Re: Access denied on GPO after "ntacl sysvolreset"

Le 14/04/2026 à 14:16, Klaas TJEBBES via samba a écrit :
> 
> 
> Le 14/04/2026 à 13:24, Rowland Penny via samba a écrit :
>> On Tue, 14 Apr 2026 11:51:27 +0200
>> Klaas TJEBBES via samba <[email protected]> wrote:
>>
>>> root@addc:~# samba-tool ntacl get
>>> "/var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/ 
>>> {168E5E09-529C-4947-84BE-DD3410700CBE}/Machine/Preferences"
>>> --as-sddl
>>> O:DAG:DAD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;DA) 
>>> (A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU) 
>>> (OA;OICI;;;;AU)(A;OICI;0x1200a9;;;ED)
>>
>> That is the correct ACL and if we break it down, it becomes:
>>
>> O:LA
>> G:BA
>> D:P
>> (A;OICI;FA;;;BA)
>> (A;OICI;0x1200a9;;;SO)
>> (A;OICI;FA;;;SY)
>> (A;OICI;0x1200a9;;;AU)
>>
>> A brief explanation of what that all means:
>>
>> The owner is 'LA'
>> The group is 'BA'
>> The DACL is PROTECTED
>> Each individual ACE is surrounded by a pair of braces '(.....)' and 
>> each ACE is separated by commas.
>>
>> In the ACES:
>> A = ACCESS_ALLOWED
>> OI = OBJECT_INHERIT
>> CI = CONTAINER_INHERIT
>> FA = FILE_ALL
>> 0x1200a9 = GRGX
>> GR = GENERIC_READ
>> GX = GENERIC_EXECUTE
>>
>> LA = LOCAL_ADMIN
>> BA = BUILTIN_ADMINISTRATORS
>> SO = SERVER_OPERATORS
>> SY = LOCAL_SYSTEM
>> AU = AUTHENTICATED_USERS
>>
>> So from that, Windows sees the file ownership as
>> LOCAL_ADMIN:BUILTIN_ADMINISTRATORS and on a Samba AD DC they are mapped
>> to the root user & group, but beware, you will come across GPOs owned
>> by Domain Admins (O:DA) which is a group. Windows sees that members of
>> the Administrators group are allowed access with full control, members
>> of the Server Operators group (SID S-1-5-32-549) are allowed access with
>> read & execute permissions, The local system (i.e. the computer)  is
>> allowed access with full control and Authenticated Users are allowed
>> access with read & execute permissions.
>>
>> I hope you understand this so far.
>>
>> The thing is, when you use Samba with Extended Attributes, Samba takes
>> the standard Unix 'ugo' permissions and any permissions you set via
>> setfacl into account and tries to alter the permissions that windows
>> sees in its EA. It also takes into account anything you add to a share,
>> this one of the reasons why you should not add anything to a share on a
>> Samba AD DC (including the netlogon and sysvol shares) and why you
>> really should set permissions from a Windows machine.
>>
>> Each directory under 'sysvol' has it own set of ACEs and these are the
>> ones that you should be looking at with samba-tool and you should
>> ignore the ouput of ls and getfacl and you should definitely never
>> attempt to set permissions on anything under 'sysvol' with setfacl.
>>
>> There is also the problem of idmap.ldb , this is where Samba 'maps'
>> SIDs to Unix IDs, usually in the '3000000' range unless you add RFC2307
>> attributes (and I am less & less convinced you need them, Samba like
>> Windows really uses the SID). The main problem is that Samba maps the
>> SIDs on a first come basis and you cannot guarantee that they will turn
>> up in exactly the same order on each DC, hence a user or group can have
>> a different Unix ID on each DC unless you copy idmap.ldb from your
>> first DC to any others.
>>
>> Any questions ?
> 
> Yes.
> 
> I have only one DC.
> 
> I did :
> * remove all ACLs and default ACLs on /var/lib/samba/sysvol/ (setfacl - 
> Rbk /var/lib/samba/sysvol/)
> * chown root:root /var/lib/samba/sysvol/ -R
> * samba-tool ntacl sysvolreset
> 
> Then I went to my GPO and tried to add a .INI File preference. It still 
> failed with "Acccess denied".
> 
> So I checked Windows ACLs :
> root@addc:~# samba-tool ntacl get --as-sddl /var/lib/samba/sysvol/ 
> domscribe.ac-test.fr/Policies/\{168E5E09-529C-4947-84BE-DD3410700CBE\}/ 
> Machine/Preferences
> O:DAG:DAD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;DA)(A;OICIIO;FA;;;CO) 
> (A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;;;AU)(A;OICI;0x1200a9;;;ED)
> 
> root@addc:~# samba-tool ntacl get --as-sddl /var/lib/samba/sysvol/ 
> domscribe.ac-test.fr/Policies/\{168E5E09-529C-4947-84BE-DD3410700CBE\}
> O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO) 
> (A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU) 
> (OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;OICI;0x1200a9;;;ED)
> 
> root@addc:~# samba-tool ntacl get --as-sddl /var/lib/samba/sysvol/ 
> domscribe.ac-test.fr/Policies/\{168E5E09-529C-4947-84BE-DD3410700CBE\}/ 
> Machine
> O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO) 
> (A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU) 
> (OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;OICI;0x1200a9;;;ED)
> 
>  From Windows, when I right clic => Properties => Security on the 
> "Preferences" folder of the GPO, I get : "the requested security 
> information is not available or cannot be displayed".
> 
> 
> What am I missing ?
> 

In addition.

You told me not to take into account POSIX rights and Unix ACLs, so I 
supposed samba only uses xattrs. But I noticed this (I absolutely don't 
know if it's normal/important or not, so I post it here in case it is) :

root@addc:~# chown root:root /var/lib/samba/sysvol/ -R

root@addc:~# setfacl -Rbk /var/lib/samba/sysvol/

root@addc:~# getfacl  /var/lib/samba/sysvol/
getfacl : suppression du premier « / » des noms de chemins absolus
# file: var/lib/samba/sysvol/
# owner: root
# group: root
user::rwx
group::rwx
other::---

root@addc:~# samba-tool ntacl sysvolreset

root@addc:~# getfacl  /var/lib/samba/sysvol/
getfacl : suppression du premier « / » des noms de chemins absolus
# file: var/lib/samba/sysvol/
# owner: root
# group: BUILTIN/administrators
user::rwx
user:root:rwx
user:BUILTIN/administrators:rwx
user:BUILTIN/server\040operators:r-x
user:NT\040Authority/system:rwx
user:NT\040Authority/authenticated\040users:r-x
group::rwx
group:BUILTIN/administrators:rwx
group:BUILTIN/server\040operators:r-x
group:NT\040Authority/system:rwx
group:NT\040Authority/authenticated\040users:r-x
mask::rwx
other::---
default:user::rwx
default:user:root:rwx
default:user:BUILTIN/administrators:rwx
default:user:BUILTIN/server\040operators:r-x
default:user:NT\040Authority/system:rwx
default:user:NT\040Authority/authenticated\040users:r-x
default:group::---
default:group:BUILTIN/administrators:rwx
default:group:BUILTIN/server\040operators:r-x
default:group:NT\040Authority/system:rwx
default:group:NT\040Authority/authenticated\040users:r-x
default:mask::rwx
default:other::---



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba