Problem
After copying an existing Group Policy Object (GPO) using the Windows Group Policy Management Console (GPMC), changes to Computer Configuration may not be applied to clients and may not be shown correctly in the GPMC overview.
The changed settings are still visible when editing the affected GPO.
In the SYSVOL directory of the copied GPO, two policy files differing only in case can be found:
# ls -l /var/lib/samba/sysvol/<domain>/Policies/<GPO-ID>/Machine/
-rwxrwx---+ 1 Administrator Domain\ Admins 166 Jul 31 17:04 registry.pol
-rwxrwx---+ 1 Administrator Domain\ Admins 178 Jul 31 17:05 Registry.pol
The issue is tracked as Bug #59695
Investigation
A newly created GPO initially contains:
Machine/Registry.pol
When this GPO is copied using GPMC, the copied GPO contains:
Machine/registry.pol
When the copied GPO is subsequently modified, GPMC writes the new policy data via Registry.tmp and requests a rename to Registry.pol.
The Samba debug log shows that Samba detects the existing lowercase file and resolves the requested name accordingly:
openat_pathref_fsp_lcomp:
rel->base_name changed from Registry.pol to registry.pol
Samba then reports the rename as:
rename_internals_fsp:
succeeded doing rename on
.../Machine/Registry.tmp -> .../Machine/registry.pol
However, the resulting SYSVOL contains both files:
Machine/registry.pol
Machine/Registry.pol
The files are separate filesystem objects with different inode numbers:
registry.pol
Inode: 2358071
Birth: 2026-07-31 17:04:06.080
Registry.pol
Inode: 2358141
Birth: 2026-07-31 17:05:04.956
The inode of the newly created Registry.pol corresponds to the temporary Registry.tmp used during the modification.
This leaves two different policy files in SYSVOL and causes the GPO to be evaluated incorrectly.
The same workflow does not produce the duplicate file with Samba 4.18 on UCS 5.0-10.
Solution / Workaround
Until Bug #59695 is fixed, remove the obsolete lowercase registry.pol from the affected GPO after modifying it.
First verify that both files exist:
ls -li "/var/lib/samba/sysvol/<domain>/Policies/<GPO-ID>/Machine/"*egistry.pol
If both registry.pol and Registry.pol are present, remove the lowercase file:
rm "/var/lib/samba/sysvol/<domain>/Policies/<GPO-ID>/Machine/registry.pol"
Verify that only Registry.pol remains:
ls -li "/var/lib/samba/sysvol/<domain>/Policies/<GPO-ID>/Machine/"*egistry.pol
The directory must contain only:
Machine/Registry.pol
After removing the duplicate lowercase file, the modified settings are shown correctly and are applied to clients again.
If the issue also occurs below User/, apply the same check to:
/var/lib/samba/sysvol/<domain>/Policies/<GPO-ID>/User/