samba - Jun 2015 - using the DC as a file Server in AD

You'll get problems with file permissions.

I've learned that you won't be able to just give a user access to a file
without also giving him read access to every folder, down from the root of the
share, that the file is located in. Example: You can't give accounting
access to \\samba\IT\management\budget.ods without also giving them rights to
\\samba\IT and \\samba\IT\management.

There may be other limitations, but I haven't found them.
 
-----Urspr?ngliche Nachricht-----
> Von:Pisch Tam?s <pischta at gmail.com>
> Gesendet: Die 9 Juni 2015 12:49
> An: samba at lists.samba.org
> Betreff: [Samba] using the DC as a file Server in AD
> 
> Hi,
> 
> there is a recommendation in the Samba AD DC howto: "We do not
recommend
> using the Domain Controller as a file Server." We have two sites. We
have
> two Samba3 servers now with ldap on site1, and one Samba3 BDC on site2. We
> have ~200 users, and around 50 clients connect to the servers at the same
> time on site1, and around 20 clients connect to the BDC on site2. On the
> BDCs there are file shares. If I upgrade to Samba4 and switch to AD, I
> would like to use DC2 and DC3 as file servers too. What issues can cause
> this setup, and how serious those are?
> 
> Thanks,
> Tamas.
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 831 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20150610/c6dfe4d4/attachment.pgp>

Am 10.06.2015 um 01:36 schrieb mots:
> I've learned that you won't be able to just give a user access to a
> file without also giving him read access to every folder, down from
> the root of the share, that the file is located in. Example: You
> can't give accounting access to \\samba\IT\management\budget.ods
> without also giving them rights to \\samba\IT and
> \\samba\IT\management.
It is sufficient to give them execute/traverse permission, then they 
access directories inside, but cannot read, not even list contents of 
the directories on the way to there.