Re: Access denied on GPO after "ntacl sysvolreset"

On Wed, 15 Apr 2026 20:25:40 +0200
Klaas TJEBBES via samba <[email protected]> wrote:

> 
> 
> Le 15/04/2026 à 11:13, Rowland Penny via samba a écrit :
> > On Tue, 14 Apr 2026 16:24:43 +0200
> > Klaas TJEBBES via samba <[email protected]> wrote:
> > 
> >>> I did :
> >>> * remove all ACLs and default ACLs on /var/lib/samba/sysvol/
> >>> (setfacl - Rbk /var/lib/samba/sysvol/)
> >>> * chown root:root /var/lib/samba/sysvol/ -R
> >>> * samba-tool ntacl sysvolreset
> > 
> > Every Samba AD DC has two default GPOs,
> > {31B2F340-016D-11D2-945F-00C04FB984F9} &
> > {6AC1786C-016F-11D2-945F-00C04FB984F9}. They should be virtually
> > empty and should not be touched (always create new GPOs), so it
> > should be easy to manually reset those.
> > 
> > Your idea to change the ownership to root:root wasn't quite correct,
> > the group initially should have been 'BUILTIN\administrators', then
> > 'BUILTIN\Domain Admins', I suggest you try this:
> > 
> > NOTE: while it should reset Sysvol to the defaults, it requires the
> > libnss links to be set up, along with /etc/nsswitch.conf and you do
> > this at your own risk.
> > 
> > First remove any extended ACLs:
> > 
> > sudo setfacl -b -R /var/lib/samba/sysvol
> > 
> > Now change the ownership of Sysvol and the default directories and
> > files under it (replace samba.home.arpa with your dns domain):
> > 
> > sudo chown root:BUILTIN\\administrators /var/lib/samba/sysvol
> > sudo chown root:BUILTIN\\administrators
> > /var/lib/samba/sysvol/samba.home.arpa sudo chown
> > root:BUILTIN\\administrators
> > /var/lib/samba/sysvol/samba.home.arpa/Policies sudo chown
> > root:BUILTIN\\administrators
> > /var/lib/samba/sysvol/samba.home.arpa/scripts sudo chown
> > root:BUILTIN\\domain\ admins
> > /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}
> > sudo chown root:BUILTIN\\domain\ admins
> > /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI
> > sudo chown root:BUILTIN\\domain\ admins
> > /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE
> > sudo chown root:BUILTIN\\domain\ admins
> > /var/lib/samba/sysvol/samba.home.arpa/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/USER
> > sudo chown root:BUILTIN\\domain\ admins
> > /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}
> > sudo chown root:BUILTIN\\domain\ admins
> > /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/GPT.INI
> > sudo chown root:BUILTIN\\domain\ admins
> > /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/MACHINE
> > sudo chown root:BUILTIN\\domain\ admins
> > /var/lib/samba/sysvol/samba.home.arpa/Policies/{6AC1786C-016F-11D2-945F-00C04FB984F9}/USER
> > 
> > Set the default permissions on Sysvol:
> > 
> > sudo chmod -R 0770 /var/lib/samba/sysvol
> > 
> > Finally use samba-tool to rest the Windows ACLs on Sysvol:
> > 
> > sudo samba-tool ntacl sysvolreset
> > sudo samba-tool ntacl sysvolcheck
> > 
> > The last command should not produce an error.
> > 
> > Good luck.
> > 
> > Rowland
> > 
> 
> I've run all your procedure.
> 
> Then I re-did my test : RSAT > Edit GPO > Computer configuration > 
> Preference > INI file > New > Ini File.
> It returns still the same "Access Denied" error.
> 
> So I went ahead and reinstalled everything, OS and Samba (AD 
> provisioning, KRB5, nsswitch, etc.). I did not modify ACLs nor from 
> Linux, nor from Windows. Result is still the same, I still get the
> same "Access Denied" error when :
> * Create an empty GPO in RSAT
> * run 'samba-tool ntacl sysvolreset'
> * edit and modify the GPO, for example by adding an INI File
> preference. => I get "Access Denied" error.
> 
> Whereas if I do :
> * Create an empty GPO in RSAT
> * edit and modify the GPO, for example by adding an INI File
> preference. I do not get any error. If I run 'sysvolreset' between
> those steps I'll get an error.
> 

Well, I am at loss here, if I do what you have posted, add a
totally bogus ini file to a GPO via the GPMC, it works for myself.

If I 'cat' the file on the DC, I get this:

sudo cat /var/lib/samba/sysvol/samdom.example.com/Policies/{EA6FE93A-E885-4083-AE7E-56F94897A573}/Machine/Preferences/IniFiles/IniFiles.xml

<?xml version="1.0" encoding="utf-8"?>
<IniFiles clsid="{694C651A-08F2-47fa-A427-34C4F62BA207}"><Ini clsid="{EEFACE84-D3D8-4680-8D4B-BF103E759448}" name="derf" status="derf" image="2" changed="2026-04-16 10:53:21" uid="{A90C1544-78CF-4D71-AF88-FF5C6FB1906D}"><Properties path="ini.txt" section="fred" value="" property="derf" action="U"/></Ini>
</IniFiles>

I am struggling to know what else to suggest.
I am running Samba 4.23.6 from backports on Debian 13, but I do not
think the Samba version has anything to do with your problem.

Do you have the attr and acl packages installed ?
Is apparmor getting in the way ?
Is there a firewall and could this be stopping something ?
What filesystem are you using ?

Rowland




-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba