Nesting of local groups (SID_NAME_ALIAS)
pfilipensky at samba.org
Thu Mar 16 19:20:46 UTC 2023
windbind does not correctly display members for e.g. BUILTIN/users. It
./bin/wbinfo --group-info BUILTIN/users
Given that "BUILTIN\Users" has 1 member "ADDOMAIN\Domain Users", it
should instead show:
./bin/wbinfo --group-info "ADDOMAIN/domain users"
I am working on the fix. One part is to call
dcerpc_samr_GetMembersInAlias() instead of the wrong
dcerpc_samr_GetAliasMembership() in source3/winbindd/winbindd_rpc.c.
Another part is to change the code dealing with nested groups / aliases.
For that, I need to understand if aliases (SID_NAME_ALIAS) can be
nested, like groups (SID_NAME_DOM_GRP).
Reading the Microsoft documentation
/A local group can contain user accounts that are local to the computer
and user accounts and global groups from their own domain./
It looks that "Local groups" which I believe is BUILTIN/users
(SID_NAME_ALIAS) cannot contain another "Local group". I have tested
that also on Windows server using lusrmgr.msc and such nesting was not
However, samba server allows such nesting:
bin/net sam createlocalgroup TestGroup1
bin/net sam createlocalgroup TestGroup2
bin/net sam addmem TestGroup1 TestGroup2
Can I assume that SID_NAME_ALIAS cannot be nested?
More information about the samba-technical