Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I am setting up a Linux box for a local accounting office. The purpose of the box is to alleviate the threat of viruses that have access to the network via USB drives. Please keep in mind that this office needs the highest security possible. My configuration is attempting to leverage Samba to allow members of the already configured (and highly secure) Windows 2008 Server to access the Samba share. I have added the user name of each of the people who need to access the Linux box to the system but have not added passwords as the passwords on the Windows Server are required to change quite often. Attempting to manage a password database on the Linux box is to be avoided if at all possible.


  • No password authentication required for logged-in Windows users to access Samba share.
  • As little manipulation of current Windows security policies as possible.
  • All users who access the share should have full read and write permissions (execute is NOT necessary).


Currently, all attempts to connect to the Samba server by unauthenticated users is met with an error on the Windows side saying "Access to the resource {insert IP address} has been disallowed." Samba is running with the following smb.conf file that I built from scratch:

    workgroup = {Windows Domain Name}
    server string = Removable Media Server
    security = share
    path = /media
    writable = yes
    browsable = yes
    guest ok = yes
    guest only = yes
    force directory mode = 0666
    force create mode = 0666

Samba version is 3.6.9. Samba's testparm command returns no errors. I have always restarted the Samba server after making changes to the Samba configuration.

What I have tried:

In smb.conf:

  • Setting security to user.
  • And just about every setting I have run across.

Other things of note:

The Samba share IS seen by the Windows domain and is actually accessible from a Windows administrator session.

One more thing: I am very new to Samba so please bear with me.

share|improve this question

Well, the first thing I was going to suggest was to set:

security = domain

But then I saw this in the Samba doc's chapter on Domain Membership:

Currently, domain security in Samba does not free you from having to create local UNIX users to represent the users attaching to your server. This means that if domain user DOM\fred attaches to your domain security Samba server, there needs to be a local UNIX user fred to represent that user in the UNIX file system.

Is it feasible for you to set up an account for each user that will be connecting?

I've never set up a Samba share inside a Windows domain, but here's a link to the Samba doc on Domain Menbership that I quoted above: Samba Domain Membership

Give the doc a look, and maybe it'll help you with what you need to do.

share|improve this answer
Thanks for the info! I will look into it when I get down to the accounting office. – DaBungalow Oct 2 '13 at 6:24
up vote 0 down vote accepted

I solved my own problem today and the answer had nothing to do with samba permissions or even Linux in general ($#@!$#@!~ WINDOWS!).

Windows has a special quirk in which it will NOT allow any user to do a network search by IP IF the user does not have permission to use the command prompt (this only took close to 100 Google searches to find, no joke). After fixing the group permissions to enable the command prompt for all users for whom it had been disabled, the whole setup worked like a dream. :)

share|improve this answer
Some info about how to do that? – TacB0sS Jul 12 '14 at 8:25
I found instructions here: 1) Click on Start. Go to Run. Users running Windows 8, Windows 7 or Vista, go to Search. 2) Type gpedit.msc and press Enter. 3) Navigate to User Configuration/ Administrative Templates / System. 4) In the work area on the right side, double click on "Prevent access to the command prompt". 5) In the popup dialog, encircle Disabled and click OK. Didn't help me with this problem, though... – Fred Hamilton Aug 24 '15 at 2:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.