Description Christina Scheinig 2022-02-18 16:12:12 CET

Adding a new GPO the Policy is shown in the filesystem like this:

drwxrwx---+  4 root          Domain Admins   4096 2021-12-20 13:19 {41F02AC9-8E77-4152-9D25-B3C81A333EF1}

The idmaping prevents this from shown in this way:

drwxrwx---+  4          5000 Domain Admins  4,0K Jan  6 16:24 {41F02AC9-8E77-4152-9D25-B3C81A333EF1}

------------------------
Samba-tool ntacl get shows this:
   owner_sid                : *
            owner_sid                : S-1-5-21-2639353322-3808860264-4138808944-500
        group_sid                : *
            group_sid                : S-1-5-21-2639353322-3808860264-4138808944-512
------------------------
samba-tool ntacl get --as-sddl 
O:DAG:DAD:PAI(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED)

vs 

O:LAG:DAD:PAI(A;OICI;0x001d0156;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001d0156;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;ED)(A;OICI;0x001200a9;;;S-1-5-21-2639353322-3808860264-4138808944-17651)(A;OICI;0x001200a9;;;DA)(A;OICI;0x001200a9;;;AU)

---------------------
Maybe a side effect of
https://errata.software-univention.de/#/?erratum=4.4x1095

At the moment I have no output from the systemdiagnose,  but the GPO is applied.