Re: Access denied on GPO after "ntacl sysvolreset"

Le 15/04/2026 à 11:13, Rowland Penny via samba a écrit :
> On Tue, 14 Apr 2026 16:24:43 +0200
> Klaas TJEBBES via samba <[email protected]> wrote:
> 
>>> I did :
>>> * remove all ACLs and default ACLs on /var/lib/samba/sysvol/
>>> (setfacl - Rbk /var/lib/samba/sysvol/)
>>> * chown root:root /var/lib/samba/sysvol/ -R
>>> * samba-tool ntacl sysvolreset
> 
> Every Samba AD DC has two default GPOs,
> {31B2F340-016D-11D2-945F-00C04FB984F9} &
> {6AC1786C-016F-11D2-945F-00C04FB984F9}. They should be virtually empty
> and should not be touched (always create new GPOs), so it should be
> easy to manually reset those.
> 
> Your idea to change the ownership to root:root wasn't quite correct,
> the group initially should have been 'BUILTIN\administrators', then
> 'BUILTIN\Domain Admins', I suggest you try this:
> 
> NOTE: while it should reset Sysvol to the defaults, it requires the
> libnss links to be set up, along with /etc/nsswitch.conf and you do
> this at your own risk.
> 
> First remove any extended ACLs:
> 
> sudo setfacl -b -R /var/lib/samba/sysvol
> 
> Now change the ownership of Sysvol and the default directories and
> files under it (replace samba.home.arpa with your dns domain):
> 
> sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol
> sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol/samba.home.arpa
> sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol/samba.home.arpa/Policies
> sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol/samba.home.arpa/scripts
> sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}
> sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI
> sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE
> sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/USER
> sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}
> sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/GPT.INI
> sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/MACHINE
> sudo chown root:BUILTIN\\domain\ admins /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/USER
> 
> Set the default permissions on Sysvol:
> 
> sudo chmod -R 0770 /var/lib/samba/sysvol
> 
> Finally use samba-tool to rest the Windows ACLs on Sysvol:
> 
> sudo samba-tool ntacl sysvolreset
> sudo samba-tool ntacl sysvolcheck
> 
> The last command should not produce an error.
> 
> Good luck.
> 
> Rowland
> 

I've run all your procedure.

Then I re-did my test : RSAT > Edit GPO > Computer configuration > 
Preference > INI file > New > Ini File.
It returns still the same "Access Denied" error.

So I went ahead and reinstalled everything, OS and Samba (AD 
provisioning, KRB5, nsswitch, etc.). I did not modify ACLs nor from 
Linux, nor from Windows. Result is still the same, I still get the same 
"Access Denied" error when :
* Create an empty GPO in RSAT
* run 'samba-tool ntacl sysvolreset'
* edit and modify the GPO, for example by adding an INI File preference. 
=> I get "Access Denied" error.

Whereas if I do :
* Create an empty GPO in RSAT
* edit and modify the GPO, for example by adding an INI File preference.
I do not get any error. If I run 'sysvolreset' between those steps I'll 
get an error.


root@addc:~# samba-tool ntacl get 
/var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/\{50109C01-DC5E-4166-B927-80EA1AF51E21\}/Machine 
--as-sddl
O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;edacfd8f-ffb3-11d1-b41d-00a0c968f939;;AU)(A;OICI;0x1200a9;;;ED)

root@addc:~# samba-tool ntacl get 
/var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/\{50109C01-DC5E-4166-B927-80EA1AF51E21\}/Machine/Preferences 
--as-sddl
O:BAG:DUD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(OA;OICI;;;;AU)(A;OICI;0x1200a9;;;ED)

 From Windows, I got to 
\\<server>\sysvol\<domain>\Policies\{50109C01-DC5E-4166-B927-80EA1AF51E21}\Machine 
I can create a new directory "testdir". Then I go in that "testdir", 
there, I canNOT create a new directory.
There seems to be something wrong with permissions inheritance.



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba