Cannot get AD permissions on shares.

[3L3ET]

I'm using FreeNas 11.1. I cannot get my share to use windows AD authentication or permissions. I can join the domain with no errors. The shares are a window share. I can view the shares as a guest, but cannot use windows permissions, or AD accounts. I have checked the Directory controller is pingable. Active directory has a machine account for freeNass machine. The DNS server is configured correctly. NTP is function as needed. Kerbros is functioning as needed. but when I look at the share there is no windows permissions.

Any suggestions?

 

[PhilipS]

Did you set the owner permissions on the dataset to an AD account? This is in the storage section, click the change permissions icon. Then you should be able to add permissions to the share from windows.

 

[mbalsam]

Just went through this.

- Check for all of the Domain Controlers with that freenas can see using
host -t srv _ldap._tcp.YOURDOMAIN.COM
- Make sure that all of those DC's are pingable.
- Make sure the times on the domain controller are all accurate. Very important.
- For me i had to add this to my smb4.conf. Put it in the additional args section of the Auxiliary parameters: of SMB service

realm = domain.net
workgroup = domain


- In SMB config turn up log level to full
- In Sharing > Windows SMB > Share name > Enable "Browseable to Network Clients"
- For some shares i had to enable. In Sharing > Windows SMB > Share name > Enable "Access Based Share Enumeration" Not really sure why.
- Make sure wbinfo -g returns a list of all of the groups
- Do a freenas reboot and make sure there are no errors when devices connect
- Watch tail -f /var/log/debug.log for errors
- Watch tail -f /var/log/samba4/log.smbd log for permission issues when you click on shares and permission is not granted.

Shares need to be configured in a Windows application!!!
This was a shocker for me. You MUST use windows COMPUTER MANAGMENT to add permissions to Samba Shares. NOT WELL DOCUMENTED AT ALL.
https://forums.freenas.org/index.php?resources/smb-tips-and-tricks.1

On one machine, i had to wait 10 minutes for the shares to be come visiable. Reboots help...

Its art NOT science.