samba - Feb 2020 - Incorrect group name is displayed in folder permission list in Windows

Hello,

Samba file server
- OS = CentOS 7
- Samba version = 4.9 (from CentOS repos)

Samba AD server
- OS = Ubuntu 18.04.4 LTS
- Samba version = 4.7 (from Ubuntu repos)

Windows client OS = Windows 10 Pro 1909

Problem:
Incorrect group name is displayed in folder permission list in Windows, just
as described in this Windows support article
<https://support.microsoft.com/en-us/help/2928800/incorrect-group-name-is-displayed-in-folder-permission-list-in-windows>

Steps to reproduce:
- Create a domain local group
- Add a user to the domain local group
- Apply an ACL to a folder on the samba file server using the domain local
group as the principal
- Use RSAT to change the name of the domain local group in samba AD
- View the ACL - it still shows the old domain local group name


Is there any way to get the ACL to display the new group name?

I know I can create a new group, add users to the new group, use the new
group in an ACL, delete the old principal from the ACL, then finally delete
the old group, but that's a fair bit of work.

-- 

Mason Schmitt

Faster Than Light Computing Inc.

(250) 804-4365 Ext. 203

mason at ftlcomputing.com


*Relationship-Driven IT Support Services*

On 12/02/2020 10:36, Mason Schmitt via samba wrote:
> Hello,
>
> Samba file server
> - OS = CentOS 7
> - Samba version = 4.9 (from CentOS repos)
>
> Samba AD server
> - OS = Ubuntu 18.04.4 LTS
> - Samba version = 4.7 (from Ubuntu repos)
>
> Windows client OS = Windows 10 Pro 1909
>
> Problem:
> Incorrect group name is displayed in folder permission list in Windows,
just
> as described in this Windows support article
>
<https://support.microsoft.com/en-us/help/2928800/incorrect-group-name-is-displayed-in-folder-permission-list-in-windows>
>
> Steps to reproduce:
> - Create a domain local group
> - Add a user to the domain local group
> - Apply an ACL to a folder on the samba file server using the domain local
> group as the principal
> - Use RSAT to change the name of the domain local group in samba AD
> - View the ACL - it still shows the old domain local group name
>
>
> Is there any way to get the ACL to display the new group name?
>
> I know I can create a new group, add users to the new group, use the new
> group in an ACL, delete the old principal from the ACL, then finally delete
> the old group, but that's a fair bit of work.
>
Hi, can we start by seeing your smb.conf from the file server ?

Rowland

>
> Hi, can we start by seeing your smb.conf from the file server ?

######################################################
#                     Global Config                  #
######################################################

[global]
kerberos method = system keytab
workgroup = NAME
security = ads
realm = NAME.EXAMPLE.COM

# Logging
log file = /var/log/samba/%m.log
log level = 3

# We're using the RID method of mapping SIDs to UID/GID
idmap config NAME : range = 2000000-2999999
idmap config NAME : backend = rid
idmap config * : range = 10000-999999
idmap config * : backend = tdb

# Winbind
winbind use default domain = no
winbind refresh tickets = yes
winbind offline logon = yes
winbind enum groups = no
winbind enum users = no

# Map domain admin account to local root account
# and resolve other "net rpc" issues
username map = /etc/samba/user.map
bind interfaces only = yes
interfaces = lo eth0

# Enable Windows ACL support and make ACLs maximally compatible with NTFS
ACLs.
# Beyond setting the POSIX ownership and permissions for the share
directory, all ACLs
# should be managed in Windows.  See the comment in the Shares section
below for details
# about our standard share configuration (both on the Linux/POSIX side and
on the Windows side
vfs objects = acl_xattr recycle
acl_xattr:default acl style = windows
#acl_xattr:ignore system acls = yes     # PURE EVIL!  If you value your
sanity, don't use this option
map acl inherit = yes
store dos attributes = yes

# Samba version 4.9.x enabled extended attribute support, by default.
# This should be a good thing as it enables clients to make more
intelligent decisions.
# Unfortunately, customer reported that their old Windows 7 CE data
collection device,
# doesn't like the new settings, so we have to revert this feature.
ea support = no


######################################################
#             Global Security Settings               #
######################################################

# Disable SMB1, it's too old and too insecure to be used anymore
server min protocol = SMB2

# Samba AD users will not have access to a shell on linux hosts
template shell = /bin/false

# Netbios is dead, let's make it explicit
disable netbios = yes

# Win10 clients, that have negotiated an encrypted connection,
# are not able to successfully re-connect to shares,
# after being idle for an extended period of time.
# Disabling encryption resolves this issue.
smb encrypt = off

# Hide shares from users that don't have permission to see them
access based share enum = yes


######################################################
#       Automatic creation of home directories       #
######################################################

# !!! Important SELINUX configuration !!!
# For automatic creation of home directories to work,
# you must set two selinux booleans with the following commands:
# setsebool -P samba_create_home_dirs 1
# setsebool -P samba_enable_home_dirs 1
#
# Check that the selinux booleans were correctly set
# getsebool -a | grep samba | grep home
#
# For samba to serve the home dirs, they must be labeled with the
# selinux type 'samba_share_t'
# During the installation of this server a policy was created for the
# /srv/samba/ directory, which ensures all sub-folders/files are labeled
# with samba_share_t.  Therefore, as long as the home folders are located
# under /srv/samba/ this labelling will be taken care of.
# --- End of SELINUX configuration ---

# Home directories will be created at this path with %U being replaced by
# the username
template homedir = /srv/samba/Shares/Home/%U

# This share declaration works in conjunction with a GPO
# When a user logs in for the first time, a new home folder will
# be created for them on the file server and a mapped drive (H:) will
# be created in the Windows profile on their computer.  See the samba wiki
for
# details of how to create the GPO
#
https://wiki.samba.org/index.php/User_Home_Folders#Using_a_Group_Policy_Preference
[Home]
        path = /srv/samba/Shares/Home
        comment = Share for user home dirs
        guest ok = no
        read only = no
        # Recyle bin
        recycle:repository = %U/Recycle_Bin
        recycle:versions = Yes
        recycle:keeptree = Yes
        recycle:touch = Yes
        recycle:exclude = *.tmp,~$*
        recycle:exclude_dir = %U/Recycle_Bin

######################################################
#                  Standard Shares                   #
######################################################

[Shares]
       path = /srv/samba/Shares
       comment = Parent share sets top level Windows file permission
inheritance
       guest ok = no
       read only = no

[Backup]
       path = /srv/samba/Shares/Backup
       comment = Create separate folders, with locked down permissions, for
each application
       guest ok = no
       read only = no

[FTL]
       path = /srv/samba/Shares/FTL
       comment = FTL tools and documents to help with on-site service
       guest ok = no
       read only = no

[Software]
       path = /srv/samba/Shares/Software
       comment = Software for installation via GPO
       guest ok = no
       read only = no

[Top]
       path = /srv/samba/Shares/Top
       comment = Top level file share
       guest ok = no
       read only = no
        # Recyle bin
        recycle:repository = Recycle_Bin/%U
        recycle:versions = Yes
        recycle:keeptree = Yes
        recycle:touch = Yes
        recycle:exclude = *.tmp,~$*
        recycle:exclude_dir = Recycle_Bin