Issue with Group Policy Management

boukej · March 5, 2023, 3:37pm

NethServer Version: 7.9.2009
Module: nethserver-dc

** Error message:**

Failed to open the Group Policy Object. You might not have the appropriate rights.
Details: The system cannot find the path specified.

What I am trying to do: I am trying to edit a group policy via Group Policy Management on Windows Server 2019.

What I did try to solve the problem: I did issue the ntacl sysvolreset command in the container
systemd-run -M nsdc -t /bin/bash -c "samba-tool ntacl sysvolreset"

I did try to run Group Policy Management as user “admin” and user “Administrator”. I did run Group Policy Management as Administrator too.

I can see the policies and view all settings. But when I click “Edit” then I get the error message about not being able to open the GPO - might not have appropriate rights.

The NethServer installation is up to date. Any ideas?

Andy_Wismer · March 5, 2023, 3:41pm

Hi @boukej
AFAIK, NethServers AD is fully compatible with Windows Server 2012 R2… But not any newer versions. They may, or may not work.

My 2 cents
Andy

boukej · March 5, 2023, 3:52pm

Hi Andy,

Thanks for your reply.

Nethserver-DC is the only DC in this environment and creating / editing the GPO’s worked indeed fine when the (only) server was running Windows Server 2008 R2. I did convert the server to a Hyper-V VM and had to do an in place upgrade (in steps) to Window Server 2019.

The RSAT tools on Windows 10 work fine in combination with Nethserver-DC. I use the RSAT tools of Windows 10 to manage group policies for a few smaller customers (different environments but all with Nethserver-DC).

I think I’ll go ahead and install the RSAT tools on a Windows 10 client and try again for this environment to edit the policies and see what happens.

Thanks.

Andy_Wismer · March 5, 2023, 3:56pm

OK, these kind of infos should come right front up!
I think you probably need to check if you have “Promisious Mode” Active on Hyper-V. AD on NethServer needs this!

I cant help here as I don’t ever see myself running a Windows Box to run a virtual Linux.
Better the other way around!

My 2 cents
Andy

Hyper-V has had a few caveats in the past check the forum…

boukej · March 5, 2023, 4:03pm

Hi Andy,

Thanks again.

I’ll look into that but I can confirm the domain works fine when I look at joining computers/servers and so on. Group policy updates also work fine. I can’t find something obvious in the event logs of the Windows 2019 server.

I believe I did have issues with promiscuous mode before - but I am not sure if that was Hyper-V or Proxmox. I’ll look into this after testing editing the policies with Windows 10.

Andy_Wismer · March 5, 2023, 4:04pm

Proxmox has promicious always enabled by default!

boukej · March 5, 2023, 4:08pm

Yes, I think you are right about that. I did also find the post with regards to the previous issue I have had with running Nethserver-DC as a Hyper-V VM: Unable to reach nsdc - network problem? - #4 by boukej

Thanks again.

boukej · March 5, 2023, 7:53pm

I did try to edit some GPO’s from a Windows 10 client. Unfortunately this gives the same error message.
I did also sniff the DNS requests. Could it be DNS? The following records (red dot) aren’t being resolved (please see the screenshot).

Many thanks.

boukej · March 5, 2023, 8:40pm

I did try something else. I did create a new GPO with the name “Test”. Next I did try to edit the GPO - and that works!

I still don’t understand why I can’t edit the existing GPOs. I suspect it has to do with rights. I am reading “Sysvolreset - SambaWiki” at the moment.

Edit:

I did try “samba-check-set-sysvol.sh” but there are are dependencies missing
I did notice the plus-sign in the permissions column and did look into the extended attributes. I can’t find a problem with the permissions.

Not sure how to proceed. What I could do to work around the problem is to backup the GPOs. Next remove the original and restore the GPO? I think I’ll try that after a good night sleep.

After some more searching I did stumble into: [Samba] Cannot edit GPO's anymore via RSAT

I did also try the following:

bash-4.2# samba-tool dbcheck --cross-ncs
Checking 3520 objects
Checked 3520 objects (0 errors)

Still can’t edit GPOs. Maybe I have to open a post on the Samba forum? Probably backup/restore every GPO might be the fastest/best workaround.

# GPO: Test
bash-4.2# getfacl \{1C7C919E-7375-4F95-909E-21D34FAA51D3\}/
# file: {1C7C919E-7375-4F95-909E-21D34FAA51D3}/
# owner: 3000004
# group: 3000004
user::rwx
user:3000002:rwx
user:3000003:r-x
user:3000007:rwx
user:3000010:r-x
group::rwx
group:3000002:rwx
group:3000003:r-x
group:3000004:rwx
group:3000007:rwx
group:3000010:r-x
mask::rwx
other::---
default:user::rwx
default:user:3000002:rwx
default:user:3000003:r-x
default:user:3000004:rwx
default:user:3000007:rwx
default:user:3000010:r-x
default:group::---
default:group:3000002:rwx
default:group:3000003:r-x
default:group:3000004:rwx
default:group:3000007:rwx
default:group:3000010:r-x
default:mask::rwx
default:other::---

# GPO: UserInit
bash-4.2# getfacl \{236D00A8-829F-4BE4-9C12-B91C70B1D07F\}/
# file: {236D00A8-829F-4BE4-9C12-B91C70B1D07F}/
# owner: 3000004
# group: 3000004
user::rwx
user:3000002:rwx
user:3000003:r-x
user:3000007:rwx
user:3000010:r-x
group::rwx
group:3000002:rwx
group:3000003:r-x
group:3000004:rwx
group:3000007:rwx
group:3000010:r-x
mask::rwx
other::---
default:user::rwx
default:user:3000002:rwx
default:user:3000003:r-x
default:user:3000004:rwx
default:user:3000007:rwx
default:user:3000010:r-x
default:group::---
default:group:3000002:rwx
default:group:3000003:r-x
default:group:3000004:rwx
default:group:3000007:rwx
default:group:3000010:r-x
default:mask::rwx
default:other::---

Andy_Wismer · March 5, 2023, 9:32pm

I’d suggest having a good look at Proxmox (Just as free as NethServer).
Proxmox can easily run Win2019, even HP ROK or equalivant Dell bundles…
Way better than Hyper-V, and rock solid!

My 2 cents
Andy

boukej · March 5, 2023, 9:48pm

Andy,

I run Proxmox at home with Nethserver and Nethserver-DC. It’s wonderful.

Although I like Proxmox… I just can’t run Proxmox for this specific environment unfortunately.

It looks like the problem isn’t Hyper-V but permissions. When I create a new GPO, then I am able to edit the GPO.

I just created a backup of the GPO “Printers”. Next I did remove the GPO. Next I did restore the GPO… and voila! I am able to edit the GPO (again)! The only caveat is that I have to link the GPO to the OU.

I don’t know the cause of this specific problem but this work around solves the problem: I just create a backup of the GPOs which I can’t edit and then I just restore and link those GPOs again. I just have to pay attention of the links.

Thanks.