samba - Apr 2016 - chgrp "Domain Admins" on folder return invalid group "Domain Admins"

Dear Samba users and admins,

I am trying to deploy Samba4 as a domain controller and a file server and
having some issues.*

The domain have been well provisioned with option --use-rfc2307

I am then trying to create share by following this samba wiki
https://wiki.samba.org/index.php/Shares_with_Windows_ACLs

The problem is that i cannot succeed to change the group owner of the
folder I want to share as recommended  with the following command

chgrp "Domain Admins" /home/demo

When I try the chgrp command I receive and error  : invalid group "Domain
Admins'.

I then read the article that explain the subject about setting up rfc2307
in AD
https://wiki.samba.org/index.php/Setting_up_RFC2307_in_AD#NIS_Extensions_installed_inside_the_directory

and can confirm that  the "ypServ30" container exists.

I wonder what is happening and if anyone could help me.
Thank you for reading and helping
Regards


Jules HOUANTONON
*Phone* : (00229) 97578914
*Email *: juleshoueto at gmail.com
*Skype* : houantonon
*linkedin* : www.linkedin.com/in/jhouantonon/en

Hi Jules,
> I am trying to deploy Samba4 as a domain controller and a file server and
> having some issues.*
>
> The domain have been well provisioned with option --use-rfc2307
>
> I am then trying to create share by following this samba wiki
> https://wiki.samba.org/index.php/Shares_with_Windows_ACLs
>
> The problem is that i cannot succeed to change the group owner of the
> folder I want to share as recommended  with the following command
>
> chgrp "Domain Admins" /home/demo
>
> When I try the chgrp command I receive and error  : invalid group
"Domain
> Admins'.
>
> I then read the article that explain the subject about setting up rfc2307
> in AD
when using rfc2307, you have to define a uid or gid for all the users 
and groups that you plan to use on your fileserver. By default "domain 
admins" group has no gid, only a SID. So you have to set it up. If there 
is no gid, you can still see it with wbinfo -g, but you won't see it 
using getent group <groupname>.

HTH,

Denis
>
https://wiki.samba.org/index.php/Setting_up_RFC2307_in_AD#NIS_Extensions_installed_inside_the_directory
>
> and can confirm that  the "ypServ30" container exists.
>
> I wonder what is happening and if anyone could help me.
> Thank you for reading and helping
> Regards
>
>
> Jules HOUANTONON
> *Phone* : (00229) 97578914
> *Email *: juleshoueto at gmail.com
> *Skype* : houantonon
> *linkedin* : www.linkedin.com/in/jhouantonon/en
>
-- 
Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, bâtiment A
12 avenue Jules Verne
44230 Saint Sébastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr

Hi Denis,

Thank you for your mail.

I assigned the GID 10000 to the domain admins group through ADUC, and
wbinfo --info-group "domain admins" display the correct output.

But i am still not able to execute succesfuly #chgrp "Domain Admins"
/home/demo

And when i go to ADUC and try to open  the Unix Attribute of domain admins
group, i have the error "Unable to execute". But ADUC still display
the
contain of the tab with the correct NIS domain and the GID.

Is it normal ?

Thank you for helping.

Regards

On Tue, Apr 5, 2016 at 7:58 AM, Denis Cardon <
denis.cardon at tranquil-it-systems.fr> wrote:
> Hi Jules,
>
> I am trying to deploy Samba4 as a domain controller and a file server and
>> having some issues.*
>>
>> The domain have been well provisioned with option --use-rfc2307
>>
>> I am then trying to create share by following this samba wiki
>> https://wiki.samba.org/index.php/Shares_with_Windows_ACLs
>>
>> The problem is that i cannot succeed to change the group owner of the
>> folder I want to share as recommended  with the following command
>>
>> chgrp "Domain Admins" /home/demo
>>
>> When I try the chgrp command I receive and error  : invalid group
"Domain
>> Admins'.
>>
>> I then read the article that explain the subject about setting up
rfc2307
>> in AD
>>
>
> when using rfc2307, you have to define a uid or gid for all the users and
> groups that you plan to use on your fileserver. By default "domain
admins"
> group has no gid, only a SID. So you have to set it up. If there is no gid,
> you can still see it with wbinfo -g, but you won't see it using getent
> group <groupname>.
>
> HTH,
>
> Denis
>
>
>>
https://wiki.samba.org/index.php/Setting_up_RFC2307_in_AD#NIS_Extensions_installed_inside_the_directory
>>
>> and can confirm that  the "ypServ30" container exists.
>>
>> I wonder what is happening and if anyone could help me.
>> Thank you for reading and helping
>> Regards
>>
>>
>> Jules HOUANTONON
>> *Phone* : (00229) 97578914
>> *Email *: juleshoueto at gmail.com
>> *Skype* : houantonon
>> *linkedin* : www.linkedin.com/in/jhouantonon/en
>>
>>
> --
> Denis Cardon
> Tranquil IT Systems
> Les Espaces Jules Verne, bâtiment A
> 12 avenue Jules Verne
> 44230 Saint Sébastien sur Loire
> tel : +33 (0) 2.40.97.57.55
> http://www.tranquil-it-systems.fr
>
>

-- 
Jules HOUANTONON
*Phone* : (00229) 97578914
*Email *: juleshoueto at gmail.com
*Skype* : houantonon
*linkedin* : www.linkedin.com/in/jhouantonon/en

Hai Jules. 
> And when i go to ADUC and try to open  the Unix Attribute of domain admins
> group, i have the error "Unable to execute". 
Yeah, that can happen. 
I fixed this by setting first the GID on the groups. 
And then assigning the users, after a few clicks its gone. 
At least for me, you can safely ignore it, the setting wil be done. 

Try : 
getent group "domain admins" 
if that dont give results back, your unable to set with chgrp.
Then check you resolv.conf nsswitch.conf and make sure the GID is set in AD.


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Jules
Houantonon
> Verzonden: dinsdag 5 april 2016 12:06
> Aan: Denis Cardon
> CC: samba at lists.samba.org
> Onderwerp: Re: [Samba] chgrp "Domain Admins" on folder return
invalid
> group "Domain Admins"
> 
> Hi Denis,
> 
> Thank you for your mail.
> 
> I assigned the GID 10000 to the domain admins group through ADUC, and
> wbinfo --info-group "domain admins" display the correct output.
> 
> But i am still not able to execute succesfuly #chgrp "Domain
Admins"
> /home/demo
> 
> And when i go to ADUC and try to open  the Unix Attribute of domain admins
> group, i have the error "Unable to execute". But ADUC still
display the
> contain of the tab with the correct NIS domain and the GID.
> 
> Is it normal ?
> 
> Thank you for helping.
> 
> Regards
> 
> On Tue, Apr 5, 2016 at 7:58 AM, Denis Cardon <
> denis.cardon at tranquil-it-systems.fr> wrote:
> 
> > Hi Jules,
> >
> > I am trying to deploy Samba4 as a domain controller and a file server
> and
> >> having some issues.*
> >>
> >> The domain have been well provisioned with option --use-rfc2307
> >>
> >> I am then trying to create share by following this samba wiki
> >> https://wiki.samba.org/index.php/Shares_with_Windows_ACLs
> >>
> >> The problem is that i cannot succeed to change the group owner of
the
> >> folder I want to share as recommended  with the following command
> >>
> >> chgrp "Domain Admins" /home/demo
> >>
> >> When I try the chgrp command I receive and error  : invalid group
> "Domain
> >> Admins'.
> >>
> >> I then read the article that explain the subject about setting up
> rfc2307
> >> in AD
> >>
> >
> > when using rfc2307, you have to define a uid or gid for all the users
> and
> > groups that you plan to use on your fileserver. By default
"domain
> admins"
> > group has no gid, only a SID. So you have to set it up. If there is no
> gid,
> > you can still see it with wbinfo -g, but you won't see it using
getent
> > group <groupname>.
> >
> > HTH,
> >
> > Denis
> >
> >
> >>
> https://wiki.samba.org/index.php/Setting_up_RFC2307_in_AD#NIS_Extensions_i
> nstalled_inside_the_directory
> >>
> >> and can confirm that  the "ypServ30" container exists.
> >>
> >> I wonder what is happening and if anyone could help me.
> >> Thank you for reading and helping
> >> Regards
> >>
> >>
> >> Jules HOUANTONON
> >> *Phone* : (00229) 97578914
> >> *Email *: juleshoueto at gmail.com
> >> *Skype* : houantonon
> >> *linkedin* : www.linkedin.com/in/jhouantonon/en
> >>
> >>
> > --
> > Denis Cardon
> > Tranquil IT Systems
> > Les Espaces Jules Verne, bâtiment A
> > 12 avenue Jules Verne
> > 44230 Saint Sébastien sur Loire
> > tel : +33 (0) 2.40.97.57.55
> > http://www.tranquil-it-systems.fr
> >
> >
> 
> 
> --
> Jules HOUANTONON
> *Phone* : (00229) 97578914
> *Email *: juleshoueto at gmail.com
> *Skype* : houantonon
> *linkedin* : www.linkedin.com/in/jhouantonon/en
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba