1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
|
<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter15.User Rights and Privileges</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.73.1"><link rel="start" href="index.html" title="The Official Samba 3.2.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="PartIII.Advanced Configuration"><link rel="prev" href="idmapper.html" title="Chapter14.Identity Mapping (IDMAP)"><link rel="next" href="AccessControls.html" title="Chapter16.File, Directory, and Share Access Controls"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter15.User Rights and Privileges</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="idmapper.html">Prev</a></td><th width="60%" align="center">PartIII.Advanced Configuration</th><td width="20%" align="right"><a accesskey="n" href="AccessControls.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="rights"></a>Chapter15.User Rights and Privileges</h2></div><div><div class="author"><h3 class="author"><span class="firstname">Gerald</span> <span class="othername">(Jerry)</span> <span class="surname">Carter</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jerry@samba.org">jerry@samba.org</a>></code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email"><<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>></code></p></div></div></div></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="rights.html#id2601492">Rights Management Capabilities</a></span></dt><dd><dl><dt><span class="sect2"><a href="rights.html#id2601767">Using the “<span class="quote">net rpc rights</span>” Utility</a></span></dt><dt><span class="sect2"><a href="rights.html#id2602113">Description of Privileges</a></span></dt><dt><span class="sect2"><a href="rights.html#id2602423">Privileges Suppored by Windows 2000 Domain Controllers</a></span></dt></dl></dd><dt><span class="sect1"><a href="rights.html#id2602911">The Administrator Domain SID</a></span></dt><dt><span class="sect1"><a href="rights.html#id2603088">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="rights.html#id2603093">What Rights and Privileges Will Permit Windows Client Administration?</a></span></dt></dl></dd></dl></div><p>
<a class="indexterm" name="id2601209"></a>
<a class="indexterm" name="id2601216"></a>
<a class="indexterm" name="id2601223"></a>
<a class="indexterm" name="id2601230"></a>
The administration of Windows user, group, and machine accounts in the Samba
domain-controlled network necessitates interfacing between the MS Windows
networking environment and the UNIX operating system environment. The right
(permission) to add machines to the Windows security domain can be assigned
(set) to non-administrative users both in Windows NT4 domains and
Active Directory domains.
</p><p>
<a class="indexterm" name="id2601246"></a>
<a class="indexterm" name="id2601253"></a>
<a class="indexterm" name="id2601260"></a>
<a class="indexterm" name="id2601267"></a>
The addition of Windows NT4/2kX/XPPro machines to the domain necessitates the
creation of a machine account for each machine added. The machine account is
a necessity that is used to validate that the machine can be trusted to permit
user logons.
</p><p>
<a class="indexterm" name="id2601281"></a>
<a class="indexterm" name="id2601288"></a>
<a class="indexterm" name="id2601295"></a>
<a class="indexterm" name="id2601302"></a>
<a class="indexterm" name="id2601309"></a>
<a class="indexterm" name="id2601316"></a>
Machine accounts are analogous to user accounts, and thus in implementing them on a UNIX machine that is
hosting Samba (i.e., on which Samba is running), it is necessary to create a special type of user account.
Machine accounts differ from normal user accounts in that the account name (login ID) is terminated with a
<code class="literal">$</code> sign. An additional difference is that this type of account should not ever be able to
log into the UNIX environment as a system user and therefore is set to have a shell of
<code class="literal">/bin/false</code> and a home directory of <code class="literal">/dev/null.</code> The machine
account is used only to authenticate domain member machines during start-up. This security measure
is designed to block man-in-the-middle attempts to violate network integrity.
</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
<a class="indexterm" name="id2601356"></a>
<a class="indexterm" name="id2601363"></a>
<a class="indexterm" name="id2601370"></a>
<a class="indexterm" name="id2601377"></a>
<a class="indexterm" name="id2601384"></a>
Machine (computer) accounts are used in the Windows NT OS family to store security
credentials for domain member servers and workstations. When the domain member
starts up, it goes through a validation process that includes an exchange of
credentials with a domain controller. If the domain member fails to authenticate
using the credentials known for it by domain controllers, the machine will be refused
all access by domain users. The computer account is essential to the way that MS
Windows secures authentication.
</p></div><p>
<a class="indexterm" name="id2601403"></a>
<a class="indexterm" name="id2601410"></a>
<a class="indexterm" name="id2601417"></a>
<a class="indexterm" name="id2601424"></a>
The creation of UNIX system accounts has traditionally been the sole right of
the system administrator, better known as the <code class="constant">root</code> account.
It is possible in the UNIX environment to create multiple users who have the
same UID. Any UNIX user who has a UID=0 is inherently the same as the
<code class="constant">root</code> account user.
</p><p>
<a class="indexterm" name="id2601446"></a>
<a class="indexterm" name="id2601453"></a>
<a class="indexterm" name="id2601460"></a>
<a class="indexterm" name="id2601467"></a>
All versions of Samba call system interface scripts that permit CIFS function
calls that are used to manage users, groups, and machine accounts
in the UNIX environment. All versions of Samba up to and including version 3.0.10
required the use of a Windows administrator account that unambiguously maps to
the UNIX <code class="constant">root</code> account to permit the execution of these
interface scripts. The requirement to do this has understandably met with some
disdain and consternation among Samba administrators, particularly where it became
necessary to permit people who should not possess <code class="constant">root</code>-level
access to the UNIX host system.
</p><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2601492"></a>Rights Management Capabilities</h2></div></div></div><p>
<a class="indexterm" name="id2601500"></a>
<a class="indexterm" name="id2601508"></a>
<a class="indexterm" name="id2601514"></a>
<a class="indexterm" name="id2601521"></a>
Samba 3.0.11 introduced support for the Windows privilege model. This model
allows certain rights to be assigned to a user or group SID. In order to enable
this feature, <a class="link" href="smb.conf.5.html#ENABLEPRIVILEGES">enable privileges = yes</a>
must be defined in the <em class="parameter"><code>global</code></em> section of the <code class="filename">smb.conf</code> file.
</p><p>
<a class="indexterm" name="id2601560"></a>
<a class="indexterm" name="id2601567"></a>
<a class="indexterm" name="id2601574"></a>
Currently, the rights supported in Samba-3 are listed in <a class="link" href="rights.html#rp-privs" title="Table15.1.Current Privilege Capabilities">“Current Privilege Capabilities”</a>.
The remainder of this chapter explains how to manage and use these privileges on Samba servers.
</p><a class="indexterm" name="id2601591"></a><a class="indexterm" name="id2601597"></a><a class="indexterm" name="id2601604"></a><a class="indexterm" name="id2601611"></a><a class="indexterm" name="id2601618"></a><a class="indexterm" name="id2601626"></a><div class="table"><a name="rp-privs"></a><p class="title"><b>Table15.1.Current Privilege Capabilities</b></p><div class="table-contents"><table summary="Current Privilege Capabilities" border="1"><colgroup><col align="right"><col align="left"></colgroup><thead><tr><th align="left">Privilege</th><th align="left">Description</th></tr></thead><tbody><tr><td align="right"><p>SeMachineAccountPrivilege</p></td><td align="left"><p>Add machines to domain</p></td></tr><tr><td align="right"><p>SePrintOperatorPrivilege</p></td><td align="left"><p>Manage printers</p></td></tr><tr><td align="right"><p>SeAddUsersPrivilege</p></td><td align="left"><p>Add users and groups to the domain</p></td></tr><tr><td align="right"><p>SeRemoteShutdownPrivilege</p></td><td align="left"><p>Force shutdown from a remote system</p></td></tr><tr><td align="right"><p>SeDiskOperatorPrivilege</p></td><td align="left"><p>Manage disk share</p></td></tr><tr><td align="right"><p>SeTakeOwnershipPrivilege</p></td><td align="left"><p>Take ownership of files or other objects</p></td></tr></tbody></table></div></div><br class="table-break"><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2601767"></a>Using the “<span class="quote">net rpc rights</span>” Utility</h3></div></div></div><p>
<a class="indexterm" name="id2601778"></a>
<a class="indexterm" name="id2601785"></a>
<a class="indexterm" name="id2601792"></a>
<a class="indexterm" name="id2601799"></a>
<a class="indexterm" name="id2601806"></a>
There are two primary means of managing the rights assigned to users and groups
on a Samba server. The <code class="literal">NT4 User Manager for Domains</code> may be
used from any Windows NT4, 2000, or XP Professional domain member client to
connect to a Samba domain controller and view/modify the rights assignments.
This application, however, appears to have bugs when run on a client running
Windows 2000 or later; therefore, Samba provides a command-line utility for
performing the necessary administrative actions.
</p><p>
The <code class="literal">net rpc rights</code> utility in Samba 3.0.11 has three new subcommands:
</p><div class="variablelist"><dl><dt><span class="term">list [name|accounts]</span></dt><dd><p>
<a class="indexterm" name="id2601849"></a>
<a class="indexterm" name="id2601860"></a>
<a class="indexterm" name="id2601867"></a>
<a class="indexterm" name="id2601874"></a>
When called with no arguments, <code class="literal">net rpc list</code>
simply lists the available rights on the server. When passed
a specific user or group name, the tool lists the privileges
currently assigned to the specified account. When invoked using
the special string <code class="constant">accounts</code>,
<code class="literal">net rpc rights list</code> returns a list of all
privileged accounts on the server and the assigned rights.
</p></dd><dt><span class="term">grant <user> <right [right ...]></span></dt><dd><p>
<a class="indexterm" name="id2601913"></a>
<a class="indexterm" name="id2601920"></a>
<a class="indexterm" name="id2601927"></a>
<a class="indexterm" name="id2601934"></a>
When called with no arguments, this function is used to assign
a list of rights to a specified user or group. For example,
to grant the members of the Domain Admins group on a Samba domain controller,
the capability to add client machines to the domain, one would run:
</p><pre class="screen">
<code class="prompt">root# </code> net -S server -U domadmin rpc rights grant \
'DOMAIN\Domain Admins' SeMachineAccountPrivilege
</pre><p>
The following syntax has the same result:
<a class="indexterm" name="id2601960"></a>
</p><pre class="screen">
<code class="prompt">root# </code> net rpc rights grant 'DOMAIN\Domain Admins' \
SeMachineAccountPrivilege -S server -U domadmin
</pre><p>
More than one privilege can be assigned by specifying a
list of rights separated by spaces. The parameter 'Domain\Domain Admins'
must be quoted with single ticks or using double-quotes to prevent
the backslash and the space from being interpreted by the system shell.
</p></dd><dt><span class="term">revoke <user> <right [right ...]></span></dt><dd><p>
This command is similar in format to <code class="literal">net rpc rights grant</code>. Its
effect is to remove an assigned right (or list of rights) from a user or group.
</p></dd></dl></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
<a class="indexterm" name="id2602015"></a>
<a class="indexterm" name="id2602022"></a>
<a class="indexterm" name="id2602028"></a>
You must be connected as a member of the Domain Admins group to be able to grant or revoke privileges assigned
to an account. This capability is inherent to the Domain Admins group and is not configurable. There are no
default rights and privileges, except the ability for a member of the Domain Admins group to assign them.
This means that all administrative rights and privileges (other than the ability to assign them) must be
explicitly assigned, even for the Domain Admins group.
</p></div><p>
<a class="indexterm" name="id2602047"></a>
<a class="indexterm" name="id2602054"></a>
<a class="indexterm" name="id2602061"></a>
<a class="indexterm" name="id2602068"></a>
By default, no privileges are initially assigned to any account because certain actions will be performed as
root once smbd determines that a user has the necessary rights. For example, when joining a client to a
Windows domain, <em class="parameter"><code>add machine script</code></em> must be executed with superuser rights in most
cases. For this reason, you should be very careful about handing out privileges to accounts.
</p><p>
<a class="indexterm" name="id2602089"></a>
<a class="indexterm" name="id2602096"></a>
<a class="indexterm" name="id2602102"></a>
Access as the root user (UID=0) bypasses all privilege checks.
</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602113"></a>Description of Privileges</h3></div></div></div><p>
<a class="indexterm" name="id2602121"></a>
<a class="indexterm" name="id2602127"></a>
<a class="indexterm" name="id2602134"></a>
The privileges that have been implemented in Samba-3.0.11 are shown below. It is possible, and likely, that
additional privileges may be implemented in later releases of Samba. It is also likely that any privileges
currently implemented but not used may be removed from future releases as a housekeeping matter, so it is
important that the successful as well as unsuccessful use of these facilities should be reported on the Samba
mailing lists.
</p><div class="variablelist"><dl><dt><span class="term">SeAddUsersPrivilege</span></dt><dd><p>
<a class="indexterm" name="id2602160"></a>
<a class="indexterm" name="id2602167"></a>
<a class="indexterm" name="id2602174"></a>
This right determines whether or not smbd will allow the
user to create new user or group accounts via such tools
as <code class="literal">net rpc user add</code> or
<code class="literal">NT4 User Manager for Domains.</code>
</p></dd><dt><span class="term">SeDiskOperatorPrivilege</span></dt><dd><p>
<a class="indexterm" name="id2602205"></a>
<a class="indexterm" name="id2602212"></a>
<a class="indexterm" name="id2602220"></a>
Accounts that possess this right will be able to execute
scripts defined by the <code class="literal">add/delete/change</code>
share command in <code class="filename">smb.conf</code> file as root. Such users will
also be able to modify the ACL associated with file shares
on the Samba server.
</p></dd><dt><span class="term">SeMachineAccountPrivilege</span></dt><dd><p>
<a class="indexterm" name="id2602252"></a>
<a class="indexterm" name="id2602259"></a>
<a class="indexterm" name="id2602266"></a>
This right controls whether or not the user can join client
machines to a Samba-controlled domain.
</p></dd><dt><span class="term">SePrintOperatorPrivilege</span></dt><dd><p>
<a class="indexterm" name="id2602285"></a>
<a class="indexterm" name="id2602292"></a>
<a class="indexterm" name="id2602299"></a>
<a class="indexterm" name="id2602306"></a>
<a class="indexterm" name="id2602313"></a>
This privilege operates identically to the <a class="link" href="smb.conf.5.html#PRINTERADMIN">printer admin</a>
option in the <code class="filename">smb.conf</code> file (see section 5 man page for <code class="filename">smb.conf</code>)
except that it is a global right (not on a per-printer basis).
Eventually the smb.conf option will be deprecated and administrative
rights to printers will be controlled exclusively by this right and
the security descriptor associated with the printer object in the
<code class="filename">ntprinters.tdb</code> file.
</p></dd><dt><span class="term">SeRemoteShutdownPrivilege</span></dt><dd><p>
<a class="indexterm" name="id2602367"></a>
<a class="indexterm" name="id2602374"></a>
<a class="indexterm" name="id2602381"></a>
Samba provides two hooks for shutting down or rebooting
the server and for aborting a previously issued shutdown
command. Since this is an operation normally limited by
the operating system to the root user, an account must possess this
right to be able to execute either of these hooks.
</p></dd><dt><span class="term">SeTakeOwnershipPrivilege</span></dt><dd><p>
<a class="indexterm" name="id2602403"></a>
<a class="indexterm" name="id2602410"></a>
This right permits users to take ownership of files and directories.
</p></dd></dl></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2602423"></a>Privileges Suppored by Windows 2000 Domain Controllers</h3></div></div></div><p>
For reference purposes, a Windows NT4 Primary Domain Controller reports support for the following
privileges:
<a class="indexterm" name="id2602433"></a>
<a class="indexterm" name="id2602440"></a>
<a class="indexterm" name="id2602448"></a>
<a class="indexterm" name="id2602455"></a>
<a class="indexterm" name="id2602462"></a>
<a class="indexterm" name="id2602469"></a>
<a class="indexterm" name="id2602476"></a>
<a class="indexterm" name="id2602483"></a>
<a class="indexterm" name="id2602490"></a>
<a class="indexterm" name="id2602497"></a>
<a class="indexterm" name="id2602504"></a>
<a class="indexterm" name="id2602511"></a>
<a class="indexterm" name="id2602518"></a>
<a class="indexterm" name="id2602525"></a>
<a class="indexterm" name="id2602532"></a>
<a class="indexterm" name="id2602540"></a>
<a class="indexterm" name="id2602546"></a>
<a class="indexterm" name="id2602553"></a>
<a class="indexterm" name="id2602560"></a>
<a class="indexterm" name="id2602567"></a>
<a class="indexterm" name="id2602574"></a>
<a class="indexterm" name="id2602581"></a>
<a class="indexterm" name="id2602588"></a>
</p><pre class="screen">
SeCreateTokenPrivilege Create a token object
SeAssignPrimaryTokenPrivilege Replace a process level token
SeLockMemoryPrivilege Lock pages in memory
SeIncreaseQuotaPrivilege Increase quotas
SeMachineAccountPrivilege Add workstations to domain
SeTcbPrivilege Act as part of the operating system
SeSecurityPrivilege Manage auditing and security log
SeTakeOwnershipPrivilege Take ownership of files or other objects
SeLoadDriverPrivilege Load and unload device drivers
SeSystemProfilePrivilege Profile system performance
SeSystemtimePrivilege Change the system time
SeProfileSingleProcessPrivilege Profile single process
SeIncreaseBasePriorityPrivilege Increase scheduling priority
SeCreatePagefilePrivilege Create a pagefile
SeCreatePermanentPrivilege Create permanent shared objects
SeBackupPrivilege Back up files and directories
SeRestorePrivilege Restore files and directories
SeShutdownPrivilege Shut down the system
SeDebugPrivilege Debug programs
SeAuditPrivilege Generate security audits
SeSystemEnvironmentPrivilege Modify firmware environment values
SeChangeNotifyPrivilege Bypass traverse checking
SeRemoteShutdownPrivilege Force shutdown from a remote system
</pre><p>
And Windows 200x/XP Domain Controllers and workstations reports to support the following privileges:
<a class="indexterm" name="id2602626"></a>
<a class="indexterm" name="id2602632"></a>
<a class="indexterm" name="id2602640"></a>
<a class="indexterm" name="id2602647"></a>
<a class="indexterm" name="id2602654"></a>
<a class="indexterm" name="id2602661"></a>
<a class="indexterm" name="id2602668"></a>
<a class="indexterm" name="id2602675"></a>
<a class="indexterm" name="id2602682"></a>
<a class="indexterm" name="id2602689"></a>
<a class="indexterm" name="id2602696"></a>
<a class="indexterm" name="id2602703"></a>
<a class="indexterm" name="id2602710"></a>
<a class="indexterm" name="id2602717"></a>
<a class="indexterm" name="id2602724"></a>
<a class="indexterm" name="id2602732"></a>
<a class="indexterm" name="id2602738"></a>
<a class="indexterm" name="id2602745"></a>
<a class="indexterm" name="id2602752"></a>
<a class="indexterm" name="id2602759"></a>
<a class="indexterm" name="id2602766"></a>
<a class="indexterm" name="id2602773"></a>
<a class="indexterm" name="id2602780"></a>
<a class="indexterm" name="id2602788"></a>
<a class="indexterm" name="id2602794"></a>
<a class="indexterm" name="id2602802"></a>
<a class="indexterm" name="id2602809"></a>
<a class="indexterm" name="id2602816"></a>
<a class="indexterm" name="id2602823"></a>
</p><pre class="screen">
SeCreateTokenPrivilege Create a token object
SeAssignPrimaryTokenPrivilege Replace a process level token
SeLockMemoryPrivilege Lock pages in memory
SeIncreaseQuotaPrivilege Increase quotas
SeMachineAccountPrivilege Add workstations to domain
SeTcbPrivilege Act as part of the operating system
SeSecurityPrivilege Manage auditing and security log
SeTakeOwnershipPrivilege Take ownership of files or other objects
SeLoadDriverPrivilege Load and unload device drivers
SeSystemProfilePrivilege Profile system performance
SeSystemtimePrivilege Change the system time
SeProfileSingleProcessPrivilege Profile single process
SeIncreaseBasePriorityPrivilege Increase scheduling priority
SeCreatePagefilePrivilege Create a pagefile
SeCreatePermanentPrivilege Create permanent shared objects
SeBackupPrivilege Back up files and directories
SeRestorePrivilege Restore files and directories
SeShutdownPrivilege Shut down the system
SeDebugPrivilege Debug programs
SeAuditPrivilege Generate security audits
SeSystemEnvironmentPrivilege Modify firmware environment values
SeChangeNotifyPrivilege Bypass traverse checking
SeRemoteShutdownPrivilege Force shutdown from a remote system
SeUndockPrivilege Remove computer from docking station
SeSyncAgentPrivilege Synchronize directory service data
SeEnableDelegationPrivilege Enable computer and user accounts to
be trusted for delegation
SeManageVolumePrivilege Perform volume maintenance tasks
SeImpersonatePrivilege Impersonate a client after authentication
SeCreateGlobalPrivilege Create global objects
</pre><p>
<a class="indexterm" name="id2602897"></a>
The Samba Team is implementing only those privileges that are logical and useful in the UNIX/Linux
environment. Many of the Windows 200X/XP privileges have no direct equivalence in UNIX.
</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2602911"></a>The Administrator Domain SID</h2></div></div></div><p>
<a class="indexterm" name="id2602919"></a>
<a class="indexterm" name="id2602926"></a>
<a class="indexterm" name="id2602933"></a>
<a class="indexterm" name="id2602940"></a>
<a class="indexterm" name="id2602946"></a>
Please note that every Windows NT4 and later server requires a domain Administrator account. Samba versions
commencing with 3.0.11 permit Administrative duties to be performed via assigned rights and privileges
(see <a class="link" href="rights.html" title="Chapter15.User Rights and Privileges">User Rights and Privileges</a>). An account in the server's passdb backend can
be set to the well-known RID of the default administrator account. To obtain the domain SID on a Samba domain
controller, run the following command:
</p><pre class="screen">
<code class="prompt">root# </code> net getlocalsid
SID for domain FOO is: S-1-5-21-4294955119-3368514841-2087710299
</pre><p>
<a class="indexterm" name="id2602980"></a>
You may assign the domain administrator RID to an account using the <code class="literal">pdbedit</code>
command as shown here:
<a class="indexterm" name="id2602994"></a>
</p><pre class="screen">
<code class="prompt">root# </code> pdbedit -U S-1-5-21-4294955119-3368514841-2087710299-500 -u root -r
</pre><p>
</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
<a class="indexterm" name="id2603018"></a>
<a class="indexterm" name="id2603025"></a>
<a class="indexterm" name="id2603032"></a>
<a class="indexterm" name="id2603039"></a>
The RID 500 is the well known standard value of the default Administrator account. It is the RID
that confers the rights and privileges that the Administrator account has on a Windows machine
or domain. Under UNIX/Linux the equivalent is UID=0 (the root account).
</p></div><p>
<a class="indexterm" name="id2603054"></a>
<a class="indexterm" name="id2603061"></a>
<a class="indexterm" name="id2603068"></a>
<a class="indexterm" name="id2603075"></a>
Releases of Samba version 3.0.11 and later make it possible to operate without an Administrator account
provided equivalent rights and privileges have been established for a Windows user or a Windows
group account.
</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2603088"></a>Common Errors</h2></div></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2603093"></a>What Rights and Privileges Will Permit Windows Client Administration?</h3></div></div></div><p>
<a class="indexterm" name="id2603102"></a>
<a class="indexterm" name="id2603109"></a>
<a class="indexterm" name="id2603116"></a>
<a class="indexterm" name="id2603123"></a>
When a Windows NT4 (or later) client joins a domain, the domain global <code class="literal">Domain Admins</code> group
is added to the membership of the local <code class="literal">Administrators</code> group on the client. Any user who is
a member of the domain global <code class="literal">Domain Admins</code> group will have administrative rights on the
Windows client.
</p><p>
<a class="indexterm" name="id2603156"></a>
<a class="indexterm" name="id2603162"></a>
<a class="indexterm" name="id2603170"></a>
<a class="indexterm" name="id2603177"></a>
<a class="indexterm" name="id2603184"></a>
This is often not the most desirable solution because it means that the user will have administrative
rights and privileges on domain servers also. The <code class="literal">Power Users</code> group on Windows client
workstations permits local administration of the workstation alone. Any domain global user or domain global
group can be added to the membership of the local workstation group <code class="literal">Power Users</code>.
</p><p>
<a class="indexterm" name="id2603211"></a>
<a class="indexterm" name="id2603218"></a>
<a class="indexterm" name="id2603226"></a>
<a class="indexterm" name="id2603232"></a>
See <a class="link" href="NetCommand.html#nestedgrpmgmgt" title="Nested Group Support">Nested Group Support</a> for an example of how to add domain users
and groups to a local group that is on a Windows workstation. The use of the <code class="literal">net</code>
command permits this to be done from the Samba server.
</p><p>
<a class="indexterm" name="id2603260"></a>
<a class="indexterm" name="id2603267"></a>
<a class="indexterm" name="id2603274"></a>
Another way this can be done is to log onto the Windows workstation as the user
<code class="literal">Administrator</code>, then open a <code class="literal">cmd</code> shell, then execute:
</p><pre class="screen">
<code class="prompt">C:\> </code> net localgroup administrators /add <strong class="userinput"><code>domain_name\entity</code></strong>
</pre><p>
where <code class="literal">entity</code> is either a domain user or a domain group account name.
</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="idmapper.html">Prev</a></td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"><a accesskey="n" href="AccessControls.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter14.Identity Mapping (IDMAP)</td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top">Chapter16.File, Directory, and Share Access Controls</td></tr></table></div></body></html>
|
