AD Admin no permission to change permissions

[AndrewH]

Hello,


I've made a big smb share for the office and have used Groups as a way of controlling which user gets access to which folder. We have recently added an AD to our network and I'm trying to get it to work with freeNAS.

I've managed to add my freeNAS box to my AD. When I type wbinfo -u or -g I get all the users and groups listed. The users and groups don't get listed in the interface though. From what I've read online the AD administrator should be able to change permission right out of explorer under the security tab.

My problem is that the administrator doesn't seem to have the rights to do any changes. When I click apply the first time it asks for a username and password again, and if I give it the administrator password that works, I get the error:
"An error occured while applying security information to: XXX
Failed to enumerate objects in container. Access is denied."

Also sometimes I get "the parameter is incorrect"

I don't seem to be able to find any thread where changing permissions asks for a second login and the administrator has no rights. Maybe worth mentioning my share has the following VFS objects active: zfs_space, aio_pthread . The permissions on the volume are currently set to owner: DOMAIN\Administrator and group wheel and Windows permissions
Inside the main Dataset I have other datasets that each belog to the corresponding groups I used for the permissions before.

Anyone had a similar problem where they can't actually set the permissions from windows?

 

[Ericloewe]

You presumably want to make the administrator group the owner of the relevant datasets.

 

[AndrewH]

Thanks for the info Ericloewe. I made administrator the owner of the datasets and I can change permissions right now. I also needed to ad zfsacl VFS object to samba to be able to setup the permissions. Without that VFS object I was getting "the paramenter is incorrect" error.

My current problem is that my linux clients, that were logged in with local(freeNAS) users, seem to have permissions problems, while the Windows users don't really have any issues.
When I list the ACLs I can see that the local group and the domain group are slightly different. I'll be debugging this this week. Hopefully I can get both groups to work. as intended.

 

[anodos]

zfsacl is required. If you try to manipulate ACLs without this VFS object, samba will try to change them like they're posix1e ACLs. This will of course fail because the samba is passing the wrong parameters.