samba - Jan 2021 - What's the use of SeDiskOperatorPrivilege?

Am 28.01.21 um 10:31 schrieb Rowland penny via samba:
> On 28/01/2021 09:11, Matthias Leopold via samba wrote:
>>
>> Thanks.
>> Is it correct, that "Full Control" for "Everyone"
is needed in a
>> shares permissions when the Domain Administrator wants to access it 
>> (and is mapped to root in "username map")?
> 
> 
> Yes, but more importantly, if you do not have 'Everyone' set on the
> share tab (which, as far as I can see, is the default) then your users 
> will not be able to access the permissions. Unless you have a valid 
> reason to alter the share tab (and I cannot think of one), leave it 
> alone, this is one of the mistakes that a lot of people make, they alter 
> the share tab.
Then why bothering with granting SeDiskOperatorPrivilege when share 
permissions shall not be modified at all (this was my original question)?
> 
> 
>> If Yes: Shall "Full Control" for "Everyone" be the
permanent setting
>> for a share permissions in this case or shall it only be added when 
>> needed?
>> Maybe all this is obvious to other people, I'm somehow missing a
piece
>> here in understanding how share permissions are meant to be configured.
> 
> The problem is that Microsoft called the tab that you might need to 
> modify 'security', a better name would have been 'NTFS
permissions'.
> 
I know that the settings in "Security" are essential. I always aimed
at
configuring the correct combination of "Share permissions" and 
"Security". There are instructions in the Microsoft docs about this.

Matthias

On 28/01/2021 10:06, Matthias Leopold via samba wrote:
>
> Then why bothering with granting SeDiskOperatorPrivilege when share 
> permissions shall not be modified at all (this was my original question)?

Because you are falling into the trap of thinking that the share tab has 
anything to do with setting the NTFS permissions on a share. Nearly 
every time anyone has problems setting permissions on a Samba from 
Windows, they have messed with the share tab, the favourite one is 
removing 'Everyone'. Just ensure that only 'Everyone' is set on
the
share tab with Full Control, Change and Read permissions set.

>
> I know that the settings in "Security" are essential. I always
aimed
> at configuring the correct combination of "Share permissions" and
> "Security". There are instructions in the Microsoft docs about
this.

I can only talk from experience, leave the share tab alone and set the 
permissions with the security tab.

Rowland