[Samba] Domain Member Server: Domain Users cannot access shares

[Rowland Penny]

On Wed, 21 Sep 2016 11:09:15 -0400
Jason Secord <it at plymouthhistory.org> wrote:

> Hi Rowland,
> 
> I've already removed all "admin users" and "valid users" entries from
> my smb.conf, they ended up there after hours of confusion trying to
> drill down to the root of the problem.
> 
> To remove the aforementioned UID/GIDs, I can do that via the tab in
> ADUC, correct?  Is there a document best practices when applying UNIX
> attributes to accounts?

You can do it with ADUC, or you can use ldb or ldap tools or ADSI edit.

> 
> I haven't encountered any mention of creating a user.map in the
> documentation, nor have I ever created one in the past.  Is this
> something that is considered a best practice a well?  Can you point
> me to any documentation on user.maps?  

Not too sure about the documentation, There is some in 'man smb.conf',
but it is easier to describe it to you.

On a Samba AD DC, Administrator gets mapped to root automatically, but
on a domain member it isn't. There are two schools of thought here,
one is to give Administrator a uidNumber, but I don't recommend this.
If you do give Administrator a uidNumber, it becomes just another
Unix user with just the same permissions as any other user and it
breaks the DC. The other option is to use a 'username map', this will
do what the DC does and maps Administrator to the root user.

> I will make this adjustments 
> tonight and update you along with the results of that getfacl command
> you requested.
> 
> I have applied ACLs to all shares already.
>