`<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi Everybody,</p>
<p>I would like to refresh my post sent around 3 month ago. The
issue still persists...</p>
<p>What I've got is</p>
<ul>
<li>Ubuntu 16.04 with Samba 4 as AD DC<br>
</li>
<li> OmniOSce CIFS server is joined to AD domain</li>
<li>Windows 10 Pro joined to AD domain</li>
<li>and some more client computers joined<br>
</li>
</ul>
<p>I do AD administration from Win10 with RSAT. I've created a lot
of accounts for employees.</p>
<p>PROBLEM: Some users are denied access to OmniOSce shares while
other users can connect without problems. I would like to stress:
the issue is present only with OmniOS shares. Users ARE authorised
thru AD DC.</p>
<ul>
<li>There is ACL rule for a "employees" AD group allowing access
for the members,</li>
<li>there are about 20 members and only a few of them have
problem,</li>
<li>problematic accounts CAN connect to another Windows machine
via RDP and are authorized by AD DC (I even changed passwords to
check and still can connect with the new passwords),</li>
<li>problematic accounts cannot access the CIFS share from
OmniIOSce server.</li>
</ul>
<p>When I try to access the server from Ubuntu machine I get the
following with "good_user":</p>
<blockquote>
<pre>$ smbclient -U test26 -L //omnios
Enter test26's password:
Domain=[DOMAIN_NAME] OS=[SunOS 5.11 omnios-r151026-51c7d] Server=[Native SMB service]
Sharename Type Comment
--------- ---- -------
public Disk
c$ Disk Default Share
test1 Disk
test2 Disk
ipc$ IPC Remote IPC
test Disk
Domain=[DOMAIN_NAME] OS=[SunOS 5.11 omnios-r151026-51c7d] Server=[Native SMB service]
Server Comment
--------- -------
Workgroup Master
--------- -------
</pre>
</blockquote>
<p>and with "bad_user" I get <br>
</p>
<blockquote>
<pre># smbclient -U bad_user -L //omnios
Enter bad_user's password:
session setup failed: NT_STATUS_ACCESS_DENIED</pre>
</blockquote>
<p>The same results are obtained from Windows machine with "net
view \\omnios" command</p>
<ul>
<li>When I log in to Windows machine with "bad user" I can log in
properly but "net view" command produces error 53.</li>
<li>When I log in to the same Windows machine with "good user", I
can list shares with "net view" command.</li>
</ul>
<p>I cannot see any difference between the users. They are members
of the same AD groups. They were created one by one.</p>
<p> As a workaround I can disable problematic accounts, create new
accounts and they work as a charm. But that is just a temporary
workaround.<br>
</p>
<p>Can the issue be related to SID numbers? Maybe OmniOS does not
like some of them?</p>
<p>I have the following ID mappings on OmniOS:</p>
<p><tt># idmap list</tt><br>
<tt>add <a class="moz-txt-link-abbreviated" href="mailto:winuser:administrator@local.domain_name.net">winuser:administrator@local.domain_name.net</a>
unixuser:root</tt><br>
<tt>add <a class="moz-txt-link-abbreviated" href="mailto:wingroup:administrators@local.domain_name.net">wingroup:administrators@local.domain_name.net</a>
unixgroup:root</tt><br>
<tt>add -d <a class="moz-txt-link-abbreviated" href="mailto:winuser:*@local.domain_name.net">winuser:*@local.domain_name.net</a>
unixuser:domain_name</tt><br>
<br>
</p>
<p>The issue drives me crazy. Any help or thoughts appreciated.</p>
<p>Regards,<br>
</p>
<pre class="moz-signature" cols="72">--
Piotr</pre>
</body>
</html>
`