--- /usr/share/pyshared/samba/provision/__init__.py.orig	2016-12-03 04:31:14.119196000 +0100
+++ /usr/share/pyshared/samba/provision/__init__.py	2016-12-03 04:18:48.775196000 +0100
@@ -1591,14 +1591,19 @@
     setntacl(lp,sysvol, SYSVOL_ACL, str(domainsid), use_ntvfs=use_ntvfs,
              skip_invalid_chown=True, passdb=s4_passdb,
              service=SYSVOL_SERVICE)
+    root_policy_path = os.path.join(sysvol, dnsdomain, "Policies")
     for root, dirs, files in os.walk(sysvol, topdown=False):
         for name in files:
+            if root.startswith(root_policy_path):
+                continue
             if use_ntvfs and canchown:
                 os.chown(os.path.join(root, name), -1, gid)
             setntacl(lp, os.path.join(root, name), SYSVOL_ACL, str(domainsid),
                      use_ntvfs=use_ntvfs, skip_invalid_chown=True,
                      passdb=s4_passdb, service=SYSVOL_SERVICE)
         for name in dirs:
+            if root.startswith(root_policy_path):
+                continue
             if use_ntvfs and canchown:
                 os.chown(os.path.join(root, name), -1, gid)
             setntacl(lp, os.path.join(root, name), SYSVOL_ACL, str(domainsid),