I have three Zentyal 5.0.1 servers with Samba 4.6.7 in the field all functioning as DC's. I use the default domain policy with roaming profiles (the roaming profiles were set in the zentyal admin webpage) and a couple of drive maps.

All the PC's are 'joined to the domain'

On windows 7 PC's when regular users log in the roaming profiles and drive maps work perfectly.

However on windows 10 PC's unless the users are administrators (members of the admin and schema admin group) neither the roaming profiles or drive maps work and often it logs in with a temp profile.
A check of the system events shows the following error;
The processing of Group Policy failed. Windows attempted to read the file \\test.local\sysvol\test.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

Things I have tried;
I can browse to and open the gpt.ini with no problems as a standard user.

If I then add the user to the admin group the issue goes away.
This issue affects all the zentyal 5 setups I have in exactly the same way including a test one. The windows 10 version is the latest creators edition.

I am certain anyone else using the win 10 creators version and zentyal 5/samba 4.6.7 will be hitting the same issue!

Has anyone solved it?

Many thanks for all the replies and pointers chaps!

Hopefully this may help another newbie like me.

Just a quick update;

The issue was caused by UNC hardening which by default is off on win 7 and 8/8.1 but enabled by default on Windows 10.
Once disabled on my win 10 clients the fault went away- However this raises two questions in my mind;

1, It looks like UNC hardening is a security feature so disabling it may not be the best idea.

2, I run quite a few MS domain controllers (Server 2008/sbs2011/server2012) and Win 10 clients with the UNC hardening enabled and have no group policy issues at all. I'm thinking this is maybe a bug in Samba?


Main thing for now is its working.