We've recently started receiving a lot of complaints from users about
broadcast messages of the form:
Message from syslogd@hostname at Dec 4 09:08:35 ...
sssd[be[domain.lan]]:Group Policy Container with DN
is unreadable or has unreadable or missing attributes. In order to fix
this make sure that this AD object has following attributes readable:
nTSecurityDescriptor, cn, gPCFileSysPath, gPCMachineExtensionNames,
gPCFunctionalityVersion, flags. Alternatively if you do not have access
to the server or can not change permissions on this object, you can use
option ad_gpo_ignore_unreadable = True which will skip this GPO.See 'man
ad_gpo_ignore_unreadable for details.'
We've reviewed the AD object with that DN and determined that they are
scoped to specific sets of workstations using AD groups, such as "Domain
Laptops". As far as we can tell, this is entirely normal, and there's
no reason to log an error, much less broadcast a message to every open
terminal every time GPOs are processed.
I'm aware of the ad_gpo_ignore_unreadable setting, but the default seems
to be the wrong behavior, and I'd like to suggest changing that.