samba - Jun 2024 - SeDiskOperatorPrivilege_Privilege

Hi there,

I wonder if this is relevant on Active Directory or maybe is a thing of older
NT4 style domains.

https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs#Granting_the_SeDiskOperatorPrivilege_Privilege

I have tried setting up a member server with ad-idmap, and used a user ?luis?
(with uidNumber) from the Unix Admins group (that has gidNumber).

Unix Admins group is a member of the Domain Admins group, that has no gidNumber.

The share looks like this:

8.0K drwxrwx---? ?2 luis unix admins 4.0K Jun??9 11:29 test

I also used:

vfs objects = acl_xattr
acl_xattr:ignore system acls = yes

I din?t need to grant any privilege(s). I just worked. Am I missing something ?

Maybe I need to grant the rights to users that are not admins so they can set up
shares / permissions? How is this reflected in the Windows ?security? tab of the
share if at all ?

I wonder if these rights should be granted per server (like I have always done)
? Or else in a DC ?

Thanks,

LP

On Sun, 9 Jun 2024 13:29:15 +0100
Luis Peromarta via samba <samba at lists.samba.org> wrote:
> Hi there,
> 
> I wonder if this is relevant on Active Directory or maybe is a thing
> of older NT4 style domains.
> 
>
https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs#Granting_the_SeDiskOperatorPrivilege_Privilege
> 
> I have tried setting up a member server with ad-idmap, and used a
> user ?luis? (with uidNumber) from the Unix Admins group (that has
> gidNumber).
> 
> Unix Admins group is a member of the Domain Admins group, that has no
> gidNumber.
> 
> The share looks like this:
> 
> 8.0K drwxrwx---? ?2 luis unix admins 4.0K Jun??9 11:29 test
> 
> I also used:
> 
> vfs objects = acl_xattr
> acl_xattr:ignore system acls = yes
> 
> I din?t need to grant any privilege(s). I just worked. Am I missing
> something ?
> 
> Maybe I need to grant the rights to users that are not admins so they
> can set up shares / permissions? How is this reflected in the Windows
> ?security? tab of the share if at all ?
> 
> I wonder if these rights should be granted per server (like I have
> always done) ? Or else in a DC ?
> 
> Thanks,
> 
> LP
You really are getting me thinking this weekend :-)

what is the output of:

net rpc rights list privileges SeDiskOperatorPrivilege -U administrator

When run as 'root' on your Unix domain member.

Depending on that, I think the wikipage may need amending.

Rowland