ipa-gpo-install(8)
| IPA-GPO-INSTALL(8) | System Manager's Manual | IPA-GPO-INSTALL(8) |
NAME
ipa-gpo-install - Prepare FreeIPA for Group Policy Management
SYNOPSIS
ipa-gpo-install [ --check-only ] [ --debuglevel LEVEL ]
DESCRIPTION
ipa-gpo-install
Prepares a FreeIPA server for group policy management by extending the LDAP
schema with group policy-related
object classes and creating the necessary directory structure.
The utility performs several checks and necessary actions:
- Extends the FreeIPA LDAP schema with group policy object classes
- Installs AD trust support if it is not already installed
- Creates the SYSVOL directory structure
- Configures the Samba SYSVOL share
- Grants the FreeIPA web service controlled editor access to GPO payloads and creates private libadmix publication state
After AD Trust setup and after ipa-server-upgrade, when run, the utility reconnects to LDAP. It verifies the required schema classes and Group Policy infrastructure entries and restarts oddjob and, after verification, Apache to load the installed server plugins.
OPTIONS
- --check-only
- Only perform checks without making changes. Missing required LDAP schema classes or Group Policy infrastructure entries cause a non-zero exit code.
- --debuglevel LEVEL
- Set the debug level: 0=errors, 1=warnings, 2=debug. Default is 0.
EXIT CODES
- 0
- The application successfully completed.
- 1
- An error occurred during execution.
FILES
- /var/log/freeipa/ipa-gpo-install.log
- The ipa-gpo-install log file.
- /var/log/ipaupgrade.log
- The ipa-server-upgrade log file.
- /var/log/ipaserver-adtrust-install.log
- The AD Trust setup log file.
- /var/lib/freeipa/sysvol
- The SYSVOL directory for storing group policies.
- /var/lib/freeipa/gpo-editor-state
- Private host-local libadmix publication recovery state, owned by the FreeIPA service account and not shared through SYSVOL.
- /etc/samba/smb.conf
- The Samba configuration file.
REQUIREMENTS
This utility requires a correctly installed and configured FreeIPA server, python3-module-admix 0.3.x (at least 0.3.0 and below 0.4.0), Administrative Templates from admx-basealt, security definitions from sdmx-basealt (at least 1.0.0), and validation schemas from sdmx-schemas (at least 1.0.0). It must be run with root privileges on the FreeIPA server and requires a valid Kerberos ticket for a user who is a domain administrator or a member of the 'admins' group.
SEE ALSO
ipa-adtrust-install(1), ipa(1), kinit(1)
BUGS
Please report any bugs to the ALT Linux Bugzilla bug tracking system at https://bugzilla.altlinux.org/ for this package.
AUTHOR
skachedubov@altlinux.org