similar to: Windows ACL clarification for Roaming Profiles share

Hi What should I find in audit log file when someone moves directory X to inside its sibling Y? I would expect something like "...|rename|ok|X|Y/X". Is that right? What "full_audit:success" options must be present to log this move operation? Regards Ethy

On Fri, 17 Feb 2017 07:58:58 +0100 Marc Muehlfeld <mmuehlfeld at samba.org> wrote: > Am 16.02.2017 um 17:27 schrieb Rowland Penny via samba: > > > However, SYSTEM is used in sysvol and Windows expects it. > > Clients, who are accessing the share, do not require it to be set on > the local filesystem the share uses on the server, because SYSTEM is > a local

On Sat, 18 Feb 2017 00:28:14 +0100 Marc Muehlfeld <mmuehlfeld at samba.org> wrote: > > Yes, because > 1.) It might be necessary _locally_ on the Windows DC > because some _local_ services (e. g. Virus scanners, > etc) may access the files _locally_ _on the DC itself_. > However if anything on the client (the OS or a user) > would access the share

On Thu, 16 Feb 2017 07:30:03 +0100 Marc Muehlfeld via samba <samba at lists.samba.org> wrote: > > On Windows, the SYSTEM account is used by services on the local host > (in your case, the local host is your Samba server). For example, > virus scanners might use it to get access to all files. However, > there is nothing on your Samba server that uses the SYSTEM account. >

hi, I'm evaluating to migrate our samba and ldap domain with samba 3 to samba 4 ad, and I have problem with roaming profile in samba 4. I have configured with https://wiki.samba.org/index.php/Implementing_roaming_profiles and for new profiles created works perfect, but my problem is that I have many users to migrate keeping profiles from samba 3 domain but our problem is that wiht migrated

I'm running Version 4.1.17-Debian as a DC on a Debian/Jessie AMD64 system. After rebuilding a domain with slightly different settings, roaming profiles stopped working. https://wiki.samba.org/index.php/Implementing_roaming_profiles contains a suggestion (see Troubleshooting roaming profiles) that gets them working again - deleting the user subkey from

I've set up a profiles share according to the wiki article: https://wiki.samba.org/index.php/Implementing_roaming_profiles Users are able to create new roaming profiles and they cannot browse each others' profiles, so all that is working. The only issue is that the group "domain admins" does not have privileges to read or delete user profiles. The acls on the profiles directory

> What uses the SYSTEM principal on the Sysvol share? Every computer or user the has a GPO set. Do read: https://technet.microsoft.com/en-us/library/dd851678(v=ws.11).aspx And see here, Security options : Computer Configuration , by default the task is run in the security context of the SYSTEM account. i noticed wbinfo --sid-to-name=S-1-5-18 on a 4.5.3 ADDC does not work but wbinfo

Am 17.02.2017 um 10:28 schrieb Rowland Penny via samba: > So, I give you a link to a Microsoft page that shows what accounts are > required for the profiles share and you choose to ignore it ???? Yes, because 1.) It might be necessary _locally_ on the Windows DC because some _local_ services (e. g. Virus scanners, etc) may access the files _locally_ _on the DC itself_.

Am 18.02.2017 um 10:50 schrieb Rowland Penny via samba: >> Yes, because >> 1.) It might be necessary _locally_ on the Windows DC >> because some _local_ services (e. g. Virus scanners, >> etc) may access the files _locally_ _on the DC itself_. >> However if anything on the client (the OS or a user) >> would access the share using the SYSTEM

On Fri, July 29, 2016 02:58, L.P.H. van Belle wrote: > I sniped the best parts, and added comment. > >   > >> > >> The situation is that assigning a new user the profile: > >> //DC/PROFILES/%USERNAME%  does not produce anything on the DC's > >> filesystem.  > > Correct that only dan when you first login with the user and then > logoff. >

On 07/09/15 22:07, Robert Moskowitz wrote: > Right now, RSAT seems not to be an option for me, as the only Win > systems here are XP... > > None of my PDC users were brought over with classicupdate. Perhaps > becuase my users are LINUX user accounts? And the home directories > map to /home/user ? Not having seen your old setup, but if you had a PDC, the users & groups

If you did read correct. You choose... OR posix acls setup OR windows acl setup. Do not mix up the both! My advice, use windows ACL setup for profiles, since "normaly" only windows computers use this, and for this, you can set the value: acl_xattr:ignore system acls = yes which makes the share even more windows acl compatible, and saves right hassle. Greetz, Louis >

On 22/12/15 12:25 AM, Gary Dale wrote: > I'm running Version 4.1.17-Debian as a DC on a Debian/Jessie AMD64 > system. > > After rebuilding a domain with slightly different settings, roaming > profiles stopped working. > https://wiki.samba.org/index.php/Implementing_roaming_profiles > contains a suggestion (see Troubleshooting roaming profiles) that gets > them

On 22/12/15 23:51, Gary Dale wrote: > On 22/12/15 12:25 AM, Gary Dale wrote: >> I'm running Version 4.1.17-Debian as a DC on a Debian/Jessie AMD64 >> system. >> >> After rebuilding a domain with slightly different settings, roaming >> profiles stopped working. I suppose the questions are, why did you rebuild the domain, what settings did you change and did

Hello, Am 15.03.2016 um 15:28 schrieb rawi: > Trying to fulfill the recommendation to separate the domain controller from > the file server and needing roaming profiles, I do not understand where I > have to declare and locate the Profiles and Home shares. > > Is it possible to declare the profiles and homes on the DC (smb.conf) and > point their paths to the member server?

On 16/03/16 13:34, rawi wrote: > Marc, thank you very much! > > Yes, I saw many tutorials, but many are showing how to set a DC and also the > shares on it self; what it is not recommended. > Others are showing how to manage Users with Windows tools. > >> If you set the attributes in the user objects, you can use ldbedit. To >> do it via GPO, you have to use the

On Fri, 7 Oct 2016 12:19:09 -0700 Mark Nienberg via samba <samba at lists.samba.org> wrote: > I've set up a profiles share according to the wiki article: > https://wiki.samba.org/index.php/Implementing_roaming_profiles > > Users are able to create new roaming profiles and they cannot browse > each others' profiles, so all that is working. The only issue is that >

Yes, it looks like this: https://wiki.samba.org/index.php/Implementing_roaming_profiles#Profile_share_using_Windows_ACLs but as I say, it works now that I have added the admin users, so I am satisfied for now. On Wed, Oct 12, 2016 at 11:31 AM, lingpanda101--- via samba < samba at lists.samba.org> wrote: > On 10/12/2016 1:34 PM, Mark Nienberg via samba wrote: > >> Well, the

Hello Community, i would like to configure roaming profiles with my samba4 dc. Im using this documenation: https://wiki.samba.org/index.php/Implementing_roaming_profiles Below the topic "Profile share using Windows ACLs", the first step ist setup a share named "Profiles". What specific share permissions ( not ACLs) must be applied for a the "Profiles" share?