similar to: ACL set in Windows not set in Samba

>> Side question: How is it even possible that Windows "remembers" the >> ACL it sets but it's not visible on Linux when using getfacl? Windows ACLs are being stored in Extended Attributes using the acl_xattr vfs module. Linux ACLs are not there because the line acl_xattr:ignore system acls = yes is telling Samba not to write them. On 13 May 2018 21:25, Viktor

Hi Rowland, Thanks for replying again. On 13 May 2018 at 18:12, Rowland Penny via samba <samba at lists.samba.org> wrote: > On Sun, 13 May 2018 17:39:39 +0200 > Viktor Trojanovic via samba <samba at lists.samba.org> wrote: > > [...] > > > username map = /etc/samba/samba_usermap > > What is in the 'samba_usermap' ? > !root =

On Sun, 13 May 2018 17:39:39 +0200 Viktor Trojanovic via samba <samba at lists.samba.org> wrote: > Setup: Samba AD DC and Samba AD Member Server, Win10 clients only. > Samba version 4.8.1 > > Has something changed recently in the way ACL's are supposed to work? No > My existing shares work just fine but any ALC changes I make using > Windows are ignored in Samba.

Setup: Samba AD DC and Samba AD Member Server, Win10 clients only. Samba version 4.8.1 Has something changed recently in the way ACL's are supposed to work? My existing shares work just fine but any ALC changes I make using Windows are ignored in Samba. For example, I'm creating a new folder in Windows inside an existing share and I add user User1 or group Group1 in the security tab.

I just joined a freshly installed Linux machine with Samba 4.11.6 to my Windows AD, as a domain member. Followed the Wiki to a T, domain join without errors, I can enumerate users/groups, I can create shares and work with them from Windows (all that matters to me). Unfortunately, however, I don't seem to be able to change share security settings, i.e. ACL from Windows. Whenever I do so, I get

On 17.11.2015 18:05, Rowland Penny wrote: > On 17/11/15 16:57, Viktor Trojanovic wrote: >> Hi Mathias, >> >> Thanks for replying. It seems you're describing the situation on the >> AD DC. Computer and user mode access to my DC works fine and without >> any issues but I can't access the shares of my *member* server *in >> computer mode*. In user

Hai Viktor, > > Before posting my share permissions, can you please elaborate what you > mean with "have you removed authenticated users from your share"? I > never had any rights for "authenticated users" on any of my shares. Ah sorry, yes, that was "everybody" ( my error ) keep it > > Maybe I'm setting up shares in the wrong way? >

Hai Mourik Jan/Victor. > MJ definitely understands the problem I'm facing.... Yes, and i do to but you wont listen... ALL My client pc's, windows and linux computers, dont have any uid/gid assigned. My client pc's do access the DCs and multiple member servers with shares. I do distribute settings and files with GPO and these files are on a member server. Yes also as

Hi Mathias, Thanks for replying. It seems you're describing the situation on the AD DC. Computer and user mode access to my DC works fine and without any issues but I can't access the shares of my *member* server *in computer mode*. In user mode, it all works just fine. Viktor On 17.11.2015 17:19, mathias dufresne wrote: > Here are my (little) view regarding shares accesses. I

On 17/11/15 16:57, Viktor Trojanovic wrote: > Hi Mathias, > > Thanks for replying. It seems you're describing the situation on the > AD DC. Computer and user mode access to my DC works fine and without > any issues but I can't access the shares of my *member* server *in > computer mode*. In user mode, it all works just fine. > > Viktor > > On 17.11.2015

On 17/11/15 17:33, Viktor Trojanovic wrote: > [global] > > netbios name = FILESERVER > workgroup = SAMDOM > security = ADS > realm = SAMDOM.EXAMPLE.COM > dedicated keytab file = /etc/krb5.keytab > kerberos method = secrets and keytab > > username map = /etc/samba/samba_usermap > > idmap config *:backend = tdb > idmap config *:range =

On 27/02/15 21:00, Shane Robinson wrote: > Hi Rowland, > > I'm also not an expert, but with the amount of help you provide on the list, > I will defer to you. > > I'd love to know your rational for prefering the "change ownership to > administrator" approach over the "change group to Domain Admins approach". > If it's just gut, that's

Hello, i also fired up a new vm :) and configured "rid" backend. I followed all step in https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs. Sett the Attributs in smb.conf: vfs objects = acl_xattr map acl inherit = yes store dos attributes = yes Granting the SeDiskOperatorPrivilege: # net rpc rights grant "SAMDOM\Domain Admins" SeDiskOperatorPrivilege

On 27/02/15 19:09, Shane Robinson wrote: > Hello again List, Marc, and Louis! > > I'm afraid my message from yesterday may have been TL;DR. The short version > is as follows: > > Following the wiki's for AD member server (building from source on Debian > Wheezy) and Setting up shares with Windows acls did not give the expected > results > > First, I needed to

On 07/08/15 14:07, Aurélien Blachet wrote: > I guess you want getent group, so i give you both. But administrator is the only user of "domain admin" group with problems. OOPS, yes 'getent group Domain\ Admins' > [root at fileserver ~]# getent passwd Domain\ Admins > [root at fileserver ~]# getent group Domain\ Admins > domain admins:x:512: > > [root at

Here are my (little) view regarding shares accesses. I write that to clarify things. And it could really be of-topic as Louis seems to have gave solution. There are 2 levels of authorisation for accessing shares: the share level and FS level. For Sysvol I would keep everyone or replace it by "authenticated users" in paranoid mode as the latter refuse non-authenticated users. They are

Yes, LAN is the workgroup name. I made a test, i removed all the ACL with setfacl -b mysharename [root at fileserv]# getfacl share/ # file: share/ # owner: root # group: root user::rwx group::rwx other::--- Going to Windows side and Added "Domain Admins" in permission tab to read/modify/total Security Tab is denied even for my others account in domain Admins group looking again

On Fri, 26 Jan 2018 14:18:53 +0000 Rowland Penny via samba <samba at lists.samba.org> wrote: > On Fri, 26 Jan 2018 14:10:40 +0100 > Micha Ballmann <ballmann at uni-landau.de> wrote: > > > To set share windows permissions and windows acl i login on a > > windows 7 computer with the administrator user.|Open ||Computer > > Management and connect to the

I've been working at this for a few days now and I can't figure out what is broken. Google turns up similar issues from years back, but I hope this is a bug resurfacing. ACL entries are being deleted when files are saved. Here is an example: username: user1 group membership: Domain Users directory: /share/test file: test.xls getfacl /share # file: share # owner: DOMAIN+backupuser #

On 27/02/15 19:46, Shane Robinson wrote: > Hello all, > > Sorry about the top-posting. > > I have added the bit about the linking (YAY!, I'm helping!). > > Now if we can clear up the ACL issue, this will be a great day! > > Summary: To edit ACL's from Windows on a Debian Member server, we need to > either > 1) map the domain admin to root OR > 2) give