We moved up from a 3.x NT-type Samba server and built a new AD server using the SambaWiki, methodically making sure each step and test worked correctly. It's fine in administrator or Domain Admin mode, but none of the other users have access, even to their home directory. Win7 and XP workstations join the domain just fine. Users can log in. Smba shares do not have access. Below is a truncated smb.conf file, showing one share "APP"
# Global parameters [global] workgroup = INT realm = INT.JINGLES.COM server role = active directory domain controller security = USER passdb backend = samba_dsdb template homedir = /samba/home/%U template shell = /bin/bash dns forwarder = 220.127.116.11 rpc_server:tcpip = no rpc_daemon:spoolssd = embedded rpc_server:spoolss = embedded rpc_server:winreg = embedded rpc_server:ntsvcs = embedded rpc_server:eventlog = embedded rpc_server:srvsvc = embedded rpc_server:svcctl = embedded rpc_server:default = external winbindd:use external pipes = true idmap config * : backend = tdb map archive = No map readonly = no store dos attributes = Yes vfs objects = dfs_samba4 acl_xattr [netlogon] path = /var/lib/samba/sysvol/int.jingles.com/scripts read only = No [sysvol] path = /var/lib/samba/sysvol read only = No [printers] comment = All Printers path = /var/spool/samba printable = Yes browseable = No [print$] comment = Printer Drivers path = /var/lib/samba/printers write list = root @lpadmin [app] comment = "Applications" path = /samba/app read only = No
The permissions are set for SYSTEM, Domain Admins, and JAM_valid_user (all employees) My personal login (mark) is a member of JAM_valid_user but cannot access the share. Here's the ls followed by the ACL settings.
drwxrwx---+ 13 jamsysadmin INT\domain admins 4096 Aug 10 2015 app
[libdefaults] default_realm = INT.JINGLES.COM dns_lookup_realm = false dns_lookup_kdc = true
I'm a bit at a loss on how to proceed, I've been hammering at this for a week, and am currently having to put all employees into the Domain Admins group for access. Why don't they have access as members of JAM_valid_user group?