samba - Mar 2017 - Failed to enumerate objects in the container. Access is denied.

> 
> great, i will give it a try!
Hi Louis,

this worked quite well. I used the native Debian Version 4.2.14.

May it be possible, that the getent-problem has something to do with
pam-auth-update? I never did that before.

there are still two issues:

1. The path /home/samba does not yet exist, so all the login-paths lead to
nowhere. Is it a problem to put the samba shares, except profiles and users, to
another path? I like to use /fs for shortness.

2. The first share I have setup with RSAT as Domain Administrator worked like
expected. I could see the Users in the security tab and change them. I could
also change ownership succesfully. But after saving it all the others did not
work, i see "Failed to enumerate objects in the container. Access is
denied." again. When changing settings for the first share, it was the
same. So something happened there and it is still not usable.

Any ideas? Where could I look? Would 4.5 help? If so, is the update troubleless?
Should I do it for the dc's as well?

Best regards

martin

On Thu, 30 Mar 2017 15:52:06 +0200 (CEST)
martin via samba <samba at lists.samba.org> wrote:
> > 
> > great, i will give it a try!
> 
> Hi Louis,
> 
> this worked quite well. I used the native Debian Version 4.2.14.
> 
> May it be possible, that the getent-problem has something to do with
> pam-auth-update? I never did that before.
Possibly
> 
> there are still two issues:
> 
> 1. The path /home/samba does not yet exist, so all the login-paths
> lead to nowhere. Is it a problem to put the samba shares, except
> profiles and users, to another path? I like to use /fs for shortness.
Where ever you put the share must exist, it will not be created for
you.
You could use '/fs', you will just need to change the 'path ='
in the
share.
 
> 
> 2. The first share I have setup with RSAT as Domain Administrator
> worked like expected. I could see the Users in the security tab and
> change them. I could also change ownership succesfully. But after
> saving it all the others did not work, i see "Failed to enumerate
> objects in the container. Access is denied." again. When changing
> settings for the first share, it was the same. So something happened
> there and it is still not usable.
This sounds like a permissions problem, compare the permissions on the
one that works with the others that don't.
> 
> Any ideas? Where could I look? Would 4.5 help? If so, is the update
> troubleless? Should I do it for the dc's as well?
If you are going to update, you might as well use Louis's  deb's they
work very well.

Rowland

> Rowland Penny <rpenny at samba.org> hat am 30. März 2017 um 16:15
geschrieben:
> > 
> > May it be possible, that the getent-problem has something to do with
> > pam-auth-update? I never did that before.
> 
> Possibly
If so a hint in the Samba-Setup manual would be of help.
 
> > 
> > there are still two issues:
> > 
> > 1. The path /home/samba does not yet exist, so all the login-paths
> > lead to nowhere. Is it a problem to put the samba shares, except
> > profiles and users, to another path? I like to use /fs for shortness.
> 
> Where ever you put the share must exist, it will not be created for
> you.
> You could use '/fs', you will just need to change the 'path
=' in the
> share.
Yes, I only asked if there is something special about the paths proposed by the
setting in smb.conf. Some relation to security.
> > 
> > 2. The first share I have setup with RSAT as Domain Administrator
> > worked like expected. I could see the Users in the security tab and
> > change them. I could also change ownership succesfully. But after
> > saving it all the others did not work, i see "Failed to enumerate
> > objects in the container. Access is denied." again. When changing
> > settings for the first share, it was the same. So something happened
> > there and it is still not usable.
> 
> This sounds like a permissions problem, compare the permissions on the
> one that works with the others that don't.
I would have, but it works only once. After the first time changing the settings
it did not work a second time. Just once.
There are differences, though:

drwxrwx---+  2 RUBENS\gf root 4096 Mär 30 14:09 gf
drwxr-xr-x   2 root      root 4096 Mär 30 14:56 mrtx

The first share could be changed once, the second share could not. The changing
of the owner for /fs/gf worked well, but when I wanted to change it back I was
not allowed. Additionally I could not ever change /fs/mrtx. In the beginning
they have all been identical in smb.conf:

[gf]
    browseable = yes
    path = /fs/gf
    read only = no

[mrtx]
    browseable = yes
    path = /fs/mrtx
    read only = no

And I created the folders as root with
mkdir /fs/gf
mkdir /fs/mrtx

So there is no difference. I rebooted the server and windows 10, still failing
to enumerate objects in the container.

This one should be before the previous. 

> On Thu, 30 Mar 2017 15:52:06 +0200 (CEST)
> martin via samba <samba at lists.samba.org> wrote:
> 
> > >
> > > great, i will give it a try!
> >
> > Hi Louis,
> >
> > this worked quite well. I used the native Debian Version 4.2.14.
> >
Thanks, your welkom.
> 1. The path /home/samba 
Was an example for you, ( a copy past of my setup. ) 
> 2. The first share I have setup with RSAT as Domain Administrator
> > worked like expected
Good. 

I could see the Users in the security tab
No, please No, use groups. stay away from users. 
Best tip i can give always use groups. Much easier to manage. 

Why : change ownership ? 
Leave as is, its not needed to change that.

>i see "Failed to enumerate objects in the container. Access is
denied."
Thats because you did change the ownership and possible forgot to set the
"inheret" and reapply.

If you want checkout these: 
https://people.debian.org/~sathieu/samba/ 

These are the "fixed" 4.2.14 versions, and will be in debian soon. 

It's also possible you did hit the latest bug here. 
Or checkout my 4.5.3 package, ( soon updated to 4.5.8 ) 

Greetz, 

Louis