Created attachment 12135 [details]
log

Добрый день, можете помочь с ошибкой, при выполнении gpoa --loglevel 0 administrator
Сервер в домене, принципал есть, krb получаю:

chrome ~ # kinit -k  CHROME$
chrome ~ # kli
klines   klipper  klist
chrome ~ # klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: CHROME$@TEST.LOCAL

Valid starting       Expires              Service principal
22.12.2022 14:33:11  23.12.2022 00:33:11  krbtgt/TEST.LOCAL@TEST.LOCAL
        renew until 29.12.2022 14:33:11
chrome ~ #

cat /etc/krb5.conf

[libdefaults]
default_realm = TEST.LOCAL
udp_preference_limit = 0
dns_lookup_kdc = true
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
[realms]
 TEST.LOCAL = {
  kdc = ad.test.local:88
  admin_server = ad.test.local:749
  default_domain = test.local
 }

[domain_realm]
 .test.local = TEST.LOCAL
 test.local = TEST.LOCAL

[kdc]
 profile = /etc/kerberos/krb5kdc/kdc.conf

[pam]
 debug = false
 ticket_lifetime = 36000
 renew_lifetime = 36000
 forwardable = true
 krb4_convert = false

[login]
 krb4_convert = false
 krb4_get_tickets = false

chrome ~ # cat /etc/samba/smb.conf

[global]
        passdb backend = tdbsam
        winbind nss info = rfc2307
        kerberos method = system keytab
        workgroup = TEST
        realm  = test.local
        netbios name = CHROME
        security = ads
        encrypt passwords = Yes
        password server = *
        log file = /var/log/samba/log.%m
        max log size = 50
        socket options = TCP_NODELAY
        os level = 0
        local master = No
        dns proxy = No
        winbind uid = 10000-20000
        winbind gid = 10000-20000
        winbind separator = +
        template homedir = /home/%D/%U
        template shell = /bin/bash
        winbind enum groups = Yes
        winbind enum users = Yes
        winbind refresh tickets = true
        winbind offline logon = true
        winbind cache time = 120
        winbind use default domain = Yes
        wins support = no
        idmap config * : range = 10000-20000000
        idmap config * : backend = tdb
[homes]
       comment = Home Directories
       browseable = no
       writable = yes

chrome ~ # cat /etc/sssd/sssd.conf

[sssd]
domains = test.local
config_file_version = 2
services = nss, pam

[domain/test.local]
default_shell = /bin/bash
krb5_store_password_if_offline = True
cache_credentials = True
krb5_realm = TEST.LOCAL
realmd_tags = manages-system joined-with-adcli
id_provider = ad
fallback_homedir = /home/%d/%u
ad_domain = test.local
use_fully_qualified_names = True
ldap_id_mapping = True
access_provider = ad
ad_gpo_ignore_unreadable = True
ad_gpo_access_control = disabled
use_fully_qualified_names = False
chrome ~ #