This is a freshly provisioned Samba 4.0.0-rc5 installation.
I provisioned the domain and created shares in the configuration file to
match an existing Samba 3.5.x installation that we're moving away from
(or at least, that's the plan...) for various reasons.
I then moved all the contents of the shares over from the old server to
the new server via rsync, including home directories and user profiles.
I then changed the permissions on the profiles and home directories to
match the POSIX IDs which were created by Samba 4 when I created the
users using the Active Directory Users and Computers management tool
from a workstation that I bound to the domain.
I then created a Group Policy, which applied itself successfully to the
workstation.
So far, so good.
However, I can only login as DOMAIN\Administrator or DOMAIN\{$USER}
where $USER is a user account that has membership in the Domain Admins
group. I am completely unable to login as any user that is not in
Domain Admins. When I attempt to do so, the workstation returns the
error message "The Group Policy Client service failed the logon. Access
is denied."
There is nothing in the Windows Event Log indicating an access denied
message, and there is nothing in the Windows Event Log indicating any
other problems at the time that the error message is displayed or within
the time that the login process is pending.
There are no messages in the Samba 4 log, either, with the debug level
set to 9.
The best that I can come up with is that this is a permissions problem
of _some_ sort, but I cannot determine what it is. The system running
Samba has no MAC security systems in the way (e.g., no SELinux or
anything like that, just simple UNIX DAC). The permissions on SYSVOL
and NETLOGON are completely unmodified by me.
Can someone give me an idea of where to start looking? I tried to
figure out perhaps what the ID numbers in the ACLs are for the SYSVOL
share, but wbinfo doesn't seem to know anything about ID numbers
3000000-3000003, which are the IDs on the share itself. The lowest ID
number that I have which appears in user or group lists as returned by
wbinfo is 3000004.
Any help would be appreciated, as I have been banging my head against
this brick wall for hours now, to no avail.
Thanks,
Mike
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
