Help with auxiliary parameters

[pechkin000]

HI,
I have been banging my head against it and I cant figure out the correct syntax. For one of my SMB shares i need to explicitly deny one group from AD. I found valid users = usernames parameter but i need the opposite. I would also prefer if I could use the group name. Can I specify AD users/groups via auxiliary parameters? If yes would the syntax be Domain\Username? Any help would be appreciated.
Thanks

 

[anodos]

HI,
I have been banging my head against it and I can't figure out the correct syntax. For one of my SMB shares i need to explicitly deny one group from AD. I found valid users = usernames parameter but i need the opposite. I would also prefer if I could use the group name. Can I specify AD users/groups via auxiliary parameters? If yes would the syntax be Domain\Username? Any help would be appreciated.
Thanks

You can set a non-inheriting ACE ('this folder only') at the top of the share denying access. Just use a windows client, right-click on the share, click on the 'security' tab and use the editor. Just make sure that you don't set it recursively.

 

[Johnny Fartpants]

valid users = @"ADS\groupname"

 

[anodos]

valid users = @"ADS\groupname"

It's better to not use valid users.

 

[Johnny Fartpants]

It's better to not use valid users.

I agree. But for creating automated home shares it's quite useful.

 

[pechkin000]

Thank you guys! I understand that valid users would allow access to a group, but is it possible to set a deny parameter rather than allow?

 

[anodos]

https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html#INVALIDUSERS

 

[pechkin000]

WOW, thank you, this is what I was looking for!
Cheers!