FreeNAS as domain controller - cannot add group policy objects
VMware Fusion, 8 GB installation disk, 8 GB RAM, 2x 20 GB data disks
1. New installation of FreeNAS 11.0U4 followed update to 11.1RC1 - problem is identical in 11.0U4
2. Create domain controller as in the attached screenshot.
3. Trying to use the group policy management tool from Windows RSAT gives a cryptic error message without detail ("invalid parameter")
4. Some more detail as available from the command line:
root@freenas:~ # net ads info LDAP server: 192.168.2.149 LDAP server name: freenas.test.lan Realm: TEST.LAN Bind Path: dc=TEST,dc=LAN LDAP port: 389 Server time: Wed, 08 Nov 2017 15:15:43 CET KDC server: 192.168.2.149 Server time offset: 0 Last machine account password change: Wed, 08 Nov 2017 15:10:09 CET
root@freenas:~ # samba-tool gpo create Test-Object -U Administrator Password for [TEST\Administrator]: ERROR(runtime): uncaught exception - (-1073741811, 'An invalid parameter was passed to a service or function.') File "/usr/local/lib/python2.7/site-packages/samba/netcmd/__init__.py", line 176, in _run return self.run(*args, **kwargs) File "/usr/local/lib/python2.7/site-packages/samba/netcmd/gpo.py", line 1000, in run conn.set_acl(sharepath, fs_sd, sio)
#8 Updated by Patrick M. Hausen almost 3 years ago
- File debug-freenas-20171219083256.tgz added
Fresh installation of 11.1 RELEASE:
[root@freenas ~]# samba-tool gpo create Test-Object -U Administrator Password for [TEST\Administrator]: ERROR(runtime): uncaught exception - (-1073741811, 'An invalid parameter was pas sed to a service or function.') File "/usr/local/lib/python2.7/site-packages/samba/netcmd/__init__.py", line 1 76, in _run return self.run(*args, **kwargs) File "/usr/local/lib/python2.7/site-packages/samba/netcmd/gpo.py", line 1000, in run conn.set_acl(sharepath, fs_sd, sio) [root@freenas ~]# ^C [root@freenas ~]#
What precisely did you change that made you expect the problem to be fixed?
#10 Updated by Patrick M. Hausen over 2 years ago
Hi Dru and colleagues,what I found with some search engine abuse seems like Samba fundamentally does not work with respect to group policies if the sysvol is on ZFS.
So I see two courses of action:
- fix it in Samba and upstream the changes
- work around the problem by using an UFS formatted md device for the sysvol
I'm not involved in actual FreeNAS development, so this is of course entirely up to you. But the second option does look like a pretty ugly hack to me ;)
#15 Updated by Patrick M. Hausen over 2 years ago
Any ETA for this? My wife's not-for-profit organisation bought a server for their office which is sitting idly on the shelf since August 2017 due to this bug. A Windows-only environment and the plan was to use FreeNAS as the DC, server based profiles and server based home directories for all users - not going to work without group policies :(
#16 Updated by Timur Bakeyev over 2 years ago
Sorry for the delay with this matter, there are both issues with xattr handling, on which I'm working now and with GPO objects in Samba, patches for which are now discussed on Samba ML for inclusion into Samba 4.8. I can't give you definite dates right now, but I hope to finish at least xattr staff this week and then it'll be more clear what is still missing.
#18 Updated by Andrew Walker over 2 years ago
Patrick M. Hausen wrote:
Thanks for the update! :)
I just posted a patched generate_smb4_conf.py file in a separate bug ticket related to Samba DCs. https://redmine.ixsystems.com/issues/28932
The file resides on your system under /usr/local/libexec/nas/generate_smb4_conf.py
If you feel comfortable with it, try replacing that file on a test system, then provision a domain and try to edit group policies.
#23 Updated by Dru Lavigne over 2 years ago
- Status changed from Blocked to Closed
- Target version changed from 11.2-U2 to N/A
- Private changed from Yes to No
- Reason for Closing set to Duplicate Issue
- Reason for Blocked deleted (
Need additional information)
Patrick: closing this one out as the patch in the duplicate ticket should resolve this. If you get a chance to test it before release, please leave a comment in this ticket.