[Samba] Samba AD DC: share access denied
Jens Kuipers
hitmokyhitter at hotmail.com
Thu Nov 15 13:43:19 UTC 2018
Hey Samba,
For the last year I've been trying to set up a Samba Active Directory with a share which will hold the profiles of users so that Windows users can be implemented with the roaming profiles functionality.
I started out with an Ubuntu Server 16.04 LTS on which I configured routing, forwarding and dhcp. After which I followed the Setting up Samba as an Active Directory Domain Controller<https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller> documentation and eventually I created a share per Setting up a Share Using Windows ACLs<https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs> documentation. I ran into problems when I tried to set the ACL's on the share through Windows (logged in as Domain Admin), I can not save the changes I made to the share permissions. The error message I get from Windows is an Access Denied.
Testpar --verbose | more:
# Global parameters
[global]
dos charset = CP850
unix charset = UTF-8
workgroup = LDB-BEHEER
realm = LDB-BEHEER.NL
netbios name = AD
netbios aliases =
netbios scope =
server string = Samba 4.3.11-Ubuntu
interfaces =
bind interfaces only = No
config backend = file
server role = active directory domain controller
security = AUTO
auth methods =
encrypt passwords = Yes
client schannel = Auto
server schannel = Auto
allow trusted domains = Yes
map to guest = Never
null passwords = No
old password allowed period = 60
obey pam restrictions = No
password server = *
smb passwd file = /etc/samba/smbpasswd
private dir = /var/lib/samba/private
passdb backend = samba_dsdb
algorithmic rid base = 1000
root directory =
guest account = nobody
enable privileges = Yes
pam password change = No
passwd program =
passwd chat = *new*password* %n\n *new*password* %n\n *changed*
passwd chat debug = No
passwd chat timeout = 2
check password script =
username map =
username level = 0
unix password sync = No
restrict anonymous = 0
lanman auth = No
ntlm auth = Yes
raw NTLMv2 auth = No
client NTLMv2 auth = Yes
client lanman auth = No
client plaintext auth = No
client use spnego principal = No
preload modules =
dedicated keytab file =
kerberos method = default
map untrusted to domain = No
log level = 2
syslog = 1
syslog only = No
log file =
logging =
max log size = 5000
debug timestamp = Yes
timestamp logs = Yes
debug prefix timestamp = No
debug hires timestamp = Yes
debug pid = No
debug uid = No
debug class = No
enable core files = Yes
smb ports = 445 139
large readwrite = Yes
server max protocol = SMB3
max protocol = SMB3
protocol = SMB3
server min protocol = LANMAN1
min protocol = LANMAN1
client max protocol = default
client min protocol = CORE
unicode = Yes
min receivefile size = 0
read raw = Yes
write raw = Yes
disable netbios = No
reset on zero vc = No
log writeable files on exit = No
defer sharing violations = Yes
nt pipe support = Yes
nt status support = Yes
smbd profiling level = off
max mux = 50
max xmit = 16644
name resolve order = lmhosts wins host bcast
max ttl = 259200
max wins ttl = 518400
min wins ttl = 21600
time server = No
unix extensions = Yes
use spnego = Yes
client signing = default
server signing = default
client use spnego = Yes
client ldap sasl wrapping = sign
ldap server require strong auth = Yes
enable asu support = No
svcctl list =
cldap port = 389
dgram port = 138
nbt port = 137
krb5 port = 88
kpasswd port = 464
web port = 901
rpc big endian = No
deadtime = 0
getwd cache = Yes
keepalive = 300
change notify = Yes
kernel change notify = Yes
lpq cache time = 30
max smbd processes = 0
max disk size = 0
max open files = 16384
socket options = TCP_NODELAY
use mmap = Yes
hostname lookups = No
name cache timeout = 660
ctdbd socket =
cluster addresses =
clustering = No
ctdb timeout = 0
ctdb locktime warn threshold = 0
smb2 max read = 8388608
smb2 max write = 8388608
smb2 max trans = 8388608
smb2 max credits = 8192
load printers = Yes
printcap cache time = 750
printcap name =
cups server =
cups encrypt = No
cups connection timeout = 30
iprint server =
disable spoolss = No
addport command =
enumports command =
addprinter command =
deleteprinter command =
show add printer wizard = Yes
os2 driver map =
mangling method = hash2
mangle prefix = 1
max stat cache size = 256
stat cache = Yes
machine password timeout = 604800
add user script =
rename user script =
delete user script =
add group script =
delete group script =
add user to group script =
delete user from group script =
set primary group script =
add machine script =
shutdown script =
abort shutdown script =
username map script =
username map cache time = 0
logon script =
logon path = \\%N\%U\profile
logon drive =
logon home = \\%N\%U
domain logons = No
init logon delayed hosts =
init logon delay = 100
os level = 20
lm announce = Auto
lm interval = 60
preferred master = Auto
local master = Yes
domain master = Auto
browse list = Yes
enhanced browsing = Yes
dns proxy = Yes
wins proxy = No
wins server =
wins support = No
wins hook =
smb2 leases = No
lock spin time = 200
oplock break wait time = 0
ldap admin dn =
ldap delete dn = No
ldap group suffix =
ldap idmap suffix =
ldap machine suffix =
ldap passwd sync = no
ldap replication sleep = 1000
ldap suffix =
ldap ssl = start tls
ldap ssl ads = No
ldap deref = auto
ldap follow referral = Auto
ldap timeout = 15
ldap connection timeout = 2
ldap page size = 1024
ldap user suffix =
ldap debug level = 0
ldap debug threshold = 10
eventlog list =
add share command =
change share command =
delete share command =
config file =
preload =
auto services =
lock directory = /var/run/samba
state directory = /var/lib/samba
cache directory = /var/cache/samba
pid directory = /var/run/samba
ntp signd socket directory = /var/lib/samba/ntp_signd
utmp directory =
wtmp directory =
utmp = No
default service =
default =
message command =
get quota command =
set quota command =
remote announce =
remote browse sync =
nbt client socket address = 0.0.0.0
socket address = 0.0.0.0
nmbd bind explicit broadcast = Yes
homedir map = auto.home
afs username map =
afs token lifetime = 604800
log nt token command =
NIS homedir = No
registry shares = No
usershare allow guests = No
usershare max shares = 100
usershare owner only = Yes
usershare path = /var/lib/samba/usershares
usershare prefix allow list =
usershare prefix deny list =
usershare template share =
allow insecure wide links = No
async smb echo handler = No
panic action =
perfcount module =
host msdfs = Yes
passdb expand explicit = No
idmap backend = tdb
idmap cache time = 604800
idmap negative cache time = 120
idmap uid =
idmap gid =
template homedir = /home/%D/%U
template shell = /bin/false
winbind separator = \
winbind cache time = 300
winbind reconnect delay = 30
winbind request timeout = 60
winbind max clients = 200
winbind enum users = No
winbind enum groups = No
winbind use default domain = No
winbind trusted domains only = No
winbind nested groups = Yes
winbind expand groups = 0
winbind nss info = template
winbind refresh tickets = No
winbind offline logon = No
winbind normalize names = No
winbind rpc only = No
create krb5 conf = Yes
ncalrpc dir = /var/run/samba/ncalrpc
winbind max domain connections = 1
winbindd socket directory = /var/run/samba/winbindd
winbindd privileged socket directory = /var/lib/samba/winbindd_privileged
winbind sealed pipes = Yes
neutralize nt4 emulation = No
reject md5 servers = No
require strong key = Yes
allow dns updates = nonsecure and secure
dns forwarder = 8.8.8.8
dns update command = /usr/sbin/samba_dnsupdate
nsupdate command = /usr/bin/nsupdate -g
rndc command = /usr/sbin/rndc
multicast dns register = Yes
samba kcc command = /usr/sbin/samba_kcc
server services = s3fs, rpc, nbt, wrepl, ldap, cldap, kdc, drepl, winbindd, ntp_signd, kcc, dnsupdate, dns
dcerpc endpoint servers = epmapper, wkssvc, rpcecho, samr, netlogon, lsarpc, spoolss, drsuapi, dssetup, unixinfo, browser, eventlog6, backupkey, dnsserver
spn update command = /usr/sbin/samba_spnupdate
share backend = classic
allow nt4 crypto = No
reject md5 clients = No
tls enabled = Yes
tls keyfile = tls/key.pem
tls certfile = tls/cert.pem
tls cafile = tls/ca.pem
tls crlfile =
tls dh params file =
tls priority = NORMAL:-VERS-SSL3.0
tls verify peer = as_strict_as_possible
client ipc max protocol = default
client ipc min protocol = default
client ipc signing = default
allow dcerpc auth level connect = No
rpc_server:tcpip = no
rpc_daemon:spoolssd = embedded
rpc_server:spoolss = embedded
rpc_server:winreg = embedded
rpc_server:ntsvcs = embedded
rpc_server:eventlog = embedded
rpc_server:srvsvc = embedded
rpc_server:svcctl = embedded
rpc_server:default = external
winbindd:use external pipes = true
idmap_ldb:use rfc2307 = yes
idmap config * : backend = tdb
comment =
path =
username =
invalid users =
valid users =
admin users =
read list =
write list =
force user =
force group =
group =
read only = Yes
spotlight = No
acl check permissions = Yes
acl group control = No
acl map full control = Yes
acl allow execute always = No
create mask = 0744
force create mode = 0000
directory mask = 0755
directory mode = 0755
force directory mode = 0000
force unknown acl user = No
inherit permissions = No
inherit acls = No
inherit owner = No
guest only = No
administrative share = No
guest ok = No
only user = No
hosts allow =
hosts deny =
allocation roundup size = 1048576
aio read size = 0
aio write size = 0
aio write behind =
ea support = No
nt acl support = Yes
profile acls = No
map acl inherit = No
afs share = No
smb encrypt = default
durable handles = Yes
block size = 1024
directory name cache size = 100
max connections = 0
min print space = 0
strict allocate = No
strict rename = No
strict sync = No
sync always = No
use sendfile = No
write cache size = 0
max reported print jobs = 0
max print jobs = 1000
printable = No
print notify backchannel = No
printing = cups
cups options =
print command =
lpq command = %p
lprm command =
lppause command =
lpresume command =
queuepause command =
queueresume command =
printer name =
use client driver = No
default devmode = Yes
force printername = No
printjob username = %U
default case = lower
case sensitive = Auto
preserve case = Yes
short preserve case = Yes
mangling char = ~
hide dot files = Yes
hide special files = No
hide unreadable = No
hide unwriteable files = No
delete veto files = No
veto files =
hide files =
veto oplock files =
map archive = No
map hidden = No
map system = No
map readonly = no
mangled names = Yes
store dos attributes = Yes
dmapi support = No
browseable = Yes
access based share enum = No
blocking locks = Yes
csc policy = manual
fake oplocks = No
kernel oplocks = No
kernel share modes = Yes
locking = Yes
oplocks = Yes
level2 oplocks = Yes
oplock contention limit = 2
posix locking = Yes
strict locking = Auto
dfree cache time = 0
dfree command =
include =
preexec =
exec =
preexec close = No
postexec =
root preexec =
root preexec close = No
root postexec =
available = Yes
volume =
fstype = NTFS
wide links = No
follow symlinks = Yes
dont descend =
magic script =
magic output =
delete readonly = No
dos filemode = No
dos filetimes = Yes
dos filetime resolution = No
fake directory create times = No
vfs objects = dfs_samba4 acl_xattr
msdfs root = No
msdfs proxy =
msdfs shuffle referrals = No
ntvfs handler = unixuid, default
[netlogon]
path = /var/lib/samba/sysvol/ldb-beheer.nl/scripts
read only = No
[sysvol]
path = /var/lib/samba/sysvol
read only = No
[users]
path = /mnt/users/roaming
read only = No
Getfacl /mnt/users/roaming
getfacl: Removing leading '/' from absolute path names
# file: mnt/users/roaming
# owner: root
# group: LDB-BEHEER\134domain\040users
# flags: -s-
user::rwx
group::r-x
other::r-x
Kind regards
More information about the samba
mailing list