Can't "apply owner" on a dataset to the "Domain\Administrator" AD user account

[Cellobita]

I'm running FreeNAS-9.3-STABLE-201505040117, on a 16GB server with two mirrored standard SATA HD's, using the built-in Domain Controller functionality. Problem is, I have been trying to apply the built-in AD "Administrator" user account as owner of a dataset, but the change doesn't "stick" when I click the Change button; as a matter of fact, I can change the owner to any standard Unix account, but not to an Active Directory one.

There is no problem with the group owner, that I can set to whatever I like.

Any suggestions or tips? I have searched the forum prior to posting, without success.

 

[depasseg]

I think there is a conflict with the word "Administrator" since it is a user and a group (or something like that). Try using a different administrator account (root has been suggested, and is what I use for my AD related CIFS shares).

 

[Cellobita]

There is a group "Administrators" (plural) on Windows Servers, but it is not created by default when you provision the Domain Controller functionality on FreeNAS; I can also confirm that you can change the owner to, say, the "Domain\Guest" AD user, so your hypothesis may indeed be accurate - anyway, if this is indeed the case, perhaps it should be filed as a bug in Samba or FreeNAS.

Edit: I have changed the title on the thread to reflect the specifics of the issue.

 

[cyberjock]

Not to mention that if you are doing CIFS shares, that window is not the appropriate window to be changing permissions. You should be doing it from within Windows itself, or via the CLI with getfacl and setfacl. ;)

 

[Cellobita]

I understand that (my area of expertise is actually Windows Servers and AD), but shouldn't the option work or else be removed from the GUI?

 

[depasseg]

Just leave the owner as Root and the group as domain admins. And then use Windows to set the proper share permissions.

 

[Cellobita]

I have done just that, with no problems whatsoever. However, being a stubborn guy, I still believe that, if it is not needed, it shouldn't be there - and, being there, it should work.

And, this is in no way dismissive of the incredible job the developers do (far above my poor coding skills), just my 2 cents.

 

[depasseg]

I think it is needed. To test it, change it to user:Root and group: wheel and then try to change the permissions in Windows.