Samba RODC 4.22.6 (debian 13) seems writeable...

Hello,

We are testing a small samba DC deployment. The target will be to provide RODCs to our subsidiaries, possibly running Samba on linux.

It consists of a Windows DC (2016), a couple of Samba RWDC (Debian 13, samba 4.22.6-Debian-4.22.6+dfsg-0+deb13u1) and a single Samba RODC (same version).

(Note: each Samba is in a Debian 13 virtual machine, but installed as a docker app, with a docker image built "by hand" starting with a debian:trixie and then an apt-get install samba )

Everything is in the same subnet, in the same Active Directory site for simplicity.

Everything works fine, it replicates ok, sysvols are ok, DNS is ok, either in windows or in linux samba. Kerberos is ok. FSMO are all on a Samba RWDC.
Functional level is windows 2016. 1 single forest with a single domain, created first in the Windows DC , then I joined the Sambas.

My issue is that when connected to a Windows client (either a win11 PC or in RDP on the windows DC), when I do modifications / creations / deletions with ADUC pointing to the RODC,
I have an error message (for example "windows cannot delete object XXX because there is no such object on the server"), but the modification / deletion / creation is applied...

The RODC has been joined to the domain with a DOCKER JOIN RODC, pointing on the windows server.
It appears a RODC in windows.

The smb.conf on the RODC, the only difference is that I put read-only in sysvol and netlogon.

[global]
  workgroup = SAMBADEV
  realm = sambadev.vccs
  netbios name = samba-rodc2
  server role = active directory domain controller
  ad dc functional level = 2016


[sysvol]
  path = /var/lib/samba/sysvol
  read only = yes


[netlogon]
  path = /var/lib/samba/sysvol/sambadev.vccs/scripts
  read only = yes

Have I missed something to prevent writing to it?

If docker is an issue, no problem, I can remove the docker rodc and apt-get install directly in the VM, but it was to be able to remove it a bit cleaner.

If anybody had an idea, thank you,

Antoine
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba