similar to: Permissions at the top of a Samba share

Am 2019-08-26 um 16:35 schrieb Rowland penny via samba: > On 26/08/2019 15:20, ? Peter Rindfuss via samba wrote: >> Hi, >> >> I have a question regarding permissions at the top of a share as seen >> from a Windows 10 client. >> >> We are using Samba 4.10.6-Debian (van Belle) on Debian 10 (Buster) with >> one AD controller and one file server. >>

Hi, i have setup an ad dc with samba 4.8, and then rigorously followed wiki tutorial at : https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs However, when following the last part (File System ACLs in the Back End), I don't get the expected results : [root at mydc ~]# getfattr -d /srv/samba/Demo/ doesn't yield anything and getfacl /srv/samba/Demo/ getfacl : suppression

On 27/08/2019 15:02, ? Peter Rindfuss wrote: > Am 2019-08-27 um 11:29 schrieb Rowland penny via samba: >> On 27/08/2019 09:58, ? Peter Rindfuss via samba wrote: >>> Am 2019-08-26 um 16:35 schrieb Rowland penny via samba: >>>> On 26/08/2019 15:20, ? Peter Rindfuss via samba wrote: >>>>> Hi, >>>>> >>>>> I have a question

On 01/07/2020 09:03, Enrico Morelli wrote: > On Wed, 1 Jul 2020 08:43:37 +0100 > Rowland penny via samba <samba at lists.samba.org> wrote: > >> On 01/07/2020 08:36, Enrico Morelli via samba wrote: >>> On Tue, 30 Jun 2020 10:28:41 -0700 >>> Jeremy Allison via samba <samba at lists.samba.org> wrote: >>> >>>> On Tue, Jun 30, 2020 at

Hi Rowland >Hi Marcio, we would need more info, where are you migrating the home folders from ? and where to ? I copied Windows Server 2008 folders and permissions with ROBOCOPY to my Samba 4 server. >I know you mentioned a Win 2008 server, are the home folders stored on that ? The personal folders were stored on it (Windows), but now they are on my new Samba 4 file server. >Another

> root at localhost:~# getfacl /home/samba/users/ > getfacl: Removing leading '/' from absolute path names > # file: home/samba/users/ > # owner: root > # group: root > user::rwx > group::rwx > other::rwx > root at localhost:~# samba-tool ntacl get /home/samba/users --as-sddl >

> You could try using a script Louis wrote, see here: > https://github.com/thctlo/samba4/blob/master/samba-check-set-sysvol.sh > > The 'idmap config' lines are nothing to worry about, you cannot set them on a DC, but, for some reason, testparm etc warns about > them. > > Rowland > Sorry, I should have said - I ran louis' script and set the acl's according

On 01.07.2020 13:35, Rowland penny via samba wrote: > On 01/07/2020 12:15, Robi. T. Wagner via samba wrote: >>> root at localhost:~# getfacl /home/samba/users/ >>> getfacl: Removing leading '/' from absolute path names >>> # file: home/samba/users/ >>> # owner: root >>> # group: root >>> user::rwx >>> group::rwx >>>

For completeness: The existing GPO: # samba-tool ntacl get --as-sddl \{07AF723D-5FFD-4807-B3C6-DFCE911B922A\}/ O:DAG:DAD:P(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;EA)(A;OICIIO;0x001f01ff;;;CO)(A;OICI;0x001f01ff;;;DA)(A;OICI;0x001f01ff;;;SY)(A;OICI;0x001200a9;;;AU)(A;OICI;0x001200a9;;;ED) The newly created GPO: # samba-tool ntacl get --as-sddl \{0C0B713E-EE65-4ACE-88AE-25125E2AAE00\}/

On 25/10/2020 20:37, Sonic wrote: > The reset allowed the current GPO to take effect, but right after > adding a new GPO (just named it, no editing, or linking) the > sysvolcheck fails: > # samba-tool ntacl sysvolcheck > ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception > - ProvisioningError: DB ACL on GPO directory >

> > However the acls via getfacl for the two GPO's are identical. Your sure? > I don't know if that will be problematic down the road or not. No, thats fine. But run on the 2 folders : samba-tool ntacl get --as-sddl FOLDERHERE Compair the 2 outputs. There must be a difference. Well, at least it works now for you.. Greetz, Louis

On 11/06/19 11:49, Rowland penny via samba wrote: > On 11/06/2019 11:38, Sebastian Arcus via samba wrote: >> >> On 11/06/19 11:07, Rowland penny via samba wrote: >>> On 11/06/2019 10:34, Sebastian Arcus via samba wrote: >>>> I've just upgraded a Samba AD server to 4.10.2 a few weeks ago from >>>> 4.x (I'm afraid I'm not sure the exact

Hi Rowland >> The folders must be mounted on a drive letter, ex: "H" in the windows >> clients workstations. >So, you are referring to Windows home Directories, now stored on a Samba >server. Next question, what sort of Samba server, a DC, Unix domain >member or what ? I have 2 DC Samba 4 (migrated from Windows 2008 Server) and the users' Home folders are stored

On 28/03/2023 19:47, Peter Carlson via samba wrote: > > On 3/28/23 11:22, Rowland Penny via samba wrote: >> >> >> On 28/03/2023 18:43, Peter Carlson via samba wrote: >>> bumping the log to 5, there are a few more lines right before >>> NT_STATUS_ACCESS_DENIED, could the EA error be a clue? >> >> I do not think so, that is what you are trying

I get this error when I run samba-tool ntacl sysvolcheck ProvisioningError('%s ACL on GPO directory %s %s does not match expected value %s from GPO object' % (acl_type(direct_db_access), path, fsacl_sddl, acl)) There are two GPO directories. One is the Default Domain Controllers Policy and one is the Default Domain Policy It looks like it's the Default Domain Policy that's

On Sun, Oct 25, 2020 at 3:31 PM Rowland penny via samba <samba at lists.samba.org> wrote: > OK, if you look at the end of the permissions, there is a '+' sign, this > shows that extended acls set, to see these: > > getfacl /usr/local/samba/var/locks/sysvol The difference in acls is that the non-working domain includes: user:3000001:r-x user:3000002:rwx user:3000003:r-x

Dear All, I've recently upgrade from samba 4.1.x to samba 4.2.14 and found that GPO are having issue Specifically when I'm adding new using they *never *got the gpupdate success fully. When I run samba-tool ntacl sysvolcheck or samba-tool ntacl sysvolreset But don't seem to got it fix.. Any suggestion? Thank in advance. #samba-tool ntacl sysvolcheck Processing section

On Sun, Oct 25, 2020 at 2:38 PM Rowland penny via samba <samba at lists.samba.org> wrote: > So '5035' is a computer, but what is '3000011' ? > You can find out by running this on the DC: > ldbsearch -H /path/to/idmap.ldb '(&(objectClass=sidMap)(xidNumber=3000011))' =================================== # ldbsearch -H /usr/local/samba/private/idmap.ldb

OK, now i've to start to move the big part of my users from my old NT-like domains to my new AD domain. I've setup roaming profile in the new domain following the wiki (https://wiki.samba.org/index.php/Roaming_Windows_User_Profiles, 'using windows ACL') and for new profiles works like a charm. But i've tried to move/copy old profile to the new domain, and seems work, with

On 26/08/2019 15:20, ? Peter Rindfuss via samba wrote: > Hi, > > I have a question regarding permissions at the top of a share as seen > from a Windows 10 client. > > We are using Samba 4.10.6-Debian (van Belle) on Debian 10 (Buster) with > one AD controller and one file server. > > The top directory of our main share on the file server has, on the Linux > level,