[Samba] idmap problems

[Rowland Penny]

On Tue, 8 Jan 2019 11:56:10 +0100
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:

> 
> > -----Oorspronkelijk bericht-----
> > Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> > Rowland Penny via samba
> > Verzonden: dinsdag 8 januari 2019 11:13
> > Aan: samba at lists.samba.org
> > Onderwerp: Re: [Samba] idmap problems
> > 
> > On Tue, 8 Jan 2019 10:36:49 +0100
> > "L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> > 
> > > Hai, 
> > > 
> > > I still dont understand the fuss about "domain admins" and no GID
> > > because im running this for 3 years now. So... Again what was the
> > > problem here, i dont remember it.. (sorry) 
> > 
> > The problem is that you use Administrators instead of Domain
> > Admins, which, if you think about it, is the same as using another
> > group instead of Domain Admins.
> No, thats not the problem..  Im using it as Windows designed it by
> default.  

I do not think you are ;-)

> 
> Builtin\Adminsitrators != "DOMAIN\Domain Admins" 

That is perfectly obvious.

>and DOM\Domain admins is member of Builtin\Adminsitrators

Again correct

> 
> Now your idee.. 
> Builtin\Adminsitrators != "DOMAIN\Domain Admins" and DOM\ANY group
> but is not default a member of Builtin\Adminsitrators

I am prepared to accept adding DOM\ANY to BUILTIN\Administrators, but
is it really any different to adding it to DOMAIN\Domain Admins, when
DOMAIN\Domain Admins is a member of BUILTIN\Administrators ?

Rowland