Re: Access denied on GPO after "ntacl sysvolreset"

On Thu, 16 Apr 2026 16:09:35 +0200
Klaas TJEBBES via samba <[email protected]> wrote:

> 
> 
> Le 16/04/2026 à 13:53, Rowland Penny via samba a écrit :
> > On Thu, 16 Apr 2026 12:12:28 +0100
> > Rowland Penny via samba <[email protected]> wrote:
> > 
> >>
> >> Well, I am at loss here, if I do what you have posted, add a
> >> totally bogus ini file to a GPO via the GPMC, it works for myself.
> >>
> >> If I 'cat' the file on the DC, I get this:
> >>
> >> sudo cat
> >> /var/lib/samba/sysvol/samdom.example.com/Policies/{EA6FE93A-E885-4083-AE7E-56F94897A573}/Machine/Preferences/IniFiles/IniFiles.xml
> >>
> >> <?xml version="1.0" encoding="utf-8"?>
> >> <IniFiles clsid="{694C651A-08F2-47fa-A427-34C4F62BA207}"><Ini
> >> clsid="{EEFACE84-D3D8-4680-8D4B-BF103E759448}" name="derf"
> >> status="derf" image="2" changed="2026-04-16 10:53:21"
> >> uid="{A90C1544-78CF-4D71-AF88-FF5C6FB1906D}"><Properties
> >> path="ini.txt" section="fred" value="" property="derf"
> >> action="U"/></Ini> </IniFiles>
> >>
> >> I am struggling to know what else to suggest.
> >> I am running Samba 4.23.6 from backports on Debian 13, but I do not
> >> think the Samba version has anything to do with your problem.
> >>
> >> Do you have the attr and acl packages installed ?
> >> Is apparmor getting in the way ?
> >> Is there a firewall and could this be stopping something ?
> >> What filesystem are you using ?
> >>
> >> Rowland
> >>
> > 
> > And then I realised that I hadn't done one thing that you had, run
> > sysvolcheck on the DC:
> > 
> > This look familiar:
> > 
> > sudo samba-tool ntacl sysvolcheck
> > ERROR(<class 'samba.provision.ProvisioningError'>): uncaught
> > exception - ProvisioningError: DB ACL on GPO directory
> > /var/lib/samba/sysvol/samdom.example.com/Policies/{EA6FE93A-E885-4083-AE7E-56F94897A573}/Machine/Scripts/Shutdown
> > O:BAG:DUD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)
> > does not match expected value
> > O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)
> > from GPO object File
> > "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py", line
> > 387, in _run return self.run(*args, **kwargs)
> > ~~~~~~~~^^^^^^^^^^^^^^^^^ File
> > "/usr/lib/python3/dist-packages/samba/netcmd/ntacl.py", line 484,
> > in run provision.checksysvolacl(samdb, netlogon, sysvol,
> > ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^ domain_sid,
> > ^^^^^^^^^^^ lp.get("realm").lower(), samdb.domain_dn(),
> > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ lp) ^^^ File
> > "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line
> > 1885, in checksysvolacl check_gpos_acl(sysvol, dnsdomain,
> > domainsid, domaindn, samdb, lp,
> > ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > direct_db_access) ^^^^^^^^^^^^^^^^^ File
> > "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line
> > 1835, in check_gpos_acl check_dir_acl(policy_path, dsacl2fsacl(acl,
> > domainsid), lp,
> > ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > domainsid, direct_db_access) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File
> > "/usr/lib/python3/dist-packages/samba/provision/__init__.py", line
> > 1801, in check_dir_acl raise ProvisioningError('%s ACL on GPO
> > directory %s %s does not match expected value %s from GPO object' %
> > (acl_type(direct_db_access), os.path.join(root, name), fsacl_sddl,
> > acl))
> > 
> > Which boils down to sysvolcheck getting this back from the
> > directory:
> > 
> > O:BAG:DUD:(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;;FA;;;BA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)
> > 
> > And it expected this:
> > 
> > O:DAG:DAD:P(A;OICI;FA;;;DA)(A;OICI;FA;;;EA)(A;OICIIO;FA;;;CO)(A;OICI;FA;;;DA)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;0x1200a9;;;ED)
> > 
> > Which if you look carefully at the ACEs, among what it got was this:
> > (A;;FA;;;BA)
> > 
> > and it expected this:
> > (A;OICI;FA;;;DA)
> > 
> > All the other ACES are the same, but the two aces above are in a
> > slightly different order, but I do not think this matters.
> > 
> > OI means the object inherits permissions from above and CI means the
> > container inherits permissions from above, but the 'P' in 'D:P('
> > prevents the DACLs security descriptor being modified by inheritable
> > ACEs.
> > The two different ACEs allow access by two different groups,
> > changing the GPO from Windows uses 'BA' which is
> > BUILTIN\Administrators, but sysvolcheck expects 'DA', Domain
> > Admins, not that this a problem, because of Windows nested groups,
> > Domain Admins is a member of BUILTIN\Administrators.
> > 
> > Someone a lot smarter than me needs to fix sysvolreset/syslvolcheck,
> > they do not seem to work with new GPOs. In the meantime, I would
> > suggest only running sysvolreset and sysvolcheck on new installs
> > where there are no extra GPOs. Then create GPOs on Windows, that
> > must know the correct ACLs to use.
> > 
> > Rowland
> > 
> > 
> > 
> > 
> 
> root@addc:~# dpkg -l|grep -E 'acl|attr'
> ii  acl                            2.3.2-1build1.1 
> amd64        access control list - utilities
> ii  attr                           1:2.5.2-1build1.1 
> amd64        utilities for manipulating filesystem extended attributes
> ii  libacl1:amd64                  2.3.2-1build1.1 
> amd64        access control list - shared library
> ii  libattr1:amd64                 1:2.5.2-1build1.1 
> amd64        extended attribute handling - shared library
> 
> 
> The procedure to reproduce the bug I see is pretty simple :
> * setup an ADDC Samba server
> * join a Windows 11 client to the domain
> * create an empty GPO via RSAT (that mean righr clic on "Group policy 
> objects" => New, enter a name and clic "Ok")
> * on the Samba DC run 'samba-tool ntacl sysvolreset'
> * in RSAT edit newly created GPO (right clic on its name => "Edit")
> * Go to "Computer configuration" > "Preferences" > "Windows
> parameters" 
>  > "Ini files" and Create an new .ini file, enter a name, a section 
> name, a key and a value
> * At this point, when I clic "Ok", I get an access denied error.
> 
> This procedure should create several subdirectories and a file :
> * Preferences/IniFiles/IniFiles.xml
> under the directory "{<GPO_ID>}\Machine\"
> 
> But only the "Preferences" directory is created and its ACLs do not 
> allow the creation of the sub-directory "IniFiles", thus don't allow
> the creation of "IniFiles.xml".
> 
> I know you told me not to look at it, but :
> 
> root@addc:~# getfacl 
> /var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/\{50109C01-DC5E-4166-B927-80EA1AF51E21\}/Machine
> getfacl : suppression du premier « / » des noms de chemins absolus
> # file: 
> var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/{50109C01-DC5E-4166-B927-80EA1AF51E21}/Machine
> # owner: DOMSCRIBE/domain\040admins
> # group: DOMSCRIBE/domain\040admins
> user::rwx
> user:root:rwx
> user:BUILTIN/administrators:rwx
> user:BUILTIN/server\040operators:r-x
> user:NT\040Authority/system:rwx
> user:NT\040Authority/authenticated\040users:r-x
> group::rwx
> group:BUILTIN/administrators:rwx
> group:BUILTIN/server\040operators:r-x
> group:NT\040Authority/system:rwx
> group:NT\040Authority/authenticated\040users:r-x
> mask::rwx
> other::---
> default:user::rwx
> default:user:root:rwx
> default:user:BUILTIN/administrators:rwx
> default:user:BUILTIN/server\040operators:r-x
> default:user:NT\040Authority/system:rwx
> default:user:NT\040Authority/authenticated\040users:r-x
> default:group::---
> default:group:BUILTIN/administrators:rwx
> default:group:BUILTIN/server\040operators:r-x
> default:group:NT\040Authority/system:rwx
> default:group:NT\040Authority/authenticated\040users:r-x
> default:mask::rwx
> default:other::---
> 
> root@addc:~# getfacl 
> /var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/\{50109C01-DC5E-4166-B927-80EA1AF51E21\}/Machine/Preferences/
> getfacl : suppression du premier « / » des noms de chemins absolus
> # file: 
> var/lib/samba/sysvol/domscribe.ac-test.fr/Policies/{50109C01-DC5E-4166-B927-80EA1AF51E21}/Machine/Preferences/
> # owner: BUILTIN/administrators
> # group: users
> user::rwx
> user:root:rwx                   #effective:r-x
> user:BUILTIN/administrators:rwx #effective:r-x
> user:BUILTIN/server\040operators:r-x
> user:NT\040Authority/system:rwx #effective:r-x
> user:NT\040Authority/authenticated\040users:r-x
> group::---
> group:BUILTIN/administrators:rwx        #effective:r-x
> group:BUILTIN/server\040operators:r-x
> group:NT\040Authority/system:rwx        #effective:r-x
> group:NT\040Authority/authenticated\040users:r-x
> mask::r-x
> other::---
> default:user::rwx
> default:user:root:rwx
> default:user:BUILTIN/administrators:rwx
> default:user:BUILTIN/server\040operators:r-x
> default:user:NT\040Authority/system:rwx
> default:user:NT\040Authority/authenticated\040users:r-x
> default:group::---
> default:group:BUILTIN/administrators:rwx
> default:group:BUILTIN/server\040operators:r-x
> default:group:NT\040Authority/system:rwx
> default:group:NT\040Authority/authenticated\040users:r-x
> default:mask::rwx
> default:other::---
> 
> As you can see, on the "Preferences" directory, there is a problem
> with the "mask" entry, leading to "rwx" becoming actually/effective
> "r-x".
> 
> Also you can see that "sysvolreset" sets the owner and group at :
> # owner : DOMSCRIBE/domain\040admins
> # group : DOMSCRIBE/domain\040admins
> 
> And RSAT, when creating "Preferences" directory sets it at :
> # owner: BUILTIN/administrators
> # group: users
> 
> ## 2 CASES ##
> 
> # CASE 1 #
> If I re-run :
> 'samba-tool ntacl sysvolreset'
> and repeat procedure from :
> * Go to "Computer configuration" > "Preferences" > "Windows
> parameters" 
>  > "Ini files" and Create an new .ini file, enter a name, a section 
> name, a key and a value
> 
> I again get an "Access Denied" error, and :
> * ACLs on "Preferences" directory are now good
> * ACLs on "IniFiles" directory are now faulty
> 
> If I re-re-run :
> 'samba-tool ntacl sysvolreset'
> and repeat procedure from :
> * Go to "Computer configuration" > "Preferences" > "Windows
> parameters" 
>  > "Ini files" and Create an new .ini file, enter a name, a section 
> name, a key and a value
> This time it's OK, "IniFiles.xml" is created and I can go on.
> 
> In other words, I have to run 'sysvolreset' as many times as there
> are sub-directories/file to be created.
> 
> # CASE 2 #
> If I run :
> 'setfacl -m mask::rwx Preferences/'
> and repeat procedure from :
> * Go to "Computer configuration" > "Preferences" > "Windows
> parameters" 
>  > "Ini files" and Create an new .ini file, enter a name, a section 
> name, a key and a value
> It's OK, sub-directoy "IniFiles" is created with correct ACLs and 
> "IniFiles.xml" is also created.
> 
> This does not solve the problem completly as other sub-directories
> from "Preferences" will experience same problem. For example, only
> "Scripts" directory is created, with faulty ACLs. Thus
> sub-directories "Startup" and "Shutdown" cannot be created (and
> "Startup/Shutdown scripts" menu won't show up at all in RSAT...).
> 
> # What did "solve" the problem #
> chown BUILTIN/administrators:users Machine/
> setfacl -m g::--- Machine/
> chown BUILTIN/administrators:users User/
> setfacl -m g::--- User/
> 
> As far as I tested, I haven't any other "Access denied" error as long
> as I don't run 'samba-tool ntacl sysvolreset'.
> 

Sysvol on a Samba AD DC has been problematic since at least version
4.0.0
I have attempted to 'fix' it a few times, but it as always beaten me,
it is just too complex. What doesn't help is that if you search the
internet for the Microsoft default ACL, you can only find the default
ACL for sysvol and it is typically this:
D:P(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;SO)(A;;0x001f01ff;;;BA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001f01ff;;;CO)

While Samba uses this:
O:LAG:BAD:P(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;SO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)

Note the lack of ownership on the Microsoft ACL, While I cannot find
anything to prove it, I do not think that Microsoft cares who owns the
ACL, just as long as the ACEs are correct.

Coming back to the ACES, the ones that do not match are the two for
'BA' (BUILTIN\Administrators) and 'SY' (SYSTEM), the Microsoft ones use
'0x001f01ff' which is full control and Samba uses 'FA' which is
'FILE_GENERIC_ALL' and I think that is another way of saying full
control.
There is one ACE missing from the Samba ACL, the one for 'CO' (Creator
Owner).

However, a few years ago, I set up a Windows 2012R2 AD DC and sysvol on
that had this ACL:
O:BAG:SYD:PAI(A;OICIIO;WDWOGXGWGR;;;CO)(A;OICIIO;GXGR;;;AU)(A;;0x1200a9;;;AU)(A;OICIIO;GA;;;SY)(A;;FA;;;SY)(A;OICIIO;WDWOGXGWGR;;;BA)(A;;0x1e01bf;;;BA)(A;OICIIO;GXGR;;;SO)(A;;0x1200a9;;;SO)

Which is yet another different ACL.

My default path in future is going to be, set up a new domain, check
that sysvol is correct and then never, not ever, run sysvolreset or
sysvolcheck again.

YMMV

You might find this interesting and it shows how long this has been
going on:

https://lists.samba.org/archive/samba/2016-December/205470.html

Rowland


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba