similar to: Unable to use BUILTIN AD groups on a domain member

On 25 September 2019 17:25, Rowland penny wrote: > On 25/09/2019 16:25, Roy Eastwood via samba wrote: > > I have set up a share on a domain member server and am attempting to set the ACLs from a domain-joined Windows 7 computer as > per the > > WiKi at https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs > > > > I want to use one of the BUILTIN

On 25/09/2019 16:25, Roy Eastwood via samba wrote: > I have set up a share on a domain member server and am attempting to set the ACLs from a domain-joined Windows 7 computer as per the > WiKi at https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs > > I want to use one of the BUILTIN groups, Backup Operators to be able to have Full Control on files in the share (as

> You could try using a script Louis wrote, see here: > https://github.com/thctlo/samba4/blob/master/samba-check-set-sysvol.sh > > The 'idmap config' lines are nothing to worry about, you cannot set them on a DC, but, for some reason, testparm etc warns about > them. > > Rowland > Sorry, I should have said - I ran louis' script and set the acl's according

I have a samba DC based on Debian Buster running samba 4.12.2 from Louis' repo. A second DC on Raspbian buster is running samba 4.12.0. I have sysvol replication working using rsync/unison as per the WiKi. I wasn't having any issues until I tried to edit a GPO and found that all the acl settings had disappeared. This may have happened when I upgraded the DCs from 4.11.x to 4.12.x

> > On the file serever: > > Collected config --- 2019-07-03-10:27 ----------- > > > > Hostname: srv > > DNS Domain: a.b.hu > > FQDN: srv.a.b.hu > > ipaddress: 10.0.3.15 192.168.0.8 > > ----------- > > Samba is running as a Unix domain member > > ----------- > > > > This computer is running Debian 10.0 x86_64 > >

> It's needed after every GPO addition and edit. There must be a root > cause to hunt down somewhere. Or is it a bug in 4.13.0 ? Yes, and no. Yes, its a bug. No, in my opionion its an old setting thats just needs some updating. Try this. samba-tool ntacl set "O:LAG:BAD:P(A;OICI;0x001f01ff;;;BA)(A;OICI;0x001200a9;;;SO)(A;OICI;0x001f01

Roy, Im still wondering what your problem might be/where its coming from. But we know it's interface/network related, only thing is Samba should not coredump. So i had a good look below to see where im missing what. And i dont see much to work with. I have 2 possible options where, where a problem might be. 1) samba start before network is online. A possible workaround is add in all

Hi, I have a Debian Stretch machine with Louis' samba 4.7.1 package installed. I have configured it as a member server and joined it to my test domain. I tried the idmap rid back end and all worked ok, but am now trying the idmap ad back end. I have users' home folders saved to a users share on the member server, configured to allow auto-creation of home folders when the windows user

Hello! I am following the how to https://wiki.samba.org/index.php/User_home_drives But even though there reported a process for User X does not access the home of Y User, this is happening root at fileserver:/srv/samba# getfacl home/ # file: home/ # owner: root # group: root user::rwx user:root:rwx user:administrator:rwx group::r-x group:root:r-x group:5007:r-x group:domain\040admins:rwx

> >>>> Run this : getfacl /home/users > >>> getfacl: Removing leading '/' from absolute path names > >>> # file: home/users > >>> # owner: root > >>> # group: A\\domain\040admins > >>> user::rwx > >>> user:root:rwx > >>> user:10512:rwx > >>> group::rwx > >>>

Hi folks, It seems that the setting acl_xattr:ignore system acls = yes reduces Windows compatibility when defined for a share. In all attempts I have used Windows tools (except editing smb.conf) Assume there is a share, where the files and folders in the share root should at least be readable by anybody having access to the share. For the sake of simplicity the following permissions apply on

Dear all, I have set a small test domain in virtualbox. 1. Samba AD DC on Debian bullseye testing 4.11.6 2. Samba domain member Debian Stretch 4.10.14 3. Windows 10 Enterprise evaluation version 1909 Roaming profiles with folder redirection setup. PAM working. The above was setup basically using guides in wiki.samba.org, with nearly the only thing changed was SAMDOM to SAMBA. "Unix

On 19/05/2020 21:29, Roy Eastwood wrote: >> You could try using a script Louis wrote, see here: >> https://github.com/thctlo/samba4/blob/master/samba-check-set-sysvol.sh >> >> The 'idmap config' lines are nothing to worry about, you cannot set them on a DC, but, for some reason, testparm etc warns about >> them. >> >> Rowland >> > Sorry, I

Does you filesystem support extended attributes? What does "|getfattr -n security.NTACL |filename" return?|| On 30.01.2024 16:13, Peter Milesson wrote: > Hi folks, > > It seems that the setting acl_xattr:ignore system acls = yes reduces > Windows compatibility when defined for a share. In all attempts I have > used Windows tools (except editing smb.conf) > > Assume

I've set up a profiles share according to the wiki article: https://wiki.samba.org/index.php/Implementing_roaming_profiles Users are able to create new roaming profiles and they cannot browse each others' profiles, so all that is working. The only issue is that the group "domain admins" does not have privileges to read or delete user profiles. The acls on the profiles directory

On 28/03/2023 15:08, Peter Carlson via samba wrote: > > On 3/28/23 01:33, Rowland Penny via samba wrote: >> >> >> On 28/03/2023 01:59, Peter Carlson via samba wrote: >>> I am having troubles with windows ACLs.? I have been following the >>> wiki >>> (https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs) and must have messed

Hai, Ok, i expected a bit different outputs. On my DC, i use /home/samba/sysvol and /home/samba/netlogon. This is what i expected. getfacl /home/samba/ getfacl: Removing leading '/' from absolute path names # file: home/samba/ # owner: root # group: BUILTIN\134administrators user::rwx user:root:rwx group::rwx group:BUILTIN\134administrators:rwx

On 25/10/2020 20:37, Sonic wrote: > The reset allowed the current GPO to take effect, but right after > adding a new GPO (just named it, no editing, or linking) the > sysvolcheck fails: > # samba-tool ntacl sysvolcheck > ERROR(<class 'samba.provision.ProvisioningError'>): uncaught exception > - ProvisioningError: DB ACL on GPO directory >

Hello, I recently upgraded from centos release 7.3 to 7.4 and samba 4.6.2 and noticed that when files/folders are added or manipulated from a windows PC via the share, extra ACLs get applied and i cannot figure out why. Nothing has changed configuration wise and i have tried all variations i can think of of different map settings, downgraded several releases of samba (4.4.4 failed to load due to

Hello Luis tomorrow i'm not in office, reply to you thursday One question : who is owner and whats rights for dir     /home     /home/samba     /home/samba/sysvol because, from windows client, user into domain admins, when i change in security tab, explorer always crash bye Il 06/11/2018 17:16, L.P.H. van Belle via samba ha scritto: > Ok, next, > > From a windows pc connect to