Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a problems with Samba and Active Directory groups which contains special character like '@' ' ' (space).

For example, I've got a group which name is : 'name.surname', I make a share in Samba :

    path = /data/share_city
    create mask = 0660
    directory mask = 2771
    force create mode = 0660
    create mode = 0660
    browseable = Yes
    browsable = Yes
    recycle:repository = .RecycleBin$/%U
    vfs object = recycle:repository recycle:keeptree
    write list = @"name.surname"
    recycle:keeptree = yes
    recycle:versions = yes
    recycle:touch = no
    recycle:exclude = *.tmp|*.temp|*.obj|~$*
    recycle:exclude_dir = /tmp|/temp|/cache
    recycle:maxsize = 1073741824
    recycle:noversions = *.mdb
    admin users = adminad

With smbclient I can connect to share : => ls is ok

smb: \> ls
.                                   D        0  Fri Nov 25 18:55:31 2011
..                                  D        0  Fri Nov 25 17:34:39 2011
test3                               D        0  Fri Nov 25 18:55:31 2011
    56569 blocks of size 8388608. 52263 blocks available

=> mkdir doesn't work

smb: \> mkdir test4
NT_STATUS_MEDIA_WRITE_PROTECTED making remote directory \test4

So if I test with system access all that works and acl inheritance works also

And with groups in the same active directory which doesn't contain characters all works well.

Is what I'm trying to do even possible?

share|improve this question

migrated from Nov 28 '11 at 18:46

This question came from our site for professional and enthusiast programmers.

From an AD perspective, there are very few characters that are disallowed for groups/security principal names. In particular, the @ symbol is allowed. The disallowed characters include:

a leading space; a trailing space; and any of the following characters:

# , + " \ < > ;  

However, if you want the "Pre-Windows 2000" name to match the CN, then you may not use:

/ \ [ ] : ; | = , + * ? < > "  

Note that in practice, AD will allow you to create groups with the hash symbol (#). Also note that the "samAccountName" attribute is the "Pre-Windows 2000" name, so most people would stick to that list of disallowed characters.

More information:

Active Directory Object Names

share|improve this answer
Thanks for your reply Greg, my client said he can rename is groups and when he rename one for testinf it's works. – Guillaume Chéramy Nov 30 '11 at 0:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.