Hello, I have a strange issue with Samba 4 as an AD DC regarding GPO creation.
I use the following packages on Debian wheezy: dpkg -l | grep samba ii libsamba-credentials0:i386 4.0.0+dfsg1-1 i386 Samba Credentials management library ii libsamba-hostconfig0:i386 4.0.0+dfsg1-1 i386 Samba host configuration library ii libsamba-policy0:i386 4.0.0+dfsg1-1 i386 Samba policy management ii libsamba-util0:i386 4.0.0+dfsg1-1 i386 Samba utility function library ii python-samba 4.0.0+dfsg1-1 i386 Python bindings for Samba rc samba 2:3.6.6-3 i386 SMB/CIFS file, print, and login server for Unix ii samba-common 2:3.6.10-1 all common files used by both the Samba server and client ii samba-common-bin 2:3.6.10-1 i386 common files used by both the Samba server and client ii samba-dsdb-modules 4.0.0+dfsg1-1 i386 Samba Directory Services Database ii samba4 4.0.0+dfsg1-1 i386 SMB/CIFS file, NT domain and active directory server (version 4) ii samba4-clients 4.0.0+dfsg1-1 i386 client utilities from Samba 4 ii samba4-common-bin 4.0.0+dfsg1-1 i386 Samba 4 common files used by both the server and the client I created an administrative account called "admin-domain" which is member of the following groups: - Administrators - Domain Admins - Domain Users - Group Policy Creator Owners If I logon with the "administrator" account, then there is no problem to create a new GPO with the group policy management application from the windows 8 client. However, if I logon with the "admin-domain" account, is is not possible to create a GPO. The error given is "Access Denied" I checked and there is no problem for "admin-domain" to write in the sysvol share. For me being member of Domain Admins and writing to sysvol rights shall be enough to write a GPO. Apart from that, the GPO are correctly applied and I see no other issue. I am sure missing something, but I can't figure out what... Thanks for your help. Antoine -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
