Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Short version:

I have such situation on a Samba share:

$ ls -lha
total 12K
drwxr-xr-x  3 hka  Domain Users 4.0K Jan 11 17:07 .
drwxrwxrwt 19 root root         4.0K Jan 11 17:06 ..
drwxr-xr-x  2 hka  Domain Users 4.0K Jan 11 17:07 dir A
-rw-r--r--  1 hka  Domain Users    0 Jan 11 17:07 file A

How am I able to change this to following using only Windows SMB/CIFS client (using 3rd party applications is OK)

$ ls -lha
total 12K
drwxr-xr-x  3 hka  Domain Users 4.0K Jan 11 17:07 .
drwxrwxrwt 19 root root         4.0K Jan 11 17:06 ..
drwxr-xr-x  2 hka  ntpoweruser  4.0K Jan 11 17:07 dir A
-rw-r--r--  1 hka  ntpoweruser     0 Jan 11 17:07 file A

Rationale and background info

I'm using POSIX ACLs on Samba shares. Together with acl group control for Samba, it allows me to delegate management of permissions to different users based on group membership.

Thing is, when I create a new file on a Samba share, I'm unable to set its primary group (the one that grants permission to change its permissions). It's being set to my primary group (Domain Users) or group set using force group option in smb.conf share definition.

Removing all groups in windows except the one I want to become the new primary group doesn't work. I can change it using chgrp group folder/ as regular user though shell, but it's suboptimal (not all users are *nix users).

Trying to set new owner to group from Windows file permission window makes the Samba to return permission denied with following log entry:

[2012/01/05 21:13:03.349734,  3] smbd/nttrans.c:1899(call_nt_transact_set_security_desc)
  call_nt_transact_set_security_desc: file = projects/project A/New folder, sent 0x1
[2012/01/05 21:13:03.349774,  3] smbd/posix_acls.c:1208(unpack_nt_owners)
  unpack_nt_owners: unable to validate owner sid for S-1-5-21-4526631811-884521863-452487935-11025
[2012/01/05 21:13:03.349804,  3] smbd/error.c:80(error_packet_set)
  error packet at smbd/nttrans.c(1909) cmd=160 (SMBnttrans) NT_STATUS_INVALID_OWNER

The SID is correct and belongs to group I specified in GUI.

share|improve this question

Thinking through this.

So if a domain user creates a file/directory thats where the problem is? You said it did inherit the gid from the smb.conf set by force group, which it is supposed to. So the problem is when a domain user creates a file it doesn't set the file/directory to that users gid, but gets set by to the Domain Users gid?


Could it be the appropiate rids aren't provisioned for? smb group mapping

share|improve this answer
As this is a large share, I don't want to use force group. – Hubert Kario Jan 11 '12 at 16:04
I added exactly what I want to achieve. – Hubert Kario Jan 11 '12 at 16:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.