[Samba] Interesting explorer crash when getting security properties on the root of a share

Aaron de Bruyn aaron at heyaaron.com
Thu Aug 31 17:10:46 UTC 2023

It doesn't appear to be affecting anything in our environment, but a vendor recently insisted on "seeing" the security properties on a share.

When we right-click on a particular share, go to properties and then click on the security tab, explorer crashes and reloads.

I tested on a few Windows 10 and 11 boxes and was able to duplicate it.

This is in the event log:
Fault bucket 1800533262255858029, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: explorer.exe
P2: 10.0.19041.3271
P3: fb42fb94
P4: StackHash_7047
P5: 10.0.19041.3324
P6: da4a9f63
P7: c0000374
P8: PCH_41_FROM_ntdll+0x000000000009DB64

This doesn't occur on every share and appears to be related to the Unix owner/group.

The shares that crash had a at least one file owned by BUILTIN\administrators and the group 'users'.

After setting them all back to root:root the issue went away. Setting them back to BUILTIN\administrators and the group 'users' didn't reproduce the crash.

Like I said, it's not impacting anything even remotely important in our environments, but it was mildly interesting. :)


More information about the samba mailing list