Re: Access denied on GPO after "ntacl sysvolreset"

On Thu, 16 Apr 2026 12:12:28 +0100
Rowland Penny via samba <[email protected]> wrote:

> 
> Well, I am at loss here, if I do what you have posted, add a
> totally bogus ini file to a GPO via the GPMC, it works for myself.
> 
> If I 'cat' the file on the DC, I get this:
> 
> sudo cat
> /var/lib/samba/sysvol/samdom.example.com/Policies/{EA6FE93A-E885-4083-AE7E-56F94897A573}/Machine/Preferences/IniFiles/IniFiles.xml
> 
> <?xml version="1.0" encoding="utf-8"?>
> <IniFiles clsid="{694C651A-08F2-47fa-A427-34C4F62BA207}"><Ini
> clsid="{EEFACE84-D3D8-4680-8D4B-BF103E759448}" name="derf"
> status="derf" image="2" changed="2026-04-16 10:53:21"
> uid="{A90C1544-78CF-4D71-AF88-FF5C6FB1906D}"><Properties
> path="ini.txt" section="fred" value="" property="derf"
> action="U"/></Ini> </IniFiles>
> 
> I am struggling to know what else to suggest.
> I am running Samba 4.23.6 from backports on Debian 13, but I do not
> think the Samba version has anything to do with your problem.
> 
> Do you have the attr and acl packages installed ?
> Is apparmor getting in the way ?
> Is there a firewall and could this be stopping something ?
> What filesystem are you using ?
> 
> Rowland
> 

And then I realised that I hadn't done one thing that you had, run
sysvolcheck on the DC:

This look familiar:

sudo samba-tool ntacl sysvolcheck
ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO directory /var/lib/samba/sysvol/samdom.example.com/Policies/{EA6FE93A-E885-4083-AE7E-56F94897A573}/Machine/Scripts/Shutdown O:BAG:DUD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) does not match expected value O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) from GPO object
  File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 387, in _run
    return self.run(*args, **kwargs)
           ~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py", line 484, in run
    provision.checksysvolacl(samdb, netlogon, sysvol,
    ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
                             domain_sid,
                             ^^^^^^^^^^^
                             lp.get("realm").lower(), samdb.domain_dn(),
                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                             lp)
                             ^^^
  File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1885, in checksysvolacl
    check_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp,
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                   direct_db_access)
                   ^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1835, in check_gpos_acl
    check_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp,
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                  domainsid, direct_db_access)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1801, in check_dir_acl
    raise ProvisioningError('%s ACL on GPO directory %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl, acl))

Which boils down to sysvolcheck getting this back from the directory:

O:BAG:DUD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)

And it expected this:

O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)

Which if you look carefully at the ACEs, among what it got was this:
(A;;FA;;;BA)

and it expected this:
(A;OICI;FA;;;DA)

All the other ACES are the same, but the two aces above are in a
slightly different order, but I do not think this matters.

OI means the object inherits permissions from above and CI means the
container inherits permissions from above, but the 'P' in 'D:P('
prevents the DACLs security descriptor being modified by inheritable
ACEs.
The two different ACEs allow access by two different groups, changing
the GPO from Windows uses 'BA' which is BUILTIN\Administrators, but
sysvolcheck expects 'DA', Domain Admins, not that this a problem,
because of Windows nested groups, Domain Admins is a member of
BUILTIN\Administrators.

Someone a lot smarter than me needs to fix sysvolreset/syslvolcheck,
they do not seem to work with new GPOs. In the meantime, I would
suggest only running sysvolreset and sysvolcheck on new installs where
there are no extra GPOs. Then create GPOs on Windows, that must know
the correct ACLs to use.

Rowland




-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba