ACL´s in local AD

[dnutan (Marc)]

@tschmitz

Do I get that right that the folder access gets only controlled over usergroups ?

For the time being, that’s true. Don’t know if there’s any plan to extend it in the near future.
But should be possible to do it with an extra tool (explorer, RSAT, smbcacls, samba-tool… on NS7 it was also possible through setfacl):

It is possible to edit ACLs with a SMB client, like the Windows Explorer application installed with Windows Pro flavours, or the smbcacls command provided by the Samba project.

@davidep

ACLs are stored inside an extended attribute: user.NTACL. The contents of that attribute are difficult to administrate with Linux commands because are encoded as Samba likes. You could check commands like smbcacls or samba-tool ntacl set; the best tools are provided by Windows