Re: Access denied on GPO after "ntacl sysvolreset"

Le 16/04/2026 à 13:53, Rowland Penny via samba a écrit :
> On Thu, 16 Apr 2026 12:12:28 +0100
> Rowland Penny via samba <[email protected]> wrote:
> 
>>
>> Well, I am at loss here, if I do what you have posted, add a
>> totally bogus ini file to a GPO via the GPMC, it works for myself.
>>
>> If I 'cat' the file on the DC, I get this:
>>
>> sudo cat
>> /var/lib/samba/sysvol/samdom.example.com/Policies/{EA6FE93A-E885-4083-AE7E-56F94897A573}/Machine/Preferences/IniFiles/IniFiles.xml
>>
>> <?xml version="1.0" encoding="utf-8"?>
>> <IniFiles clsid="{694C651A-08F2-47fa-A427-34C4F62BA207}"><Ini
>> clsid="{EEFACE84-D3D8-4680-8D4B-BF103E759448}" name="derf"
>> status="derf" image="2" changed="2026-04-16 10:53:21"
>> uid="{A90C1544-78CF-4D71-AF88-FF5C6FB1906D}"><Properties
>> path="ini.txt" section="fred" value="" property="derf"
>> action="U"/></Ini> </IniFiles>
>>
>> I am struggling to know what else to suggest.
>> I am running Samba 4.23.6 from backports on Debian 13, but I do not
>> think the Samba version has anything to do with your problem.
>>
>> Do you have the attr and acl packages installed ?
>> Is apparmor getting in the way ?
>> Is there a firewall and could this be stopping something ?
>> What filesystem are you using ?
>>
>> Rowland
>>
> 
> And then I realised that I hadn't done one thing that you had, run
> sysvolcheck on the DC:
> 
> This look familiar:
> 
> sudo samba-tool ntacl sysvolcheck
> ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception - ProvisioningError: DB ACL on GPO directory /var/lib/samba/sysvol/samdom.example.com/Policies/{EA6FE93A-E885-4083-AE7E-56F94897A573}/Machine/Scripts/Shutdown O:BAG:DUD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) does not match expected value O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED) from GPO object
>    File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line 387, in _run
>      return self.run(*args, **kwargs)
>             ~~~~~~~~^^^^^^^^^^^^^^^^^
>    File "/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py", line 484, in run
>      provision.checksysvolacl(samdb, netlogon, sysvol,
>      ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
>                               domain_sid,
>                               ^^^^^^^^^^^
>                               lp.get("realm").lower(), samdb.domain_dn(),
>                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>                               lp)
>                               ^^^
>    File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1885, in checksysvolacl
>      check_gpos_acl(sysvol, dnsdomain, domainsid, domaindn, samdb, lp,
>      ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>                     direct_db_access)
>                     ^^^^^^^^^^^^^^^^^
>    File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1835, in check_gpos_acl
>      check_dir_acl(policy_path, dsacl2fsacl(acl, domainsid), lp,
>      ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>                    domainsid, direct_db_access)
>                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>    File "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line 1801, in check_dir_acl
>      raise ProvisioningError('%s ACL on GPO directory %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl, acl))
> 
> Which boils down to sysvolcheck getting this back from the directory:
> 
> O:BAG:DUD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)
> 
> And it expected this:
> 
> O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)
> 
> Which if you look carefully at the ACEs, among what it got was this:
> (A;;FA;;;BA)
> 
> and it expected this:
> (A;OICI;FA;;;DA)
> 
> All the other ACES are the same, but the two aces above are in a
> slightly different order, but I do not think this matters.
> 
> OI means the object inherits permissions from above and CI means the
> container inherits permissions from above, but the 'P' in 'D:P('
> prevents the DACLs security descriptor being modified by inheritable
> ACEs.
> The two different ACEs allow access by two different groups, changing
> the GPO from Windows uses 'BA' which is BUILTIN\Administrators, but
> sysvolcheck expects 'DA', Domain Admins, not that this a problem,
> because of Windows nested groups, Domain Admins is a member of
> BUILTIN\Administrators.
> 
> Someone a lot smarter than me needs to fix sysvolreset/syslvolcheck,
> they do not seem to work with new GPOs. In the meantime, I would
> suggest only running sysvolreset and sysvolcheck on new installs where
> there are no extra GPOs. Then create GPOs on Windows, that must know
> the correct ACLs to use.
> 
> Rowland
> 
> 
> 
> 

root@addc:~# dpkg -l|grep -E 'acl|attr'
ii  acl                            2.3.2-1build1.1 
amd64        access control list - utilities
ii  attr                           1:2.5.2-1build1.1 
amd64        utilities for manipulating filesystem extended attributes
ii  libacl1:amd64                  2.3.2-1build1.1 
amd64        access control list - shared library
ii  libattr1:amd64                 1:2.5.2-1build1.1 
amd64        extended attribute handling - shared library


The procedure to reproduce the bug I see is pretty simple :
* setup an ADDC Samba server
* join a Windows 11 client to the domain
* create an empty GPO via RSAT (that mean righr clic on "Group policy 
objects" => New, enter a name and clic "Ok")
* on the Samba DC run 'samba-tool ntacl sysvolreset'
* in RSAT edit newly created GPO (right clic on its name => "Edit")
* Go to "Computer configuration" > "Preferences" > "Windows parameters" 
 > "Ini files" and Create an new .ini file, enter a name, a section 
name, a key and a value
* At this point, when I clic "Ok", I get an access denied error.

This procedure should create several subdirectories and a file :
* Preferences/IniFiles/IniFiles.xml
under the directory "{<GPO_ID>}\Machine\"

But only the "Preferences" directory is created and its ACLs do not 
allow the creation of the sub-directory "IniFiles", thus don't allow the 
creation of "IniFiles.xml".

I know you told me not to look at it, but :

root@addc:~# getfacl 
/var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/\{50109C01-DC5E-4166-B927-80EA1AF51E21\}/Machine
getfacl : suppression du premier « / » des noms de chemins absolus
# file: 
var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/{50109C01-DC5E-4166-B927-80EA1AF51E21}/Machine
# owner: DOMSCRIBE/domain\040admins
# group: DOMSCRIBE/domain\040admins
user::rwx
user:root:rwx
user:BUILTIN/administrators:rwx
user:BUILTIN/server\040operators:r-x
user:NT\040Authority/system:rwx
user:NT\040Authority/authenticated\040users:r-x
group::rwx
group:BUILTIN/administrators:rwx
group:BUILTIN/server\040operators:r-x
group:NT\040Authority/system:rwx
group:NT\040Authority/authenticated\040users:r-x
mask::rwx
other::---
default:user::rwx
default:user:root:rwx
default:user:BUILTIN/administrators:rwx
default:user:BUILTIN/server\040operators:r-x
default:user:NT\040Authority/system:rwx
default:user:NT\040Authority/authenticated\040users:r-x
default:group::---
default:group:BUILTIN/administrators:rwx
default:group:BUILTIN/server\040operators:r-x
default:group:NT\040Authority/system:rwx
default:group:NT\040Authority/authenticated\040users:r-x
default:mask::rwx
default:other::---

root@addc:~# getfacl 
/var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/\{50109C01-DC5E-4166-B927-80EA1AF51E21\}/Machine/Preferences/
getfacl : suppression du premier « / » des noms de chemins absolus
# file: 
var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/{50109C01-DC5E-4166-B927-80EA1AF51E21}/Machine/Preferences/
# owner: BUILTIN/administrators
# group: users
user::rwx
user:root:rwx                   #effective:r-x
user:BUILTIN/administrators:rwx #effective:r-x
user:BUILTIN/server\040operators:r-x
user:NT\040Authority/system:rwx #effective:r-x
user:NT\040Authority/authenticated\040users:r-x
group::---
group:BUILTIN/administrators:rwx        #effective:r-x
group:BUILTIN/server\040operators:r-x
group:NT\040Authority/system:rwx        #effective:r-x
group:NT\040Authority/authenticated\040users:r-x
mask::r-x
other::---
default:user::rwx
default:user:root:rwx
default:user:BUILTIN/administrators:rwx
default:user:BUILTIN/server\040operators:r-x
default:user:NT\040Authority/system:rwx
default:user:NT\040Authority/authenticated\040users:r-x
default:group::---
default:group:BUILTIN/administrators:rwx
default:group:BUILTIN/server\040operators:r-x
default:group:NT\040Authority/system:rwx
default:group:NT\040Authority/authenticated\040users:r-x
default:mask::rwx
default:other::---

As you can see, on the "Preferences" directory, there is a problem with 
the "mask" entry, leading to "rwx" becoming actually/effective "r-x".

Also you can see that "sysvolreset" sets the owner and group at :
# owner : DOMSCRIBE/domain\040admins
# group : DOMSCRIBE/domain\040admins

And RSAT, when creating "Preferences" directory sets it at :
# owner: BUILTIN/administrators
# group: users

## 2 CASES ##

# CASE 1 #
If I re-run :
'samba-tool ntacl sysvolreset'
and repeat procedure from :
* Go to "Computer configuration" > "Preferences" > "Windows parameters" 
 > "Ini files" and Create an new .ini file, enter a name, a section 
name, a key and a value

I again get an "Access Denied" error, and :
* ACLs on "Preferences" directory are now good
* ACLs on "IniFiles" directory are now faulty

If I re-re-run :
'samba-tool ntacl sysvolreset'
and repeat procedure from :
* Go to "Computer configuration" > "Preferences" > "Windows parameters" 
 > "Ini files" and Create an new .ini file, enter a name, a section 
name, a key and a value
This time it's OK, "IniFiles.xml" is created and I can go on.

In other words, I have to run 'sysvolreset' as many times as there are 
sub-directories/file to be created.

# CASE 2 #
If I run :
'setfacl -m mask::rwx Preferences/'
and repeat procedure from :
* Go to "Computer configuration" > "Preferences" > "Windows parameters" 
 > "Ini files" and Create an new .ini file, enter a name, a section 
name, a key and a value
It's OK, sub-directoy "IniFiles" is created with correct ACLs and 
"IniFiles.xml" is also created.

This does not solve the problem completly as other sub-directories from 
"Preferences" will experience same problem. For example, only "Scripts" 
directory is created, with faulty ACLs. Thus sub-directories "Startup" 
and "Shutdown" cannot be created (and "Startup/Shutdown scripts" menu 
won't show up at all in RSAT...).

# What did "solve" the problem #
chown BUILTIN/administrators:users Machine/
setfacl -m g::--- Machine/
chown BUILTIN/administrators:users User/
setfacl -m g::--- User/

As far as I tested, I haven't any other "Access denied" error as long as 
I don't run 'samba-tool ntacl sysvolreset'.



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba