diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index fbc8117ed5a..20114c9541e 100644
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -799,7 +799,7 @@ sub provision($$$$$$$$$)
 
 [sysvol]
 	path = $ctx->{statedir}/sysvol
-	read only = yes
+	read only = no
 
 [netlogon]
 	path = $ctx->{statedir}/sysvol/$ctx->{dnsname}/scripts
diff --git a/source4/scripting/python/samba/tests/samba_tool/gpo.py b/source4/scripting/python/samba/tests/samba_tool/gpo.py
new file mode 100644
index 00000000000..84154f57563
--- /dev/null
+++ b/source4/scripting/python/samba/tests/samba_tool/gpo.py
@@ -0,0 +1,57 @@
+# Unix SMB/CIFS implementation.
+# Copyright (C) Andrew Bartlett 2012
+#
+# based on time.py:
+# Copyright (C) Sean Dague <sdague@linux.vnet.ibm.com> 2011
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+import os
+from samba.tests.samba_tool.base import SambaToolCmdTest
+
+class GpoCmdTestCase(SambaToolCmdTest):
+    """Tests for samba-tool time subcommands"""
+
+    gpo_name = "testgpo"
+
+    def test_gpo_list(self):
+        """Run gpo list against the server and make sure it looks accurate"""
+        (result, out, err) = self.runsubcmd("gpo", "listall", "-H", "ldap://%s" % os.environ["SERVER"])
+        self.assertCmdSuccess(result, "Ensuring gpo listall ran successfully")
+
+    def test_fetchfail(self):
+        """Run against a non-existent GPO, and make sure it fails (this hard-coded UUID is very unlikely to exist"""
+        (result, out, err) = self.runsubcmd("gpo", "fetch", "c25cac17-a02a-4151-835d-fae17446ee43", "-H", "ldap://%s" %
+os.environ["SERVER"])
+        self.assertEquals(result, -1, "check for result code")
+
+    def test_fetch(self):
+        """Run against a real GPO, and make sure it passes"""
+        (result, out, err) = self.runsubcmd("gpo", "fetch", self.gpo_guid, "-H", "ldap://%s" % os.environ["SERVER"], "--tmpdir", os.environ['SELFTEST_PREFIX'])
+        self.assertCmdSuccess(result, "Ensuring gpo fetched successfully")
+
+    def setUp(self):
+        """set up a temporary GPO to work with"""
+        super(GpoCmdTestCase, self).setUp()
+        (result, out, err) = self.runsubcmd("gpo", "create", self.gpo_name, "-H", "ldap://%s" % os.environ["SERVER"], "-U%s%%%s" % (os.environ["USERNAME"], os.environ["PASSWORD"]))
+        self.gpo_guid = "{%s}" % out.split("{")[1].split("}")[0]
+
+        self.assertCmdSuccess(result, "Ensuring gpo created successfully")
+
+    def tearDown(self):
+        """remove the temporary GPO to work with"""
+        (result, out, err) = self.runsubcmd("gpo", "del", self.gpo_guid, "-H", "ldap://%s" % os.environ["SERVER"], "-U%s%%%s" % (os.environ["USERNAME"], os.environ["PASSWORD"]))
+        self.assertCmdSuccess(result, "Ensuring gpo deleted successfully")
+        super(GpoCmdTestCase, self).tearDown()
diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index ca5bdd39c1c..58936e8d16f 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -405,6 +405,13 @@ planpythontestsuite("dc:local", "samba.tests.dcerpc.bare")
 planpythontestsuite("dc:local", "samba.tests.dcerpc.unix")
 planpythontestsuite("dc:local", "samba.tests.dcerpc.srvsvc")
 planpythontestsuite("dc:local", "samba.tests.samba_tool.timecmd")
+
+# We run this test against both AD DC implemetnations because it is
+# the only test we have of GPO get/set behaviour, and this involves
+# the file server as well as the LDAP server.
+planpythontestsuite("dc:local", "samba.tests.samba_tool.gpo")
+planpythontestsuite("plugin_s4_dc:local", "samba.tests.samba_tool.gpo")
+
 planpythontestsuite("dc:local", "samba.tests.samba_tool.processes")
 planpythontestsuite("dc:local", "samba.tests.samba_tool.user")
 planpythontestsuite("dc:local", "samba.tests.samba_tool.group")