Re: sysvolcheck problem after any changes in gpedit

sysvol, and idmap.ldb should be synced. See:

http://samba.bigbird.es/doku.php?id=samba:sync-idmap.ldb

Also, you should cron this on the PDC emulator FSMO owner at lest (no harm to do in others too):

if ! samba-tool ntacl sysvolcheck; then samba-tool ntacl sysvolreset; fi

To run every so often.
On Mar 8, 2026 at 20:13 +0000, Piotr Adamcio via samba <[email protected]>, wrote:
> I am experiencing a persistent issue with permission preservation in the
> SYSVOL directory on a Samba AD DC (Functional Level 2016). From that AD
> I replicate data (Sysvol and Idmap) to other Domain Controllers using
> |rsync|.
>
> Every time I modify smth in gpmc.msc   from a Windows workstation, the
> ACLs in the SYSVOL directory become corrupted. Consequently, clients
> stop applying policies, and |samba-tool ntacl sysvolcheck| starts
> reporting errors.
>
> The only current workaround is to manually run |samba-tool ntacl
> sysvolreset| after every single GPO change. Once executed, everything
> returns to normal, and |rsync| successfully replicates the corrected
> data to the remaining DCs. This is highly frustrating as every group
> policy  operation requires manual shell intervention on the server.
>
> *OS:* Debian 12
>
> *File System:* BTRFS (mounted on /) - everything on one partition
>
> SAMBA 4.22
>
> *Current smb.conf:*
>
> |[global]|
>
> |ad dc functional level = 2016 server role = active directory domain
> controller realm = AAA.LAN workgroup = AAA netbios name = DC01 winbind
> enum users = yes winbind enum groups = yes [sysvol] path =
> /var/lib/samba/sysvol read only = No [netlogon] path =
> /var/lib/samba/sysvol/aaa.lan/scripts read only = No|
>
> I would appreciate any suggestions on how to stabilize SYSVOL
> permissions in this environment.
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions: https://lists.samba.org/mailman/options/samba
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba