search for: 0x1200a9

...39;OK', which > completed without error. 'EVERYONE' is no longer listed on Windows, but > if I go to the machine that holds the share and run 'samba-tool ntacl > get /srv/acl3 --as-sddl', I get this: > > O:S-1-22-1-0G:S-1-22-2-0D:AI(A;OICI;FA;;;S-1-22-1-0)(A;OICI;0x1200a9;;;DU)(A;OICI;0x1200a9;;;DU)(A;;FA;;;S-1-22-2-0)(A;;FA;;;S-1-22-2-0)(A;;FA;;;S-1-22-1-0)(A;;FA;;;WD)(A;OICIIO;FA;;;CO)(A;OICIIO;0x1200a9;;;S-1-22-2-0)(A;OICIIO;0x1200a9;;;CG)(A;OICIIO;0x1200a9;;;WD) > > 'WD' is Windows speak for 'EVERYONE'. looks like a bug or misconfiguratio...

...d 'Apply' then 'OK', which completed without error. 'EVERYONE' is no longer listed on Windows, but if I go to the machine that holds the share and run 'samba-tool ntacl get /srv/acl3 --as-sddl', I get this: O:S-1-22-1-0G:S-1-22-2-0D:AI(A;OICI;FA;;;S-1-22-1-0)(A;OICI;0x1200a9;;;DU)(A;OICI;0x1200a9;;;DU)(A;;FA;;;S-1-22-2-0)(A;;FA;;;S-1-22-2-0)(A;;FA;;;S-1-22-1-0)(A;;FA;;;WD)(A;OICIIO;FA;;;CO)(A;OICIIO;0x1200a9;;;S-1-22-2-0)(A;OICIIO;0x1200a9;;;CG)(A;OICIIO;0x1200a9;;;WD) 'WD' is Windows speak for 'EVERYONE'. Rowland

...t; completed without error. 'EVERYONE' is no longer listed on Windows, > > but if I go to the machine that holds the share and run 'samba-tool > > ntacl get /srv/acl3 --as-sddl', I get this: > > > > O:S-1-22-1-0G:S-1-22-2-0D:AI(A;OICI;FA;;;S-1-22-1-0)(A;OICI;0x1200a9;;;DU)(A;OICI;0x1200a9;;;DU)(A;;FA;;;S-1-22-2-0)(A;;FA;;;S-1-22-2-0)(A;;FA;;;S-1-22-1-0)(A;;FA;;;WD)(A;OICIIO;FA;;;CO)(A;OICIIO;0x1200a9;;;S-1-22-2-0)(A;OICIIO;0x1200a9;;;CG)(A;OICIIO;0x1200a9;;;WD) > > > > 'WD' is Windows speak for 'EVERYONE'. > > looks like a bu...

...and fails on the Docker image. The difference in the returned ACL, being the default created by a root user uploaded with smbclient is: (VM) O:S-1-5-21-453318200-1757343522-2642056891-1000G:S-1-5-21- 453318200-1757343522-2642056891-513D:(A;;FA;;;S-1-5-21-453318200- 1757343522-2642056891-1000)(A;;0x1200a9;;;S-1-5-21-453318200- 1757343522-2642056891-513)(A;;0x1200a9;;;WD) (Docker) O:S-1-5-21-1647377796-1824335532-2881770359-1000G:S-1-22-2- 0D:(A;;FA;;;S-1-5-21-1647377796-1824335532-2881770359- 1000)(A;;0x1200a9;;;S-1-22-2-0)(A;;0x1200a9;;;S-1-22-2-0)(A;;FA;;;S-1- 5-21-1647377796-1824335532-288177035...

...      BUILTIN\Administrators Allow  268435456          BUILTIN\Administrators Allow  Write, ReadAndExecute, ChangePermissions, TakeOwnership, Synchronize          BUILTIN\Server Operators Allow  ReadAndExecute, Synchronize Audit  : Sddl   : O:BAG:SYD:PAI(A;OICIIO;GA;;;CO)(A;OICIIO;GXGR;;;AU)(A;;0x1200a9;;;AU)(A;OICIIO;GA;;;SY)(A;;FA;;;SY)(A;OICIIO;G          A;;;BA)(A;;0x1e01bf;;;BA)(A;OICIIO;GXGR;;;SO)(A;;0x1200a9;;;SO)   The one with numbers like CREATOR OWNER Allow  268435456 Are users/groups with special rights.     2) and just now created GPO, didnt touch it at al. Path   : Microsof...

...; > The difference in the returned ACL, being the default created by a > root user uploaded with smbclient is: > > (VM) O:S-1-5-21-453318200-1757343522-2642056891-1000G:S-1-5-21- > 453318200-1757343522-2642056891-513D:(A;;FA;;;S-1-5-21-453318200- > 1757343522-2642056891-1000)(A;;0x1200a9;;;S-1-5-21-453318200- > 1757343522-2642056891-513)(A;;0x1200a9;;;WD) Hi Andrew, just a question, you said that you were setting up a standalone server, so how have you got the RID for Domain Users ? Rowland > > (Docker) O:S-1-5-21-1647377796-1824335532-2881770359-1000G:S-1-22-2- > 0...

On 1/31/24 09:50, Peter Milesson via samba wrote: > The crucial problem here is, that Everyone (yes, really everyone) can > write to the root share. why don't you just change it? That's how it's supposed to work. -slow -- SerNet Samba Team Lead https://samba.plus/ Samba Team Member https://samba.org/ SAMBA+ packages https://samba.plus/ SerNet

...1-5-21-33300784-995546578-3414580312-1121D:AI(A;OICI;FA;;;S-1-22-1-0)(A;;FA;;;S-1-5-21-33300784-995546578-3414580312-1121)(A;;FA;;;DA)(A;;FA;;;S-1-5-21-33300784-995546578-3414580312-1121)(A;;FA;;;S-1-5-21-33300784-995546578-3414580312-1121)(A;;FA;;;S-1-22-1-0)(A;;FA;;;WD)(A;OICIIO;FA;;;CO)(A;OICIIO;0x1200a9;;;DA)(A;OICIIO;0x1200a9;;;CG)(A;OICIIO;0x1200a9;;;WD) The share mounts and I am a member of the correct groups CARLSON\peter at u2gui:~$ cat /etc/fstab //fs.carlson.lab/test /mnt/test cifs credentials=/root/smbcreds,multiuser,sec=ntlmssp,_netdev 0 0 //fs.carlson.lab/test on /mnt/...

Hi Samba List, hope you're doing well all. We have realized a security audit of our Samba4 Active Directory. It returns that the security descriptors options of all our GPO objects are wrong. They should be : SE_DACL_AUTO_INHERITED SE_DACL_PRESENT instead of this, the options are by default : SE_DACL_PROTECTED SE_DACL_PRESENT We can change the options, but the "sysvolreset"

On Thu, May 23, 2024 at 09:42:53AM +1200, Andrew Bartlett via samba wrote: >After 23 years answering questions here, I figure it might be time for >me to ask one. > >As mentioned here: >https://lists.samba.org/archive/samba-technical/2024-May/138969.html I >am working with a client to improve a Go SMB client library. > >They want to manipulate ACLs on SMB, which is a very

...let it be there> You need to remove the gidNumber from Domain Admins. If you add any GPOs to 'sysvol' (other than the two default ones), they will be > created in 'sysvol\DOMAIN.LOCAL\Policies\{GUID}' > And the Sddl will be: > > O:DAG:DAD:PAI(A;OICIIO;FA;;;CO)(A;OICI;0x1200a9;;;ED)(A;OICI;0x1200a9;;;AU)(A;OICI;FA;;;SY)(A;OICI;FA;;;DA)(A;OICI;FA;;;S-1-5-21-2695348288-4157658249-429813502-519) > > The important bit (as far as the Unix OS is concerned) is 'O:DAG:DA', > which if we expand it becomes 'O:DA G:DA' > O = Owner > G = Group > D...

...3000000, while the "Administrators" group has > the group ID 3000002. I corrected the group ID assigned to the sysvol > folder on both DCs and now I can edit the GP objects with the GPO > editor. The permissions set on the sysvol directory are: O:LAG:BAD:P(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;SO)(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU) Which in a more readable form is: Owner:LOCAL_ADMIN Group:BUILTIN_ADMINISTRATORS D:P(Allow;Full control;;;BUILTIN_ADMINISTRATORS)(Allow;Read and Execute,Inherited;;;SERVER_OPERATORS)(Allow;Full control;;;LOCAL_SYSTEM)(Allow;Read and Execute,Inherited;;;_...

...DOMAIN CONTROLLERS Allow ReadAndExecute, Synchronize NT AUTHORITY\Authenticated Users Allow ReadAndExecute, Synchronize NT AUTHORITY\SYSTEM Allow FullControl HOME\Domain Admins Allow FullControl HOME\Enterprise Admins Allow FullControl Audit : Sddl : O:DAG:DAD:PAI(A;OICIIO;FA;;;CO)(A;OICI;0x1200a9;;;ED)(A;OICI;0x1200a9;;;AU)(A;OICI;FA;;;SY)(A;OICI;FA;;;DA)(A;OICI;FA;;;S-1-5-21-2695348288-4157658249-429813502-519) Rowland

...let it be there> You need to remove the gidNumber from Domain Admins. If you add any GPOs to 'sysvol' (other than the two default ones), they will be > created in 'sysvol\DOMAIN.LOCAL\Policies\{GUID}' > And the Sddl will be: > > O:DAG:DAD:PAI(A;OICIIO;FA;;;CO)(A;OICI;0x1200a9;;;ED)(A;OICI;0x1200a9;;;AU)(A;OICI;FA;;;SY)(A;OICI;FA;;;DA)(A;OICI;FA;;;S-1-5-21-2695348288-4157658249-429813502-519) > > The important bit (as far as the Unix OS is concerned) is 'O:DAG:DA', > which if we expand it becomes 'O:DA G:DA' > O = Owner > G = Group > D...

...he cmd we run is something like following: /usr/bin/smbcacls -U 'Domain\Administrator'%'pwd' '//win_server/testshare' 'TestFolder\Test.txt' -S 'REVISION:1','ACL:win_server\Administrator:DENIED/0/0x100116','ACL:win_server\Administrator:ALLOWED/0/0x1200a9','ACL:Domain\Administrator:ALLOWED/16/FULL' The smbcacls cmd worked before till recently. Due to the recent Windows patch which disables SMB v1, we have to add the following line into the [global] section in smb.conf file on Linux machine so that the smbcacls can talk to the Windows...

...NT AUTHORITY\SYSTEM Allow  FullControl > > > >          ROTTERDAM\Domain Admins Allow  FullControl > > > >          ROTTERDAM\Enterprise Admins Allow  FullControl > > > > Audit  : > > > > Sddl   : > > > O:DAG:DAD:PAI(A;OICIIO;FA;;;CO)(A;OICI;0x1200a9;;;ED)(A;OICI;0x1200a9;;;AU > )(A;OICI;FA;;;SY)(A;OICI;FA;;;DA)(A;OICI;FA;;;EA) > > Now do you believe me when I say Domain Admins shouldn't have a > gidNumber ? > > Rowland

...bits: 0x1ff Permissions: 0x1f01ff: SYNCHRONIZE_ACCESS WRITE_OWNER_ACCESS WRITE_DAC_ACCESS READ_CONTROL_ACCESS DELETE_ACCESS SID: S-1-22-1-0 ACE type: ACCESS ALLOWED (0) flags: 0 Specific bits: 0xa9 Permissions: 0x1200a9: SYNCHRONIZE_ACCESS READ_CONTROL_ACCESS SID: S-1-22-2-0 ACE type: ACCESS ALLOWED (0) flags: 0 Specific bits: 0xa9 Permissions: 0x1200a9: SYNCHRONIZE_ACCESS READ_CONTROL_ACCESS SID: S-1-1-0 Owner SID:...

Hello all, to return to the original topic: My original problem was that I could not edit GP objects with the GP Editor, even as Domain admin. I always got "access denied". A sysvolcheck returned no errors and the Windows "Security" tab for the object in question on the sysvol share looked correct. I now found out that the group id of the sysvol folder (and everything

...1-5-21-33300784-995546578-3414580312-1121D:AI(A;OICI;FA;;;S-1-22-1-0)(A;;FA;;;S-1-5-21-33300784-995546578-3414580312-1121)(A;;FA;;;DA)(A;;FA;;;S-1-5-21-33300784-995546578-3414580312-1121)(A;;FA;;;S-1-5-21-33300784-995546578-3414580312-1121)(A;;FA;;;S-1-22-1-0)(A;;FA;;;WD)(A;OICIIO;FA;;;CO)(A;OICIIO;0x1200a9;;;DA)(A;OICIIO;0x1200a9;;;CG)(A;OICIIO;0x1200a9;;;WD) > I take that 'S-1-5-21-33300784-995546578-3414580312-1121' is the SID for 'videousers'. > The share mounts and I am a member of the correct groups > > CARLSON\peter at u2gui:~$ cat /etc/fstab > //fs.ca...

Hello, im trying to setup a share using windows acls. I followed the step ins https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs but hanging at "Adding a Share" # mkdir -p /srv/samba/Demo/ # chown root:"Domain Admins" /srv/samba/Demo/ *--> chown: ungültige Gruppe: »root:Domain Admins“* # net rpc rights list privileges SeDiskOperatorPrivilege -U