samba - Sep 2011 - Samba4 and sysvol share

Hello.
I noticed that any domain user can delete the content of the shared folder
sysvol in the domain controller from a windows client.

How can I avoid that?

Greetings,
Felix

On 27/09/2011 13:07, felix at epepm.cupet.cu wrote:
> Hello.
> I noticed that any domain user can delete the content of the shared folder
> sysvol in the domain controller from a windows client.
>
> How can I avoid that?
>
> Greetings,
> Felix
>
What's the default windows behavior with this ?

Matthieu.

-- 
Matthieu Patou
Samba Team
http://samba.org

> Alright, here is update Felix.
>
> From a default install, at least on the server I set up,  sysvol is
Authenticated Users(read/execute), Domain Admins(all), System(all). It
and
> all children.
>
> As you dive deeper into folder structure there are some more  added like
Enterprise Admins and so forth(will full privileges).  I believe Owner
is
> also one as you get further down and it has no privileges set.
>
> Chris
>
Today I downloaded samba4 alpha 17 tar again.
I made a new virtual machine and I installed ntp 4.2.6, Bind9 9.8.0 and
Samba4 alpha 17 on Debian Lenny.


To see the content of sysvol from a Windows client I had to authenticate
using a user of my new domain, but again when I checked the Security Tab
in sysvol I saw that Everyone has special permissions, meaning Full
Access.

Does it have something to do with the filesystem support mentioned in the
HowTo???


Thanks in advance.
Felix.