Comment # 16 on bug 1092099 from Samuel Cabrero

(In reply to Satoru Matsumoto from comment #15)
> One problem that has not been solved is, I can't access netlogon as
> Administrator.
> 
> # smbclient //localhost/netlogon -UAdministrator -c 'ls'
> Enter TAD23\Administrator's password: 
> NT_STATUS_ACCESS_DENIED listing \*smbclient //localhost/netlogon
> -UAdministrator -c 'ls'
> Enter TAD23\Administrator's password: 
> NT_STATUS_ACCESS_DENIED listing \*

Hi Satoru,

thank you for the feedback. The update-apparmor-samba-profile script was not
called when starting samba as AD DC. Fixed by
https://build.opensuse.org/request/show/612904. Please update and restart
samba.

(In reply to Christian Boltz from comment #14)
> If this is really true, I'd be very interested to see the output of
>     apparmor_parser -r /etc/apparmor.d
> and what gets logged in /var/log/audit/audit.log when doing that.

Tested again and profiles are reloaded correctly. I think the issue was the
shares profile (/etc/apparmor.d/local/usr.sbin.smbd-shares) was not updated.