Hey guys, I am beating my head against the wall here. I've searched high and low, found some threads that were dead on to my problems (https://forums.freenas.org/index.php?threads/creator-owner-permissions-broken-wrong.22166/), but alas no solution. Others, including the ever-present cyberjock, have seemed to get this to work fine so I am hopeful to come to a resolution.
Setup is a Dell 2950 running Freenas 9.10.2-U1, fresh install, test system, raid10 disks. Freenas has been joined to the domain, and all of that portion works. IE, I have domain users in my Owner user/group drop down under Dataset Permissions, I can ping my freenas box and dcs, and wbinfo --ping-dc succeeds, etc.
I have performed these steps in order, as I believe them to be correct and best practices.
Root dataset (not nested, as I've seen this could be a potential bug), set permissions to user DOMAIN\jadmin (my admin user) and group DOMAIN\domain admins. I have used 'set permission recursively' many times, though there is no data to start with.
Share settings: I have tried with and without Apply Default Permissions
From there I move to my windows box, with Computer Management launched as my DOMAIN\jadmin user. Under advanced, I set the recommended settings as per folder redirection guidelines (https://blogs.technet.microsoft.com...s-for-redirected-folders-or-home-directories/ for reference) Everyone ends up with Create Folder/Append Data, List Folder/Read Data, Read Attribs, Traverse folder/Execute file
To be clear and make sure these are actually set, I manually set myself as owner (though I already am listed), then delete any previous settings and only leave it configured as such:
On the Windows AD side, I have a GPO that points to \\rtfserver\data2 (freenas box and share name) and create a brand new test user with that policy. I then login with my test user.
The root user folder for redirection is created, ie: \\rtfserver\data2\justin.test4, but my user that just logged in and created it has no rights to access it. As you can see, the folder is created but I cannot enter it and get this unusual message.
In fact, that user cannot reliably create any folder in data2 even though they should (as everyone) have rights to create a folder. Often, it will create 5 New Folders if you attempt to create one, named New Folder, New Folder (2), etc. That user justin.test4 will not be able to modify or view or enter those folders that I just created as him. Note I only clicked "Create New Folder" once.
However, my admin user has full rights to all folders, can create and delete. The folder that was created by justin.test4 shows as properly owned, but does not allow justin.test4 any access.
Oddly, if I manually add user justin.test4 with Full Control over This subfolder and Files, it will ALSO add an inherited Full Control for This folder Only as justin.test4 (highlighted and circled in red). Note that is done automatically and shows up as soon as I manually add the Full Control permission (denoted by Inherited from None)
Signing out as justin.test4 and relogging in and things behave better.
This isn't, however, good enough for production use. Unfortunately it isn't something we've caught, and we're pretty far down the path of integrating Freenas into our system as a low-cost replacement for Windows servers that do nothing but file share at our branch locations. This server is already on site and racked, but not in production yet. I personally love Freenas, I have been using it at home for 5 years and at work we have 5 or 6 boxes setup as iSCSI targets for our virtualization backend. We had planned on integrating Freenas at the branch level to homogenize our non-MS systems and make it entirely easier to manage. The built in reporting, ease of backup and replication, along with all other benefits of ZFS are very appealing - but if we can't get our users folder redirection working, it's all for naught.
Any help would be greatly appreciated. I am well versed in Windows and a quick study with Freenas, but do not claim to be an expert in either. I would HAPPILY learn I am doing something incorrect and change that behavior!
Let me know if any logs would help, as well as where they might be.
Thank you guys so much.
Setup is a Dell 2950 running Freenas 9.10.2-U1, fresh install, test system, raid10 disks. Freenas has been joined to the domain, and all of that portion works. IE, I have domain users in my Owner user/group drop down under Dataset Permissions, I can ping my freenas box and dcs, and wbinfo --ping-dc succeeds, etc.
I have performed these steps in order, as I believe them to be correct and best practices.
Root dataset (not nested, as I've seen this could be a potential bug), set permissions to user DOMAIN\jadmin (my admin user) and group DOMAIN\domain admins. I have used 'set permission recursively' many times, though there is no data to start with.
Share settings: I have tried with and without Apply Default Permissions
From there I move to my windows box, with Computer Management launched as my DOMAIN\jadmin user. Under advanced, I set the recommended settings as per folder redirection guidelines (https://blogs.technet.microsoft.com...s-for-redirected-folders-or-home-directories/ for reference) Everyone ends up with Create Folder/Append Data, List Folder/Read Data, Read Attribs, Traverse folder/Execute file
To be clear and make sure these are actually set, I manually set myself as owner (though I already am listed), then delete any previous settings and only leave it configured as such:
On the Windows AD side, I have a GPO that points to \\rtfserver\data2 (freenas box and share name) and create a brand new test user with that policy. I then login with my test user.
The root user folder for redirection is created, ie: \\rtfserver\data2\justin.test4, but my user that just logged in and created it has no rights to access it. As you can see, the folder is created but I cannot enter it and get this unusual message.
In fact, that user cannot reliably create any folder in data2 even though they should (as everyone) have rights to create a folder. Often, it will create 5 New Folders if you attempt to create one, named New Folder, New Folder (2), etc. That user justin.test4 will not be able to modify or view or enter those folders that I just created as him. Note I only clicked "Create New Folder" once.
However, my admin user has full rights to all folders, can create and delete. The folder that was created by justin.test4 shows as properly owned, but does not allow justin.test4 any access.
Oddly, if I manually add user justin.test4 with Full Control over This subfolder and Files, it will ALSO add an inherited Full Control for This folder Only as justin.test4 (highlighted and circled in red). Note that is done automatically and shows up as soon as I manually add the Full Control permission (denoted by Inherited from None)
Signing out as justin.test4 and relogging in and things behave better.
This isn't, however, good enough for production use. Unfortunately it isn't something we've caught, and we're pretty far down the path of integrating Freenas into our system as a low-cost replacement for Windows servers that do nothing but file share at our branch locations. This server is already on site and racked, but not in production yet. I personally love Freenas, I have been using it at home for 5 years and at work we have 5 or 6 boxes setup as iSCSI targets for our virtualization backend. We had planned on integrating Freenas at the branch level to homogenize our non-MS systems and make it entirely easier to manage. The built in reporting, ease of backup and replication, along with all other benefits of ZFS are very appealing - but if we can't get our users folder redirection working, it's all for naught.
Any help would be greatly appreciated. I am well versed in Windows and a quick study with Freenas, but do not claim to be an expert in either. I would HAPPILY learn I am doing something incorrect and change that behavior!
Let me know if any logs would help, as well as where they might be.
Thank you guys so much.
