Add Computer Object to Access Control Entry for SMB share

TrueNAS General
, ,
1

I have implemented Truenas SCALE to replace an aging Windows File Server, but I have run into a permissions problem. On the Windows File Server, another specific Windows Server had full access to the File Share in the form of an Active Directory Computer Object. Without that, I have had to add modify permissions to the Domain Users group where it was only needed to have Read permissions previously.

How can I add an AD Computer Object, or otherwise allow this server full access to the share?

I found this old post on the old forums:

And have tried a few things relating to using the SID of the computer, but to no avail.

2

Are you trying to apply to the share ACL or to the filesystem ACL? Filesystem ACL at least you should be able to just type in the computer account name: <DOMAIN>\computername$ and it will work.

3

Yes, Filesystem ACL. Share ACL is set to Everyone with full access, and I am using the Filesystem ACL to specify access.

I had entered in the computer name as you have written, \computername$, but it didn’t seem have the same effect as on the Windows File Share. If that is just a difference in how Linux handles SMB file sharing, I guess I can work with it.

4

What do you mean? Did the ACL entry get inserted as expected?

5

Yes, and if that is the right way to do it. Then that will work for me. It did show up as a group ACL entry, should it be a “User”?

6

No. Group works due to how idmap backends are implemented. Basically every AD object could be a user or group (required in order for SID history to work properly).

7

Awesome, thanks!

8

In general if you just need to allow domain computers access to a share, then you can simply grant “domain computers” access. Every computer account is a member of that group.