Our campus hosts an on-prem Active Directory domain; Linux users I support run Ubuntu. Ultimately I'd like to implement the use of adsys to configure Ubuntu systems, but before trying to tackle that I'd like to resolve an issue I've run into with SSSD's GPO-based access control. I can successfully join Ubuntu systems to our AD domain, domain users can authenticate and home directories are automatically created, etc. However when I've executed "systemctl status sssd" I had been seeing the notification
"Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode."
I didn't see that there were any GPOs that would have been read by SSSD that would have generated that message so I modified the debug level for various SSSD-related logs. It seems as though it was after I executed "sssctl debug-level 0x0400 --domain <our campus domain>" that the
"Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode."
messages stopped. At that point I changed "ad_gpo_access_control = permissive" to "ad_gpo_access_control = enforcing", put a test system into an OU with a GPO that implements an ACL, and things seem to be working the way I would expect. I'd like to figure out why those warning messages appeared in the first place and what changed that made them stop. What information, logs, etc. would be helpful?
Tom,
You can look at /var/lib/sss/gpo_cache to see which policies SSSD processed. Without logs and more detail, it's hard to know exactly why. FWIW, that seems to be a relatively generic message if GPO processing fails; for example, if one of the policies was not readable, you can try "ad_gpo_ignore_unreadable = True" as well.
- Dan
On Mon, Aug 3, 2026 at 2:17 PM Tom Carpenter via sssd-users < sssd-users@lists.fedorahosted.org> wrote:
Our campus hosts an on-prem Active Directory domain; Linux users I support run Ubuntu. Ultimately I'd like to implement the use of adsys to configure Ubuntu systems, but before trying to tackle that I'd like to resolve an issue I've run into with SSSD's GPO-based access control. I can successfully join Ubuntu systems to our AD domain, domain users can authenticate and home directories are automatically created, etc. However when I've executed "systemctl status sssd" I had been seeing the notification
"Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode."
I didn't see that there were any GPOs that would have been read by SSSD that would have generated that message so I modified the debug level for various SSSD-related logs. It seems as though it was after I executed "sssctl debug-level 0x0400 --domain <our campus domain>" that the
"Warning: user would have been denied GPO-based logon access if the ad_gpo_access_control option were set to enforcing mode."
messages stopped. At that point I changed "ad_gpo_access_control = permissive" to "ad_gpo_access_control = enforcing", put a test system into an OU with a GPO that implements an ACL, and things seem to be working the way I would expect. I'd like to figure out why those warning messages appeared in the first place and what changed that made them stop. What information, logs, etc. would be helpful? -- _______________________________________________ sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.o... Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
sssd-users@lists.fedorahosted.org
-
Dan Lavu -
Tom Carpenter