search for: sddls

...a/raw > It seems to do something. But I have no idea what :-) > > > Regards, > Marc FYI Marc, It is allowing 'Domain Computers' access to "CN=demo01,CN=Users,DC=samdom,DC=example,DC=com", the container will inherit ACES and 'Domain Computers' can read the sddls, list children and read control. :-) See here: https://msdn.microsoft.com/en-gb/library/windows/desktop/aa374928%28v=vs.85%29.aspx and here: https://msdn.microsoft.com/en-gb/library/windows/desktop/aa379602%28v=vs.85%29.aspx

Hallo We are trying to migrate from an old Windows server to a Linux samba system. As we are also replacing the old AD, we exported the permissions as SDDLs from the old share and set them to the new system, using "samba-tool". In general it seems to work quite well, but there is a strange behavior. ----- ----- root at smb-01:/# samba-tool ntacl set 'O:BAG:DUD:P(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A;OICI;FA;;;S-1-5-21-2875923508-401772753...

On Tue, 13 May 2025 12:38:25 +0200 Steffen Wurm via samba <samba at lists.samba.org> wrote: > Hallo > > We are trying to migrate from an old Windows server to a Linux samba > system. As we are also replacing the old AD, we exported the > permissions as SDDLs from the old share and set them to the new > system, using "samba-tool". > > In general it seems to work quite well, but there is a strange > behavior. > > ----- ----- > root at smb-01:/# samba-tool ntacl set > 'O:BAG:DUD:P(A;OICIIO;FA;;;CO)(A;OICI;FA;;;SY)(A...

...sericorde.fr> wrote: > >> Thanks Rowland for once again, an analysis that looks good. >> >> To you, >> is there a workaround at this stage ? > Not from myself,it has been years since I looked into this and only > really got has far as mapping the sysvol directory SDDLs on a 2012R2 > DC. It was at this point that I was basically told my python was crap > (it wasn't said in that term, but it came across to me in that way), so > I just gave up. > >> For others, let say someone that >> had dev this part, any chance to see a change in the n...

...ny via samba wrote: > On Tue, 13 May 2025 12:38:25 +0200 > Steffen Wurm via samba <samba at lists.samba.org> wrote: >> We are trying to migrate from an old Windows server to a Linux samba >> system. As we are also replacing the old AD, we exported the >> permissions as SDDLs from the old share and set them to the new >> system, using "samba-tool". >> >> In general it seems to work quite well, but there is a strange >> behavior. > > If you are setting the permissions with samba-tool, why are you not > checking them with samba-...

I need to create a couple of OUs under Users to separate my internal users from my external users that have LDAP backed accounts so I can put ACLs over the external users so I can limit what they can see on the tree. What options do I have to create the OUs and the ACLs in a Samba4 AD-DC domain?