Re: sysvolcheck problem after any changes in gpedit

Piotr Adamcio via samba <[email protected]> wrote:

> Every time I modify smth in gpmc.msc   from a Windows workstation, the
> ACLs in the SYSVOL directory become corrupted. Consequently, clients
> stop applying policies, and |samba-tool ntacl sysvolcheck| starts
> reporting errors.


Yes, this happens consistently, in my case over a number of domains and
functional levels. Any change to the sysvol by gpmc.msc results in samba-tool
ntacl sysvolcheck complaining until you run sysvolreset.
Side-by-side comparison of the ACL's that appear in the output of
sysvolcheck:

$ diff -y actual expected
O:DAG:DAD:PAI               | O:DAG:DAD:PAR
(A;OICI;FA;;;DA)              (A;OICI;FA;;;DA)
(A;OICI;FA;;;EA)              (A;OICI;FA;;;EA)
(A;OICIIO;FA;;;CO)            (A;OICIIO;FA;;;CO)
(A;OICI;FA;;;DA)              (A;OICI;FA;;;DA)
(A;OICI;FA;;;SY)              (A;OICI;FA;;;SY)
(A;OICI;0x1200a9;;;ED)        (A;OICI;0x1200a9;;;ED)
(A;OICI;0x1200a9;;;AU)        (A;OICI;0x1200a9;;;AU)
(A;OICI;0x1200a9;;;DC)        (A;OICI;0x1200a9;;;DC)
                           >
(OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;DC)
$ samba --version
Version 4.22.6-Debian-4.22.6+dfsg-0+deb13u1~bpo12+1

Work around this by setting up that cron job.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba