Non-Administrator Active Directory users cannot access Shares

[XStylus]

Hi there,

I seem to to having an issue whereby users in my Active Directory cannot access a share on FreeNAS 11.2-RC1 unless they are a domain administrator. I'm sure there's something I'm doing wrong, but for the life of me I can't see what.

The FreeNAS, as best as I can tell, is joined to the Active Directory happily. DNS settings are properly set to point to the domain controller's internal DNS,, and the FreeNAS is getting NTP time sync from the domain controller, so I'm going to assume that's all good unless someone has a suggestion on something I overlooked.

Getting right to it...: I have a Pool called "BZ-Company" that is shared out via SMB, and a general user named "Test Testarossa" (BZ\test). Ms. Testarossa is also set as a member of the "BZ\AlphaTest" group.

On the FreeNAS, I have set the permissions for "BZ-Company" to have BZ\test as the owner, and "BZ\AlphaTest" as the group. However, Ms. Testarossa cannot access the Share. That user can only access the Share if I make Ms. Testarossa an administrator by adding that user to the "BZ\Domain Admins" group.

Screenshots attached. What am I neglecting to consider?

 

[anodos]

If this is still a testing environment, try running the command winacl -a reset -O "BZ\test" -G "BZ\alphatest" -r -p /mnt/Aincrad/BZ/BZ-Company
I recently fixed an issue with how permissions were being applied via winacl. Let's see if manually applying the default permissions will get the expected behavior.

 

[XStylus]

If this is still a testing environment, try running the command winacl -a reset -O "BZ\test" -G "BZ\alphatest" -r -p /mnt/Aincrad/BZ/BZ-Company
I recently fixed an issue with how permissions were being applied via winacl. Let's see if manually applying the default permissions will get the expected behavior.

Yep, still a testing environment as a prelude to a much larger deployment.

I have just tried the command you suggested. Issue persists.

Also, just for sanity checking, I tested against a Share hosted on a bona-fide Windows machine, and with permissions set the same way they are on the FreeNAS box. Works as intended.

I'm prepared to go file a bug report but I want to make sure the problem isn't "defective user" first.

 

[anodos]

Yep, still a testing environment as a prelude to a much larger deployment.

I have just tried the command you suggested. Issue persists.

Also, just for sanity checking, I tested against a Share hosted on a bona-fide Windows machine, and with permissions set the same way they are on the FreeNAS box. Works as intended.

I'm prepared to go file a bug report but I want to make sure the problem isn't "defective user" first.

Post your smb4.conf file and also output of sharesec --view-all

Also post output of id "BZ\test", and wbinfo --name-to-sid="BZ\test"

 

[XStylus]

Post your smb4.conf file and also output of sharesec --view-all

Also post output of id "BZ\test", and wbinfo --name-to-sid="BZ\test"

root@Aincrad[/mnt/Aincrad/BZ/BZ-Utilities]# wbinfo --name-to-sid="BZ\test"
S-1-5-21-2041558028-4077458491-2309428135-1166 SID_USER (1)

ShareSec output at the link below:
http://xstylus.com/temp/sharesec.txt

smb4.conf available at the link below:
http://xstylus.com/temp/smb4.conf.txt

 

[anodos]

root@Aincrad[/mnt/Aincrad/BZ/BZ-Utilities]# wbinfo --name-to-sid="BZ\test"
S-1-5-21-2041558028-4077458491-2309428135-1166 SID_USER (1)

ShareSec output at the link below:
http://xstylus.com/temp/sharesec.txt

smb4.conf available at the link below:
http://xstylus.com/temp/smb4.conf

I'm getting a 403 error on the smb4.conf file. You can attach it to a post as a txt file. Try running wbinfo --sid-to-uid=S-1-5-21-2041558028-4077458491-2309428135-1166

 

[XStylus]

Here we go...