Re: Access denied on GPO after "ntacl sysvolreset"

On Tue, 14 Apr 2026 11:51:27 +0200
Klaas TJEBBES via samba <[email protected]> wrote:

> root@addc:~# samba-tool ntacl get 
> "/var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/{168E5E09-529C-4947-84BE-DD3410700CBE}/Machine/Preferences" 
> --as-sddl
> O:DAG:DAD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;DA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;;;AU)(A;OICI;0x1200a9;;;ED)

That is the correct ACL and if we break it down, it becomes:

O:LA
G:BA
D:P
(A;OICI;FA;;;BA)
(A;OICI;0x1200a9;;;SO)
(A;OICI;FA;;;SY)
(A;OICI;0x1200a9;;;AU)

A brief explanation of what that all means:

The owner is 'LA'
The group is 'BA'
The DACL is PROTECTED
Each individual ACE is surrounded by a pair of braces '(.....)' and each ACE is separated by commas.

In the ACES:
A = ACCESS_ALLOWED
OI = OBJECT_INHERIT
CI = CONTAINER_INHERIT
FA = FILE_ALL
0x1200a9 = GRGX
GR = GENERIC_READ
GX = GENERIC_EXECUTE

LA = LOCAL_ADMIN
BA = BUILTIN_ADMINISTRATORS
SO = SERVER_OPERATORS
SY = LOCAL_SYSTEM
AU = AUTHENTICATED_USERS

So from that, Windows sees the file ownership as
LOCAL_ADMIN:BUILTIN_ADMINISTRATORS and on a Samba AD DC they are mapped
to the root user & group, but beware, you will come across GPOs owned
by Domain Admins (O:DA) which is a group. Windows sees that members of
the Administrators group are allowed access with full control, members
of the Server Operators group (SID S-1-5-32-549) are allowed access with
read & execute permissions, The local system (i.e. the computer)  is
allowed access with full control and Authenticated Users are allowed
access with read & execute permissions.

I hope you understand this so far.

The thing is, when you use Samba with Extended Attributes, Samba takes
the standard Unix 'ugo' permissions and any permissions you set via
setfacl into account and tries to alter the permissions that windows
sees in its EA. It also takes into account anything you add to a share,
this one of the reasons why you should not add anything to a share on a
Samba AD DC (including the netlogon and sysvol shares) and why you
really should set permissions from a Windows machine.

Each directory under 'sysvol' has it own set of ACEs and these are the
ones that you should be looking at with samba-tool and you should
ignore the ouput of ls and getfacl and you should definitely never
attempt to set permissions on anything under 'sysvol' with setfacl.

There is also the problem of idmap.ldb , this is where Samba 'maps'
SIDs to Unix IDs, usually in the '3000000' range unless you add RFC2307
attributes (and I am less & less convinced you need them, Samba like
Windows really uses the SID). The main problem is that Samba maps the
SIDs on a first come basis and you cannot guarantee that they will turn
up in exactly the same order on each DC, hence a user or group can have
a different Unix ID on each DC unless you copy idmap.ldb from your
first DC to any others.

Any questions ?

Rowland



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba