Ubuntu系统Adsys无法从Active Directory获取GPO问题求助

Ubuntu 22.04 错误表现 #

已按Wiki教程及《Ubuntu桌面集成白皮书》完成所有配置，SSSD后端可正常登录AD用户，但安装Adsys后无法获取GPO。执行adsysctl update -m、adsysctl update username@domain.com.br /tmp/krb5c_getentId_randomdnumber或仅adsysctl update命令时，均触发以下错误：

ERROR Error from server: error while updating policy: can't get policies for "ubuntu": can't download all gpos and assets: one or more error while fetching GPOs and assets: can't download "ubuntuRoot": can't check if ubuntuRoot needs refreshing: no GPT.INI file: cannot open smb://addc01.domain.com.br/SysVol/domain.com.br/Policies/{DF072E7E-6F2F-46D1-A90F-699415F72F2E}/GPT.INI: invalid argument

Ubuntu 22.04 完整详细日志（-vvvv verbose） #

INFO No configuration file: Config File "adsys" Not Found in "[/home/jzprates /root /etc /usr/sbin]".
We will only use the defaults, env variables or flags.
DEBUG Connecting as [[2504:109556]]
DEBUG New request /service/UpdatePolicy
DEBUG Requesting with parameters: IsComputer: true, All: false, Target: ubuntu, Krb5Cc:
DEBUG NormalizeTargetName for "ubuntu", type "computer"
DEBUG Check if grpc request peer is authorized
DEBUG Authorized as being administrator
DEBUG GetPolicies for "ubuntu", type "computer"
DEBUG Getting gpo list with arguments: "--objectclass computer ldap://addc01.domain.com.br ubuntu"
DEBUG GPO "ubuntuRoot" for "ubuntu" available at "smb://addc01.domain.com.br/SysVol/domain.com.br/Policies/{DF072E7E-6F2F-46D1-A90F-699415F72F2E}"
DEBUG Analyzing "assets"
DEBUG Analyzing "ubuntuRoot"
INFO No assets directory with GPT.INI file found on AD, skipping assets download
ERROR Error from server: error while updating policy: can't get policies for "ubuntu": can't download all gpos and assets: one or more error while fetching GPOs and assets: can't download "ubuntuRoot": can't check if ubuntuRoot needs refreshing: no GPT.INI file: cannot open smb://addc01.domain.com.br/SysVol/domain.com.br/Policies/{DF072E7E-6F2F-46D1-A90F-699415F72F2E}/GPT.INI: invalid argument

Ubuntu 22.10/23.04 错误表现 #

升级至22.10或23.04后，错误信息变更为：

ERROR Error from server: error while updating policy: can't get policies for "ubuntu": failed to retrieve the list of GPO (exited with 1): exit status 1
Failed to bind - LDAP client internal error: NT_STATUS_INVALID_PARAMETER
Failed to connect to 'ldap://addc01.domain.com.br' with backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER
Failed to open session: (1, 'LDAP client internal error: NT_STATUS_INVALID_PARAMETER').

Ubuntu 23.04 完整详细日志（-vvvv verbose） #

INFO No configuration file: Config File "adsys" Not Found in "[/home/jzprates /root /etc /usr/sbin]".
DEBUG Connecting as [[58811:006019]]
DEBUG New request /service/UpdatePolicy
DEBUG Requesting with parameters: IsComputer: true, All: false, Target: ubuntu, Krb5Cc:
DEBUG NormalizeTargetName for "ubuntu", type "computer"
DEBUG Check if grpc request peer is authorized
DEBUG Authorized as being administrator
DEBUG GetPolicies for "ubuntu", type "computer"
DEBUG Getting gpo list with arguments: "--objectclass computer ldap://addc01.domain.com.br ubuntu"
ERROR Error from server: error while updating policy: can't get policies for "ubuntu": failed to retrieve the list of GPO (exited with 1): exit status 1
Failed to bind - LDAP client internal error: NT_STATUS_INVALID_PARAMETER
Failed to connect to 'ldap://addc01.domain.com.br' with backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER
Failed to open session: (1, 'LDAP client internal error: NT_STATUS_INVALID_PARAMETER')

补充信息 #

• 域控制器与机器处于同一子网，各层级均无防火墙；
• 域控制器为已更新至最新安全版本的Windows Server 2019；
• 机器与用户位于同一OU，已启用“不继承”，仅添加了一条允许username@domain.com.br成为root的策略；
• 两份日志的信息头目录均为/home/jzprates，因为使用本地账户通过sudo adsysctl update -m -vvvv命令收集日志；
• 若在pam-auth-update中禁用Adsys登录，Ubuntu可正常创建域用户的主目录并登录。

内容的提问来源于stack exchange，提问作者JuarezPrates