samba - Feb 2019 - Computer Management - Share Security - No Read Access

No. If it was mentioned in any of the samba docs consulted, then I missed it.



On February 17, 2019 9:43:18 PM EST, Luke Barone via samba <samba at
lists.samba.org> wrote:
>Did you add the seSecurityPrivilege permission for Domain Admins as
>well?
>
>On Sun, Feb 17, 2019 at 3:13 PM Marco Shmerykowsky via samba <
>samba at lists.samba.org> wrote:
>
>> Can't figure out what is going on.
>>
>> I define the shares in smb.conf
>>
>> [share]
>> path = /server/share
>> read on = no
>>
>> When I go to "Computer Management" in Windows I
>> can create the share and I can set Share Permissions.
>>
>> However, when I go to the "Security" tab for the
>> share I get "You must have Read permissions to
>> view the properties of this object"
>>
>> I set SeDiskOperatorPrivilege for Domain Admins
>> on the server with the share.  I'm using a domain
>> admin account to access the snap-ins.
>>
>> What am I missing?
>>
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  https://lists.samba.org/mailman/options/samba

My domain admins group doesn't have this privilege and I can still set 
security permissions from Windows just fine, though I've been doing it 
using the default domain administrator account so I can't comment if 
that's different from using another domain admin account.

net rpc rights list privileges looks as follows in my case:

SeDiskOperatorPrivilege: SAMDOM\Domain Admins
SeSecurityPrivilege: BUILTIN\Administrators


On 18.02.2019 03:49, Marco J Shmerykowsky PE via samba
wrote:
> No. If it was mentioned in any of the samba docs consulted, then I missed
it.
>
>
>
> On February 17, 2019 9:43:18 PM EST, Luke Barone via samba <samba at
lists.samba.org> wrote:
>> Did you add the seSecurityPrivilege permission for Domain Admins as
>> well?
>>
>> On Sun, Feb 17, 2019 at 3:13 PM Marco Shmerykowsky via samba <
>> samba at lists.samba.org> wrote:
>>
>>> Can't figure out what is going on.
>>>
>>> I define the shares in smb.conf
>>>
>>> [share]
>>> path = /server/share
>>> read on = no
>>>
>>> When I go to "Computer Management" in Windows I
>>> can create the share and I can set Share Permissions.
>>>
>>> However, when I go to the "Security" tab for the
>>> share I get "You must have Read permissions to
>>> view the properties of this object"
>>>
>>> I set SeDiskOperatorPrivilege for Domain Admins
>>> on the server with the share.  I'm using a domain
>>> admin account to access the snap-ins.
>>>
>>> What am I missing?
>>>
>>>
>>> --
>>> To unsubscribe from this list go to the following URL and read the
>>> instructions:  https://lists.samba.org/mailman/options/samba
>> -- 
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba

Perhaps I missed a permission change on the shared directory?

It's supposed to be set to 0770, correct?  I created the
directory from root - can't recall what the permissions
where or if I chmod'd it.

Would a goof on that result in the inability to set permissions
when using the windows administrator account. Basically the
behavior I'm seeing?

On 2019-02-18 3:36 am, Viktor Trojanovic via samba
wrote:
> My domain admins group doesn't have this privilege and I can still set
> security permissions from Windows just fine, though I've been doing it
> using the default domain administrator account so I can't comment if
> that's different from using another domain admin account.
> 
> net rpc rights list privileges looks as follows in my case:
> 
> SeDiskOperatorPrivilege: SAMDOM\Domain Admins
> SeSecurityPrivilege: BUILTIN\Administrators
> 
> 
> On 18.02.2019 03:49, Marco J Shmerykowsky PE via samba wrote:
>> No. If it was mentioned in any of the samba docs consulted, then I 
>> missed it.
>> 
>> 
>> 
>> On February 17, 2019 9:43:18 PM EST, Luke Barone via samba 
>> <samba at lists.samba.org> wrote:
>>> Did you add the seSecurityPrivilege permission for Domain Admins as
>>> well?
>>> 
>>> On Sun, Feb 17, 2019 at 3:13 PM Marco Shmerykowsky via samba <
>>> samba at lists.samba.org> wrote:
>>> 
>>>> Can't figure out what is going on.
>>>> 
>>>> I define the shares in smb.conf
>>>> 
>>>> [share]
>>>> path = /server/share
>>>> read on = no
>>>> 
>>>> When I go to "Computer Management" in Windows I
>>>> can create the share and I can set Share Permissions.
>>>> 
>>>> However, when I go to the "Security" tab for the
>>>> share I get "You must have Read permissions to
>>>> view the properties of this object"
>>>> 
>>>> I set SeDiskOperatorPrivilege for Domain Admins
>>>> on the server with the share.  I'm using a domain
>>>> admin account to access the snap-ins.
>>>> 
>>>> What am I missing?
>>>> 
>>>> 
>>>> --
>>>> To unsubscribe from this list go to the following URL and read
the
>>>> instructions:  https://lists.samba.org/mailman/options/samba
>>> -- To unsubscribe from this list go to the following URL and read
the
>>> instructions:  https://lists.samba.org/mailman/options/samba