samba - Mar 2015 - Roaming profiles via GPO and matching rights on a folder

Hello,

I set up Samba as an AD-controller as described in the documentation, that is
with "samba-tool domain provision --use-rfc2307 --interactive",
https://wiki.samba.org/index.php/Samba_AD_DC_HOWTO. I used Debian 7.8 as basis
and the current packages (last Friday) from Sernet for Samba 4.1.

Now I try to set up roaming profiles as described by Microsoft here:
https://technet.microsoft.com/en-us/library/jj649079.aspx

Though I set the folder rights according to step 3 in the Microsoft
documentation my users cannot create their profiles. When I give them full
access for testing purposes it does work. This gives me the idea that there is a
problem with setting the described folder rights on the Samba share.

Can you give me a hint, what might need to be additionally done?

Thanks in advance and best regards
Andreas


-- 
Andreas Bockhold

Base2 IT Consult GmbH
Hauptstra?e 18c
D-21465 Wentorf

Handelsregister-Nr.: HRB 10775 HL
Steuernummer: 22/294/66660
USt-Id.: DE275577708

Hello Andreas,

Am 19.03.2015 um 08:54 schrieb Andreas Bockhold:
> Now I try to set up roaming profiles as described by
> Microsoft here:
> https://technet.microsoft.com/en-us/library/jj649079.aspx
> 
> Though I set the folder rights according to step 3 in
> the Microsoft documentation my users cannot create their
> profiles. When I give them full access for testing
> purposes it does work.

Have you seen
https://wiki.samba.org/index.php/Samba_%26_Windows_Profiles#Implementing_roaming_profiles_with_Samba



Regards,
Marc

Hello Marc,

Am 19.03.2015 um 22:48 schrieb Marc Muehlfeld:
> Am 19.03.2015 um 08:54 schrieb Andreas Bockhold:
> > Now I try to set up roaming profiles as described by Microsoft here:
> > https://technet.microsoft.com/en-us/library/jj649079.aspx
> > 
> > Though I set the folder rights according to step 3 in the Microsoft 
> > documentation my users cannot create their profiles. When I give them 
> > full access for testing purposes it does work.
> 
> Have you seen
>
https://wiki.samba.org/index.php/Samba_%26_Windows_Profiles#Implementing_roaming_profiles_with_Samba
Thanks for your reply - sorry for my delay!

Yes, I did follow the instructions, specifically mounting the filesystem (ext4)
appropriately and giving the SeDiskOperatorPrivilege to the admin group.

I chose the Windows ACLs way. There I used the rights proposed by Microsoft (see
above) - not those by the Samba team. There seem to be some differences?
Especially the "samba way" dows not provide SYSTEM with it's
rights? Can you give advice, which and why to use?

Best regards,
Andreas