Univention Bugzilla – Bug 37624
reset well known ACL after takeover
Last modified: 2019-12-12 22:05:26 CET
Samba 4 doesn't currently honor all variants of ACLs for LDAP objects that AD supports and one can't set them using the samba-tools or AD Tools. However the AD-takeover copies unsupported ACLs over from the Windows DC. In most cases these are then ignored, however if there are ACLs set on well known containers, Samba might not work correctly. To fix it one can simply call samba-tool dbcheck --yes --fix --reset-well-known-acls it might make sense to test the output of "samba-tool dbcheck" for the string "nTSecurityDescriptor" and call the above command if the error was detected.
Can you provide an example or log?
I propose to simply add the switch "--reset-well-known-acls".
This issue has been filled against UCS 4.0. The maintenance with bug and security fixes for UCS 4.0 has ended on 31st of May 2016. Customers still on UCS 4.0 are encouraged to update to UCS 4.3. Please contact your partner or Univention for any questions. If this issue still occurs in newer UCS versions, please use "Clone this bug" or simply reopen the issue. In this case please provide detailed information on how this issue is affecting you.