts 
reporting errors.

The only current workaround is to manually run |samba-tool ntacl 
sysvolreset| after every single GPO change. Once executed, everything 
returns to normal, and |rsync| successfully replicates the corrected 
data to the remaining DCs. This is highly frustrating as every group 
policy  operation requires manual shell intervention on the server.

*OS:* Debian 12

*File System:* BTRFS (mounted on /) - everything on one partition

SAMBA 4.22

*Current smb.conf:*

|[global]|

|ad dc functional level = 2016 server role = active directory domain 
controller realm = AAA.LAN workgroup = AAA netbios name = DC01 winbind 
enum users = yes winbind enum groups = yes [sysvol] path = 
/var/lib/samba/sysvol read only = No [netlogon] path = 
/var/lib/samba/sysvol/aaa.lan/scripts read only = No|

I would appreciate any suggestions on how to stabilize SYSVOL 
permissions in this environment.

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba