Manage Samba permissions from Windows

原地址：Manage Samba permissions from Windows

For those who installed samba and join the server to Windows Domain, this tutorial will show you how to Manage Samba permissions from Windows machine.

There are a tutorials how to install Samba Server and join it to Windows Active Directory domain, but on most of them i haven’t seen how to manage Samba permissions from Windows machine.

Filesystem support

If you are using ext3 or ext4 file system you need to edit your /etc/fstab and include user_xattr and acl on the partition that you use for your shares:

# vi /etc/fstab
/dev/sda3     /shares/Demo     ext4      user_xattr,acl      1 1

ACL options on member server

In the [global] section of your smb.conf add the following lines:

vfs objects = acl_xattr
map acl inherit = Yes
store dos attributes = Yes

Note: This is only required on Domain Member Servers

SeDiskOperatorPrivilege

You need an account with SeDiskOperatorPrivilege privileges to be able to configure share permissions. With the following command you will enable Domain Admins to configure share permissions:

net rpc rights grant 'DOMAIN\Domain Admins' SeDiskOperatorPrivilege -Uadministrator

Configure share permissions from Windows machine

• Login on a Windows machine with Domain Admins account and open MMC Console.
• In the menu bar go to File -> Add/Remove Snap-in and choose Computer Management.
• Choose Another Computer and enter the name or IP address of your Samba server, you’ve create the new share on.
• Navigate to System Tools -> Shared Folders -> Shares and select the new added share.

• Right-click to the share name, choose Properties.
• To configure who can access the share and the appropriate permissions go to the Share Permissions tab.

• Go to the Security tab, click the Edit button and configure the file system permissions.

Change permissions on folders of a share

You can change folder security permissions from any computer where you are logged in with account which is member of Domain Administrators.

• Log on to a Windows machine as Domain Administrator.
• Navigate to the folder of which you want to change the permissions.
• Right-click to the folder and choose Properties.
• Go to the Security tab and click the Edit button.
• Change the permissions to your needs.