ML Server - ignoring permissions?

Hi--
Setting up a new 10.8 Server Mac Mini, bound to my campus Active Directory. File sharing works well -- too well, in fact. What I'm finding is that ALL valid AD users can connect to a share, even if they don't have permissions.
See my settings in the screenshots below. Does anyone have any insights as to why a user, not listed here, and not in the "CDIB-pAdmins" group, can still successfully connect to the share? Any user with valid credentials on our campus AD can connect to any share on this box, can write files, delete files, create folders, etc. These users are NOT admins on the server, just regular plain users.
It is authenticating users, as if I mistype the password access is denied. If I turn off SMB access, the shares disappear from Windows PCs. So the options here are being recognized, to some extent.
I do not like that "Guests" is still listed in the user list, and that it is still marked "Primary Group," even though the guest access box is unchecked. I cannot remove it from the user/group listing; the remove command is unavailable when guests is highlighted. Is there a way to remove it altogether, or how do I set a different group as the primary? Perhaps that is the issue here.
Also not sure why the local administrator account is listed as "Unknown User." Don't like that.
Any insights are appreciated.

make this simple..
if you want to delete the contents of all mailboxes, then delete all the folders in your mailstore.
Or delete individual mailboxes (named with the user's GUID).
When new mail arrives or the user checks email, their mailbox directory will be recreated.

Similar Messages

Project Server 2010 permissions granted through RBS are not flowing through to Project Sites.

Hi,
I have configured RBS as "The Project Owner is a descendant of the user via RBS" its working fine for Projects.
But users are facing access denied issue when working with project sites RBS is not working for project sites.
Can any one Help me How can i grant permissions Automatically for project sites also as same like projects is it possible ?
The Members in Executives group can see all projects in organization but same like can they see all project sites ?
I have found one blog of
RaymondRis he is recommending to do it manually as its not possible to grant Project site permissions Automatically.
http://blogs.technet.com/b/raymond_ris/archive/2013/05/09/project-server-2010-permissions-granted-through-rbs-are-not-flowing-through-to-project-sites.aspx
Thank You, Kumar KSV

Kumar,
The permissions to project sites is not cotrolled by the RBS, as you have discovered. It is controlled by the Security Category permisisons, and the settings if the permssions are auto synced. The permissions work like this:
Project managers who have published a project or who have Save Project permissions on a project are added to the Project Managers (Microsoft Project Server) site group.
Team members with assignments in a project are added to the Team members (Microsoft Project Server) site group.
Other Project Server users who have View Project Site permission on a project are added to the Readers (Microsoft Project Server) site group.
As long as you use the Auto Sync of permisisons for project sites, i do not think there is any work around.
Cheers,
Prasanna Adavi, Project MVP
Blog:
Podcast:
Twitter:
LinkedIn:

I am running Lion 10.7.2 and I have an external drive hooked to my time machine. I can't rename folders and when trying, I get an error code 8076. The checkbox "ignore permissions for this device" does not show on volume info. Help please???

I am running Lion 10.7.2 and I have an external drive hooked to my time machine. I can't rename folders and when trying, I get an error code 8076. The checkbox "ignore permissions for this device" does not show on volume info. Help please???

The TIme Machine volume does not have that checkbox.
I think the issue is with your Finder...
Go to Finder "Go" menu hold the option key and choose Library. Then go to Preferences trash these files:
com.apple.finder.plist
com.apple.sidebarlists.plist
Then, restart, or log out and in again.
(You will have to reset a few finder prefs the way you like them.)

Why I can't see "Ignore Permissions on this volume" option on folder info?

Why I can't see "Ignore Permissions on this volume" option on folder info?
I'm already logged on with the administrator user and the lock is removed

Not every drive supports that option and I have never seen it on a folder.

Mac Mini with Mavericks Windows Server Access Permissions Problem

We have a Mac Mini that was running Lion. This machine was joined to our Active Directory network using Beyond Trust’s PowerBroker Identity Services add-on. This had been working fine with no issues.
We recently had to change the permissions on the file server (Windows Server 2012) for one of the directory branches. The share permissions are set to Modify and the file permissions were set so the user of the Mac had full control over the files.
The Mac then started experiencing a problem where it could not open some of the files on the network this only affected certain files or folders. A couple of other machines we have running Mavericks who are not domain joined had no problems accessing the files when connected to the share as the same user.
I then upgraded the Mac to Mavericks after removing the Beyond Trust software. The Mac was then re-joined to the domain using the native support of Mavericks. This fixed the problem temporarily and by this all seems fine for maybe one or two hours and then suddenly you cannot access files anymore.
When I looked at the permissions of a file that could not be opened it was showing the same user name twice. One with r/w access and the other with Custom. If the Mac was re-booted the problem would disappear again for another hour or so but then come back.
Thinking the issue was with the AD integration yesterday I took the Mac off the domain and just left it as standalone connecting to the server. The local user accounts that were from the AD user have been deleted so there is now only Administrator, Guest (disabled) and the user. This has not fixed the problem.
What I have noticed is that while it is working when you look at the permissions on the file through finder they say “You have custom access”. When it is broken the permission change to showing the user multiple times, etc.
I have reset the permissions on the server a number of times and it makes no difference.
I am assuming that when it is working the Mac is reading the permissions correctly from the Windows Server and then it suddenly decides to use some other set of permissions it is getting locally to the files.
Does anyone have any idea how I can fix this?
Thanks

Both OS X and OS X Server can host Subversion (SVN), yes. That's been possible for many years, and there are directions posted around the 'net for downloading and installing and setting up the Subversion server.
Distributed source code control packages (and links from there) — such as Mercurial and particularly git — would be some of the more common and newer technologies used here. These too can be installed on OS X and OS X Server.
On the 'net, Subversion, git, Mercurial, Bizaar and other distributed packages are all platform-independent. The remote clients don't know and don't care about the type of server hosting the repository.
As for your Mavericks Server question — and quoting directly from this Apple web page, and thus permitted to be posted here — "The new features in Xcode Server make it easier than ever for a Mac or iOS development team to create robust, reliable software, thanks to continuous integration, testing, and repository hosting services." (Beyond this quote and any other officially-public Apple statements or public Apple presentations, you'll have to be a registered Apple Developer to gather more information and potentially access to the previews, as OS X Mavericks and Mavericks Server and Xcode 5 are all presently under NDA.)

I need some help with my server's permissions asap!

Well, I am here for a reason as you can tell from my subject. Before I ask my question, I will explain my setup so you have a better understanding of what I am trying to do.
I have an intel iMac running Mac OS X Server 10.5. It is setup at home with about 4-5 services running for personal use. It is an Open Directory Master machine. I have clients setup to connect to the server and everything is running well, except for USER permissions. I have TWO partitions on the machine. One is smaller than the other. The first one has my system files along with applications/local users. The second one is used for network home directories and backup storage. So there is only a bootable system on the first partition. Now for my questions:
I know as time goes on, user permissions or even system permissions modify and need to be "repaired" using Disk Utility. I am able to successfully repair the system permissions, but I CANNOT repair network user home folders on the second partition because there is no OS installed on it. If you see what I am trying to do here, please advise the best possible solution. No, I cannot start over. I just want to repair permissions for the users located on another partition other than the one where the OS system files are located.
Thank you.

I didn't say it didn't check user permissions... (if by user permissions you are talking about who owns a file.) I'm saying it won't check user home directories or backup directories.
From Apple's knowledge base article: http://support.apple.com/kb/HT1452
{quote}Files that aren't installed as part of an Apple-originated installer package are not listed in a receipt and therefore are not checked.{quote}
Also in that KB article it explains what Disk Utility does, which is to verify the ownerships and permissions of every file and directory installed from an Apple-originated installer package. Things like iTunes library files aren't installed from a package, they're created by iTunes.
To see all the files and directories that might be checked by Disk Utility run:
find /Library/Receipts -name '*.bom' -exec lsbom {} ;
The command above doesn't distinguish between Apple originated or third party packages, so it actually shows more than what Disk Utility checks. If you limit the output to what gets checked under /Users there is only this:
./Users/.localized 100644 0/0 0 4294967295
./Users/Shared 41777 0/0
./Users/Shared/.localized 100644 0/0 0 4294967295
Now, regarding the "iTunes Library file is locked..." problem, I'll assume that you've already verified the user owns 'iTunes Library' and 'iTunes Music Library.xml' in their ~/Music/iTunes folder and that they have read/write access to these files. If there is a chance that iTunes crashed before this problem occurred, it's possible there is still a lock on one or both of the files. The simplest fix is just to reboot the client machine. If you want to fix it the hard way, you can copy the two files to another directory, delete the originals (which have the locks), then copy the backup files to the ~/Music/iTunes folder.

Sun Directory Server Windows permissions?

Hi All,
I am installing Sun ONE Directory Server 5.2 sp4 on Win2k3 Sp1 and was wondering what permissions it requires to run? I would like to run it as a Windows domain account that only has the permissions the service requires to run on the local machine. It would be ideal to have something that could be applied to both the "Admin Directory server" service as well other instances I might create. Specificially I would be looking for:
# NTFS permissions
# Registry permissions
# Service Dependencies
Any hints or shoves down the right path would be greatly appreciated! Our security policies are really painful.
Thanks!
Dave

Thank You Marco for the response.
Yes, I understand that it is not available, however i am expecting if someone has it on their workstation, and could send it via bigfiles etc. If I dont get any response, surely i will try to reach out to support team.
JPrince.

Server Admin permissions

Hi, where do I change the permissions to allow certain users to edit server settings (e.g. NetBoot settings) in Server Admin?

A user needs to be in the Administrator group in order to run Server Admin and configure a server.
Note that this can have other consequences - since it makes the user an admin they can change any element of the server, not just the components exposed by Server Admin.

File Server and Permissions

We are using Coldfusion 8. Does anyone know a way to set permissions on a file server so my users in my cfapplication are the only people that can access the files in a specific folder on that server? I ask this because we have a lot of public folders on this server and now we want to add some private folders only accesable via people using the application.

If what you are asking is "how can I setup a folder on my fileserver so that files that are accessed through my CF application using tags such as CFFILE are the only ones that can access it" then the answer is to 1) Change the login information for the CF services from the local system service to a domain account, being sure to give that account admin privs, 2) on the file server only give access to the domain user that you just created in step 1.
However, if your CF app is allowing users to access that folder via mechanisms like HREF links (ie, where the account accessing the folder is not the CF account, but the user that is logged into windows running a browser), then you need to put those users in a group and give that group the sole access to the folder.
Scenario #1 presumes that your CF app is doing some sort of authentication so that it knows who is allowed to use it to get to that folder.
-reed

New SQL Server 2014 permissions chart is available

I have created a new permissions poster for the SQL Server 2014 Database Engine. It includes the 3 permissions that are new in SQL Server 2014. It is available at
http://go.microsoft.com/fwlink/?LinkId=229142
Rick Byham, Microsoft, SQL Server Books Online, Implies no warranty

Thanks Rick.
Regards, Vishal Srivastava

Dreamweaver overriding server file permissions

We currently use Dreamweaver CS4, and for some reason sometimes when checking out a file, working on it, then checking it back in, it changes the permissions that that file originally had on the server.
Each folder on our server has a set of permissions tied to logins and the files in each folder inherit their permissions from there. However, sometimes dreamweaver decised to completely change the set of permissions that a file has on the server and disabling the inheritance of permissions entirely on said file. It seems that it changes the ownership of the file from Administrator to Contribute User, but whether this is the cause of the permission changes or a symptom, im not sure.
The oddest thing, however, is that it is far from consistant. It seems that the files that get affected by this are random and it dosn't always happen to the same file twice.
Has anyone else experienced this before or know what could possibly be causing this?
Thanks
-Nick

Just bumping this to see if anyone else has had any luck since i first posted. This issue appears to be happening on several people's computers so it's some conflict between dreamweaver and the server that's causing the bug to happen.
The server we're working on is running Windows Server 2008 with IIS7. Would there be any inherent permissioning conflicts that would explain this issue? If not, is there a way to have dreamweaver not touch permissions at all? Could this be an issue with the checkin/checkout system in dreamweaver?
Thanks for the help,
-Nick

SQL Server UID Permissions and JDBC

I'm using Netbeans 5.5.1 on my local PC and have created a connection to a remote SQL server using IP. I have followed the JDBC driver installation (as obtained from the Microsoft site) and I have even connected to the remote database in my Netbeans IDE using an account "imsteam". All appears okay with the connectivity....except...
With the account "imsteam", that I use to remotely connect to the database server...I can only see tables and stored procedures that were created by the user "imsteam". All other tables and stored procedures have been created/owned by "dbo", which I know exist, but I can't see them in my "run-time" window in Netbeans.
I have had our DBA check the permissions on the SQL server itself, and "imsteam" account has access to all tables and stored procedures, but I still can't see them through the JAVA netbeans IDE.
Is there some little "gotcha" that I need to be aware of when using netbeans so I can see these tables and procedures. Any advice, or references to articles specifically on account permissions with netbeans would be appreciated.
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>formats1='(\\+\\d{1,3} ?)(\$\\d{1,5}\$|\\d{1,5}) ?\\d{1,6} ?\\d{0,7} ?\\d{0,5} ?\\d{0,5}'</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>formats2='(?:\\+? ?[01] ?-?\\.?)?\$?\\d{3}\$?\\�?-?\\.? ?\\d{3}-?\\.?\\�? ?\\d{4}'</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>dialPath='C:/Program Files/Avaya/Avaya IP Softphone'</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>var ecNumStr='';function captureMouseClick(e){sel=event.srcElement;if(sel.className=="clickableSpan"){val=ReturnValidNumber(sel.innerText);if(val){dial(val);}ecNumStr='';}}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>function captureMouseOverOut(e){sel=event.srcElement;if(sel.className=="clickableSpan"){status="Click to dial using Avaya IP SoftPhone";document.body.style.cursor="file://"+dialPath+"/ring.ico";}else{document.body.style.cursor="";status="";}}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>document.onclick=captureMouseClick;document.onmouseover=captureMouseOverOut;document.onmouseout=captureMouseOverOut;</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>function mainFuncFN(){parsePhoneNums();return;}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>function parsePhoneNums(){var formats=new Array;formats[0]=RegExp(formats1,"gi");formats[1]=RegExp(formats2,"gi");for(var nof=0;nof<2;nof++){if(document.body.createTextRange==null)return;var brng=document.body.createTextRange();var drng=brng.duplicate();bodytext=brng.text;var numbers=bodytext.match(formats[nof]);if(numbers==null);else{for(var i=0;i<numbers.length;i++){flag=0;if(ReturnValidNumber1(numbers[i])==-1)continue;if(!drng.findText(numbers))continue;if(check_valid_range(drng) == -1) flag = 1;brng.setEndPoint("StartToEnd",drng);if(flag == 0)assignContextMenu(drng);drng=brng.duplicate();}}}}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>function assignContextMenu(rng){if (rng.parentElement().tagName=='SPAN'){if(rng.parentElement().className=='clickableSpan')return;}if((val2=rng.execCommand("BackColor",0,"YELLOW"))==false)return;fnspan=document.createElement('span');rng.parentElement().appendChild(fnspan);fnspan.className='clickableSpan';fnspan.innerText=rng.text;rng.text="";}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>function ReturnValidNumber(inStr){var retnum="";var digits="0123456789";var others=".()-+ �";var others2=".()-+ ";var others1=" ";var i=0;for(i=0;i<inStr.length;i++){var c=inStr.charAt(i);if(digits.indexOf(c)==-1&&others.indexOf(c)==-1)return -1;if(digits.indexOf(c)!=-1||others.indexOf(c)!=-1){retnum+=c;}}return retnum;}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>function ReturnValidNumber1(inStr){var retnum="";var digits="0123456789";var others=".()-+ �";var alpha="ABCDEFGHIJKLMNOPQRSTUVWXYZ";var i=0;for(i=0;i<inStr.length;i++){var c=inStr.charAt(i);if(digits.indexOf(c)==-1&&others.indexOf(c)==-1&&alpha.indexOf(c)==-1)return -1;if(digits.indexOf(c)!=-1){retnum+=c;}if(alpha.indexOf(c)!=-1){ retnum+=c;}}if(retnum.length<9){return -1;}if(retnum.length>16){return -1;}return retnum;}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>function check_valid_range(rng) {rng1 = rng.duplicate();rng1.moveStart("character",-1);length_orig= rng.text.length;length_1 = rng1.text.length;if(length_orig == (length_1 -1)){inStr = rng1.text; var digits = "0123456789";var alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";var c1 = inStr.charAt(0);if ((digits.indexOf(c1) != -1) )return -1;if((alpha.indexOf(c1) != -1))return -1;}rng1.moveEnd("character",1);length_2 = rng1.text.length;if(length_1 == (length_2 -1)){inStr = rng1.text;var digits1 = "0123456789-";var alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";var c2 = inStr.charAt(length_2 -1);if( (alpha.indexOf(c2) != -1))return -1;if((digits1.indexOf(c2) != -1))return -1;}return 1;}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>function dial(telephoneNumber){if(telephoneNumber==null)return;if(telephoneNumber.length<2)return;if(telephoneNumber.length>50){number1=telephoneNumber.slice(0,50);window.location="phone://"+number1;}else window.location="phone://"+telephoneNumber;}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>document.onmouseup=mouseup;function mouseup(){ xE=document.selection.createRange();here=xE.duplicate();here.collapse();etype='mouse';try{top.select=(xE.text).slice(0);}catch(e){;}}</SCRIPT>
<SPAN style="DISPLAY: none">h</SPAN>
<SCRIPT defer>mainFuncFN()</SCRIPT>

hi shilohcity,
i did have some problem when i updated my sql server to sp3. The driver i was using.., Atinav's aveConnect3, didn't connect and was throwing exceptions. But after contacting their tech support, they provided me with an updated version, which they had released recently, and that solved the problem. I now believe that with that support, what i paid for that driver was worth it.'cos I would've been kept waiting for the updates if i was using some free driver with poor tech support.
see these links..
http://forum.java.sun.com/thread.jsp?forum=48&thread=351239
and another one
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&threadm=e4774458.0301270610.134f9e5d%40posting.google.com&rnum=1&prev=/groups%3Fq%3DaveConnect%26hl%3Den%26lr%3D%26ie%3DUTF-8%26oe%3DUTF-8%26selm%3De4774458.0301270610.134f9e5d%2540posting.google.com%26rnum%3D1
I do think this is some problem that could be solved by the driver vendors. the M$ 's TDS version is still a mystery as far as i know. and the driver should communicate with sql server using this TDS protocol. I dont know, may be SP3 would've introduced updates in the TDS protocol.. and the drivers should be able to support it, or new updated versions released.
It can happen in future too... M$ may change their stance anytime.. better be wise in choosing your DB Server and even be more careful while chosing JDBC drivers.
cheers,
-Jer

Wiki server sharing permissions aren't working.

The sharing permissions or my documents in the wiki server don't seem to be working. All of my documents are set to no access for logged in and unauthenticated users. However I can still see my documents listed and accessible in the All Activity section of the wiki server when I am logged out. This is a real problem. Any ideas?

I spoke with Apple yesterday. This issue is being elevated to the appropriate team as a definite problem. The workaround for now is to set the permissions to read or read/write, click OK, then go back in and set it ot "no access" and click OK. This should set and reset the permission for the document.
It worked for me.

When a win7 users accesses a file on the server the permissions on the file revert to read only.

Hi there,
Originally my enviroment was 100% Mac, but now we have merged with another company who are all PC users.
The issue I'm having is when a Windows 7 client accesses a file on the Snow Leopard server the file becomes Read Only, and I have to manually propergate the permissions to fix it. This isn't an issue with XP users.
So far this is only happening with Excel files.
Is anyone else experiencing this issue? Any help would be greatly appreciated.
Cheers,
J

I'm having a similar issue as well. Excel 2007 appears to be the culprit, but hard for me to say. Running 10.6.8 here as well.

Windows Server 2003, permissions, username prompts, etc.

Hello all,
I have a unique situation that I need a lot of help with. I work in a prison and teach an introduction to computers course with 20 lab computers and 1 file server. The lab computers are all running Windows XP Professional and the file server is running Windows
Server 2003.
The way these lab computers are setup is with DeepFreeze so that any changes the inmates make to the computer is wiped clean 100% when the machine gets rebooted (this is a must have as some of these guys are quite nefarious and like to cause mischief for
no reason). I'd like to be able to setup the computers so that they work like this:
- Each of the student lab computers are all part of the domain
- When they login, they login with the generic "Student" account which is "Student" username and "password" password. This account exists on the domain and has absolutely 0 privileges.
- Upon login, a logon.bat script pops up a dialog box asking them for their personal username and password which will then, based upon their entry, map a network drive to their own personal folder.
The reason they need to login with a generic account first is because that generic account has already been configured on the computer with certain rights as to what they can and can't access as well as certain shortcuts and other stuff. In addition, it
has the Windows XP theme disabled and loads the classic theme instead as well as various other tweaks such as not grouping all taskbar items, showing all folders in the "detail" layout, not popping up the "desktop cleanup wizard", etc,
etc. That one user profile is configured exactly the way it needs to be for them to be productive. If I have them all login to the machines with their own username/password, all of those fine details would be lost, especially considering DeepFreeze and the
fact that it wipes out any changes they make to the computer.
Is it possible to have them login with the generic account and then once they login, get a login prompt so that they can work with their own user folders?
At first I had it setup so that they all had the "users" folder mapped, however any student could make any change they wanted to other student's folders. I'm getting pretty tired of having to go in and restore files for students because some other
inmate decided they wanted to delete all of that student's work.
Thanks everyone, and hopefully I can get some help in this matter.

Hi,
Thanks for posting in Microsoft TechNet forums.
We can achieve the target by following the steps below:
1.Create a logon-stript file and named "logonsript.cmd".The content is:
if not exist "\\fileservername\sharefoldername\%username%" md "\\fileservername\sharefoldername\%username%"
if not exist h: net use h:
\\fileservername\sharefoldername\%username% /persistent:yes
Note:fileservername is the netbios name of your fileserver.All of Students' personal folders is in the sharefolder.
2.Assign the permissions to the sharefolder.
Cancel the option of "Include inheritable permissions from this object's parent".
Remove the group "Users" in the security TAB.
Give "full control" permissions to the group "creator owner" and apply to:"Subfolders and files only".
3.Edit GPO
Open Group policy object editor.
User configration--Windows Settings--Script(Logon/Logoff),
Double-click "Logon" on the right,click "Show Files" buttom,copy "Logonsript.cmd" to this folder,close this page.
Then click"Add..." buttom,click "browse" and choose the script file in the folder which the script file was copyed to.
Click "confirm".
When a student use the domian account to log in,a personal folder will be created automatically with "logon name" in your fileserver ,the person folder will be mapped as a dirve "H" automatically. Everyone can only access his/her own folder.
If the issue still exists, please feel free to let me know.
Ted

ML Server - ignoring permissions?

Similar Messages

Maybe you are looking for