[Samba] User and Group Permissions in a Workgroup

Pluess, Tobias tpluess at ieee.org
Wed Oct 2 12:52:48 UTC 2024


Good day,
when I am using SAMBA in a workgroup only (i.e. without a domain
controller), is it still possible to assign users to different groups and
grant different permissions, based on the groups?

I am asking because I encountered the following problem:
I have set up a new SAMBA server that is completely standalone and using a
workgroup only. Now, I added a couple users, and I wanted to adjust some
folder permissions from windows, using the Windows Explorer, like here

https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs#Setting_ACLs_on_a_Folder

and I saw that I cannot change the permissions. The error returned is that
the permission is denied. Funny enough, I can create, add and modify files
and folders just fine.

I then thought, well, maybe this has to do with the
SeDiskOperatorPrivilege. And of course, this privilege is granted to
builtin\Administrators, and my workgroup users are not part of that group.
I tried now quite a long time to add users to the builtin\Administrators
group, but I failed. So I wonder, is it probably not possible to allow
permissions to be changed from the Windows side, when only a workgroup is
used?

I have used the following configs in the smb.conf:

ea support = yes
inherit acls = yes
acl_xattr:ignore system acls = yes
inherit permissions = yes
vfs objects = acl_xattr
map acl inherit = yes

and the folder, where I have my share in, has permissions 0777 (for test
purposes....).

Thanks for any hints!
Tobias


More information about the samba mailing list