Re: Access denied on GPO after "ntacl sysvolreset"

On Tue, 14 Apr 2026 16:24:43 +0200
Klaas TJEBBES via samba <[email protected]> wrote:

> > I did :
> > * remove all ACLs and default ACLs on /var/lib/samba/sysvol/
> > (setfacl - Rbk /var/lib/samba/sysvol/)
> > * chown root:root /var/lib/samba/sysvol/ -R
> > * samba-tool ntacl sysvolreset

Every Samba AD DC has two default GPOs,
{31B2F340-016D-11D2-945F-00C04FB984F9} &
{6AC1786C-016F-11D2-945F-00C04FB984F9}. They should be virtually empty
and should not be touched (always create new GPOs), so it should be
easy to manually reset those.

Your idea to change the ownership to root:root wasn't quite correct,
the group initially should have been 'BUILTIN\administrators', then
'BUILTIN\Domain Admins', I suggest you try this:

NOTE: while it should reset Sysvol to the defaults, it requires the
libnss links to be set up, along with /etc/nsswitch.conf and you do
this at your own risk.

First remove any extended ACLs:

sudo setfacl -b -R /var/lib/samba/sysvol

Now change the ownership of Sysvol and the default directories and
files under it (replace samba.home.arpa with your dns domain):

sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol
sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol/samba.home.arpa
sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol/samba.home.arpa/Policies
sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol/samba.home.arpa/scripts
sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}
sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI
sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE
sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/USER
sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}
sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/GPT.INI
sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/MACHINE
sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/USER

Set the default permissions on Sysvol:

sudo chmod -R 0770 /var/lib/samba/sysvol

Finally use samba-tool to rest the Windows ACLs on Sysvol:

sudo samba-tool ntacl sysvolreset
sudo samba-tool ntacl sysvolcheck

The last command should not produce an error.

Good luck.

Rowland

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba