amarcionek

updated

11 years ago

A

amarcionek

1 Rookie

56 Posts

0

8302

April 8th, 2015 14:00

Changing File Ownership on SMB

I'm having a bit of an issue getting ownership to work.  Little background: I have an app that archives files to an Isilon SMB share.  But for the moment, I'm just experimenting with Windows explorer given that I can't get it to work there.

Two shares, 1 on Isilon and 1 on Windows Server 2012.  I have 1 folder and 1 file in the folder in each share.  Share permissions on both give THE domain administrator full control.

Folder ACL contains 2 allow ACEs, both full control; [DOMAIN]\Administrator and CREATOR OWNER

File ACL contains the 1 inherited ACE, full control; [DOMAIN]\Administrator

Both file and folder are owned by [DOMAIN]\Administrator

Logging into a separate Windows Server 2012 R2 instance as [DOMAIN]\Administrator, I mapped a network drive to each share.  For either the folder or the file, if I try to change the owner to anything other than myself, on the Windows share, that succeeds, but on Isilon I get an ACCESS DENIED error (Details using Procmon: IRP_MJ_CREATE succeeds with WRITE_OWNER but IRP_MJ_SET_SECURITY fails with Information:Owner.)

I'd even tried changing the Isilon SMB permission for [DOMAIN]\Administrator to run as root and remapped the drive to no avail.

Here is the output from the shell on that file with [DOMAIN] substituted for our actual domain:

Isilon-7-2-1# ls -led Inventory\ Job\ SMB.Log

-rwx------ +  1 [DOMAIN]\admin  [DOMAIN]\domai  522 Apr  6 15:50 Inventory Job SMB.Log

OWNER: user:[DOMAIN]\administrator

GROUP: group:[DOMAIN]\domain users

CONTROL:dacl_auto_inherited

0: user:[DOMAIN]\administrator allow inherited file_gen_all,inherited_ace

I'd rather not use THE domain administrator for some of these tests, but I figure if I get it to work there, then programmatically I can prove it out. Ultimately, the more typical use case will be to give our app some sort of administrative access to the share in whatever form and do the proper process elevation (SeTakeOwnership. SeRestore, etc.)  But any help I can ge initially here will help greatly. Thank you so much.