[Samba] Cannot set Windows ACL on Sharefolder with other user than Administrator

[Oliver]

Am 10.08.2022 um 08:38 schrieb Rowland Penny via samba:
> Sorry to be the bearer of bad news, but if 'security = ADS' is set in
> smb.conf on DC2 and DC3, then they are not DC's, they are Unix domain
> members, how did you join them ?

I joined both members with :

# net ads join -U administrator

Cause of static ip in network adapter settings, I manuel created the 
reverse-PTR Record in the reverse dns zone via RSAT.

When i run testjoin, also getting error on ldb. files...

root at member1:~#  net ads testjoin -d 3
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
Processing section "[global]"
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface eth0 ip=192.168.188.24 bcast=192.168.188.255 
netmask=255.255.255.0
Registered MSG_REQ_POOL_USAGE
Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED
added interface lo ip=127.0.0.1 bcast=127.255.255.255 netmask=255.0.0.0
added interface eth0 ip=192.168.188.24 bcast=192.168.188.255 
netmask=255.255.255.0
ldb: ltdb: tdb(/usr/local/samba/private/secrets.ldb): tdb_open_ex: could 
not open file /usr/local/samba/private/secrets.ldb: Datei oder 
Verzeichnis nicht gefunden

ldb: Unable to open tdb '/usr/local/samba/private/secrets.ldb': Datei 
oder Verzeichnis nicht gefunden
ldb: Failed to connect to '/usr/local/samba/private/secrets.ldb' with 
backend 'tdb': Unable to open tdb 
'/usr/local/samba/private/secrets.ldb': Datei oder Verzeichnis nicht 
gefunden
Failed to create cldap tsocket_address for  - NT_STATUS_ACCESS_DENIED
ads_try_connect: CLDAP request  failed.
get_dc_list: preferred server list: ", *"
Successfully contacted LDAP server 192.168.188.5
get_dc_list: preferred server list: ", *"
get_dc_list: preferred server list: ", *"
Failed to create cldap tsocket_address for  - 
NT_STATUS_OBJECT_NAME_COLLISION
ads_try_connect: CLDAP request  failed.
Failed to create cldap tsocket_address for  - 
NT_STATUS_OBJECT_NAME_COLLISION
ads_try_connect: CLDAP request  failed.
get_dc_list: preferred server list: ", *"
Successfully contacted LDAP server 192.168.188.5
get_dc_list: preferred server list: ", *"
get_dc_list: preferred server list: ", *"
Successfully contacted LDAP server 192.168.188.5
Connecting to 192.168.188.5 at port 389
Connected to LDAP server dc1.domain.home
ads_sasl_spnego_bind: got OID=1.2.840.48018.1.2.2
ads_sasl_spnego_bind: got OID=1.2.840.113554.1.2.2
ads_sasl_spnego_bind: got OID=1.3.6.1.4.1.311.2.2.10
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Join is OK
return code = 0

Oliver