similar to: [Not really Samba] Semantic was Permission Denied

2015-12-08 17:15 GMT+01:00 Rowland penny <rpenny at samba.org>: > On 08/12/15 16:02, mathias dufresne wrote: > >> On any Linux system where you want to be able to use AD users as system >> users you need to configure PAM. This because it is PAM which discuss with >> the tool you have chosen to retrieve users information from AD and then >> build system users

On any Linux system where you want to be able to use AD users as system users you need to configure PAM. This because it is PAM which discuss with the tool you have chosen to retrieve users information from AD and then build system users with these information. I think you also need to configure PAM for file servers connected to some domain (AD or NT4) for the underlaying system knows which user

On 25 November 2015 at 20:27, mathias dufresne <infractory at gmail.com> wrote: > Hi, > > You should post your smb.conf of that file server. You should also tell us > what kind of domain it is, in case of domain. That should help people to > help you. > > Cheers, > > mathias > > Hi and thank you for the help. I think I have solved this however my solution

To see which DC is used by Windows client: open a MSDOS console, type "set", look for LOGONSERVER=\\<your_dc> <your_dc> is the DC used to connect on. If issue comes from one DC I would have on sysvol synchronisation between DC, ACL on all sysvol, DNS entries (but I don't think that's a DNS issue if you have only GPO issue). 2016-03-29 14:51 GMT+02:00 Sébastien Le

Ole, Did you configure PAM to use AD as a users source ? You need to have Winbind or SSSD or nslcd configured to access your AD + configure PAM + configure nsswitch.conf. Then you will system users from AD (ie "getent passwd my-ad-account" would work). Cheers, mathias 2015-12-07 20:54 GMT+01:00 Rowland penny <rpenny at samba.org>: > On 07/12/15 19:42, Ole Traupe wrote: >

Ok... I am not a telephone guy... I was born after rotary phones, so forgive my ignorance in this matter. I am trying to get a really old rotary phone up and running with an ATA. Why? Who knows... just thought it would be cool. The problem is that it does not have an RJ11 connector, instead it has three wires (green,yellow,red). Does anyone know what that type of connector is called? Or

I'm not an expert in idmap (at all in fact :p) but I thought idmap stuffs were here to replace RFC2307 UID/GID declared into AD/LDAP objects. In others words, if you configure correctly idmap into smb.conf I expect you don't need any more declaring UID/GID for machine accounts. Anyway here my machines get access to their GPO: I tested one computer's GPO this morning, the one giving

Complete event id of : > But still, events log show a warning about kerberos ticket from LsaSrv > source and right after a permission denied on GPT.ini And a getfacl of the problem GPO SID please, i'll check. And a output of ipconfig /all on the problem pc. And question, dedicated IP or dhcp IP? Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba

I found this one. Check which one works for you. http://www.eventid.net/display-eventid-40960-source-LSASRV-eventno-8508-phase-1.htm Im sure this is not a samba configuration problem. Greetz, Louis > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens L.P.H. van Belle > Verzonden: dinsdag 29 maart 2016 16:18 > Aan: samba at

Ok, where your pc's get the DNS info from? Server : AD-DC + DNS Or Server : AD-DC + Some other server with DNS Can you give the output of dig NS your.domain.tld and tel us what what is. > -----Oorspronkelijk bericht----- > Van: samba [mailto:samba-bounces at lists.samba.org] Namens Sébastien Le Ray > Verzonden: dinsdag 29 maart 2016 16:31 > Aan: samba at

I dont see the difference, i think its all how you interper it. ( sorry about the spelling errors.. ) For example > wbinfo can get a whole list of all Samba users (I believe it can do that > with AD or NT4 or standalone Which is exact what i want. > wbinfo does not show system users.. which is also exact what i want. > wbinfo does not show system users, it > shows Samba

Hi all, I just add into my AD a user with different values for attributes "CN" and "name". Here is an extract of the LDIF used to add this user: ------------------------------------------------------------------------------------ dc202:~# egrep 'cn:|name:' mathias.ldif cn: Mathias Dufresne (CN) *name: mathias.dufresne*

Thank you Rowland for that reply, even if answer to Q2 is not a list of deplicated attributes but the schema which contains all attributes. To answer you: I'm trying to understand. I'm currently working for one company to help them design an AD hosted by Samba. I won't be there to manage it and they already have peoples working with LDAP trees, these coming with their own habits. I

Hi, I´m have a Samba 4 Domain Member that I use like a Proxy Server. I use Squid with NTLM Athentication and work perfecly. My problem is Squidguard with NTLM Authentication. If I use Samba 4.2.X in my Samba 4 Domain Controler I watch in Squid LOG only the user name but If I use Samba 4.1.x or 4.3.0 in my Domain Controler I watch in Squid LOG domain\\user name and Squidguard Authentication not

Wel, thats wrong, when i to the following.     wbinfo –u  i get all my users. wbinfo –g i get all my groups getent passwd username   i get my user:UID:GID:NAME:homedir:shel id username  gives also the correct info.. (uid= .. gid= ) groups =  etc..    And i use winbind on a DC. ( samba 4.2.5 sernet  on debian wheezy )     Greetz,   Louis         Van: mathias dufresne

I hate 'me too' replies - but I have also been struggling with this for some years in my multi-DC environment. (yes, replicated sysvol via lsyncd + rsync; permissions looked identical via getfacl last time I checked). Sometimes a client machine will run gpupdate just fine; other times it will fail, seemingly randomly. My next step was going to be to run wireshark on a client machine to

Here are my (little) view regarding shares accesses. I write that to clarify things. And it could really be of-topic as Louis seems to have gave solution. There are 2 levels of authorisation for accessing shares: the share level and FS level. For Sysvol I would keep everyone or replace it by "authenticated users" in paranoid mode as the latter refuse non-authenticated users. They are

I have created a [home] share: user at jupiter:~$ sudo ls -l /srv/samba/ total 24 drwxrwxr-x 2 root domain admins 4096 Nov 22 21:38 Demo drwxrwxr-x 2 root domain admins 4096 Nov 15 11:51 Finance drwxrwxr-x+ 2 root domain admins 4096 Nov 25 08:08 home drwxrwxr-x+ 9 root domain admins 4096 Nov 24 21:06 Printer_drivers When i try to set the ACLs in Windows I get "Permission Denied" In

Let me guess. You accessing your server like : \\servername\netlogon of \\servername\sysvol Well thats protected by windows these these days. Try with \\servername.domain.tld\netlogon or \\servername.domain.tld\sysvol Does that work? Yes, There is a whole chaper of this on the list somewhere.. Best is to read howto override this. https://adsecurity.org/?p=1405 and for you

On 19/10/15 16:46, mathias dufresne wrote: > AD from Samba or Microsoft is mainly a database for storing users (and > associated stuffs). It comes also with stuffs (protocols) to connect and > retrieve information. > > How the client uses these information is, as always, a choice from that > specific client. > > Your AD client is your Squid/Squidguard(ian) server. Its job