netcmd: models: add default SDDL to group_msa_membership

LA can be used for the administrator and Windows will expand that on save, making the group_sddl method redundant.

Signed-off-by: Rob van der Linde <rob@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>

diff --git a/python/samba/netcmd/domain/models/user.py b/python/samba/netcmd/domain/models/user.py
index 1af9576f6430bde47adbb622794d3035e300b86d..95b300e297043780116c5418f1d30e62695af143 100644 (file)
--- a/python/samba/netcmd/domain/models/user.py
+++ b/python/samba/netcmd/domain/models/user.py
@@ -99,7 +99,8 @@ class GroupManagedServiceAccount(User):
     """A GroupManagedServiceAccount is a type of User with additional fields."""
     managed_password_interval = IntegerField("msDS-ManagedPasswordInterval")
     dns_host_name = StringField("dNSHostName")
-    group_msa_membership = SDDLField("msDS-GroupMSAMembership")
+    group_msa_membership = SDDLField("msDS-GroupMSAMembership",
+                                     default="O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;LA)")
     managed_password_id = BinaryField("msDS-ManagedPasswordId",
                                       readonly=True, hidden=True)
     managed_password_previous_id = BinaryField("msDS-ManagedPasswordPreviousId",