I have a Windows 2012 R2 AD. Users all are members of the group "domain users", and then each user is also a member of another group, depending on department. All users have "domain users" as their "primary group" in AD. So it looks somethin like this:

uid=40001(user1) gid=123456(domain users) groups=123456(domain users),50001(dep1),301(BUILTIN\users)
uid=40002(user2) gid=123456(domain users) groups=123456(domain users),50002(dep2),301(BUILTIN\users)
uid=40003(user3) gid=123456(domain users) groups=123456(domain users),50002(dep2),301(BUILTIN\users)

Now, on the Samba share, their home directories shall be owned by user:dep. I create the directories, chown to the appropriate group and set the guid to be sticky:

drwxrws---+ 4 user1   dep2 41 Jan 13 17:30 user1
drwxrws---+ 3 user2   dep2 22 Jan 13 17:30 user2
drwxrws---+ 3 user3   dep2 22 Jan 13 17:30 user3

in the /etc/samba/smb.conf I have configured the home directories as follows:

        comment = Home Directories
        browseable = no
        writable = yes
        directory mask=2770
        force directory mode=2770
        create mask=2770
        force create mode=2770
        force security mode=2770
        force directory security mode=2770

But whenever I mount the share in windows and create a file or directory inside, it will be owned by the default group:

-rwxrwx---+ 1 user1   domain users  0 Jan 14 13:16 Test.txt

How can I get samba to use the depX groups for new files and directories?


IRL it does not matter what group owns the files in user's personal folder: no one should have a way to mount it except for user the owner. Here's my config for "homes" share:

    comment = %S: personal folder
    valid users = @MYDOMAIN\my-subdomain-users
    read only = No
    browseable = No
    browsable = No
#    root preexec = /usr/local/sbin/mkhomedir.sh %D %S
    volume = %U-%S
    vfs objects = recycle:keeptree=yes
    create mask = 700
    directory mask = 700
    path = /home/%D/%U

Note the masks: I prohibit any access to files and folders for all users and groups except for the owner (700). You on contrary ALLOW the full access for group. Do you really need that on personal folders?

PS. As to commented "root preexec": older SAMBAs (before 4) could not auto-create home directories and needed such "medical crutch". Also note the path: I created symlink for my subdomain (I will not allow use this share for users from other subdomains): /home/MYDOMAIN --> /var/samba/homes/MYDOMAIN and samba creates users' subdirs inside the path specified: %D replaced with MYDOMAIN and %U - with user's logon name.

| improve this answer | |
  • The 770 is for test purposes, because it was taken 1:1 from a mailing list posting about how to retain the gid in samba. But 700 is not what is desired in this scenario. The home folders are for work related content, and the group is relevant per the specific requirements. – Christian Witte Jan 20 '15 at 11:22
  • Just curious... you imply root preexec isn't needed any more. I have Samba 4.1.16 here and don't get home directories created witout doing a root preexec. Is there another way that I am unaware of? – starfry Feb 24 '15 at 12:12
  • The config in my answer is working, and I've read about autocreation of home dirs somewhere in man, may be smb.conf's man – Troublemaker-DV Feb 26 '15 at 2:03
  • Christian, the home folders are for single user, not for group access. For dept's I made a "super folder" and depts' folders are reside inside it. All departments in my organization have unique codes, then sub folders in "super folder" named after these codes, not dept names. – Troublemaker-DV Feb 26 '15 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.