0

I'm trying to access a share using user Administrator while the ACL contains Administrators (the group).

The permissions on the share are Administrator: Full Control. (This is Windows 2016)

The security settings for objects inside the share inherit the ACL which contains the group Administrators with full control, as well as the group Users with Read & Execute permissions only.

I am having trouble writing/deleting these objects from a CIFS mount.

The share is mounted from Linux with no additional options, except for specifying the Administrator user to connect, resulting in:

(rw,relatime,vers=1.0,sec=ntlmssp,cache=strict,username=Administrator,domain=SERVER,uid=0,noforceuid,gid=0,noforcegid,addr=1.2.3.6,file_mode=0755,dir_mode=0755,nounix,mapposix,rsize=61440,wsize=65536,actimeo=1)

Expected result: Since Administrator belongs to group Administrators, I should have full access using the CIFS mountpoint.

Actual result: I can only read but not write nor delete.

I looks like for some reason "Administrator" over CIFS is mapped to the Users group, not Administrators: Leaving only Administrators in the ACL and removing Users gives no access at all anymore. Explicitly specifying/adding Administrator (the user) in the Windows ACL gives R/W access.

0

It's not only a remote effect from a Linux mount but also happens from a Windows machine ("You need permission to perform this action", "You require permission from Administrators to make changes to this file").

Locally, you will find that this has to do with UAC. The problem is also group policy "User Account Control: Use Admin Approval Mode for the built-in Administrator account" which is enabled on the machine in question but disabled by default (if the docs are correct).

Disabling it effectively gives access to user "Administrator" without UAC in the described scenario.

The question that remains is why adding a specific ACE for "Administrator" is so much different and does not trigger UAC in any case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.