File sharing permissions for AD Domain Admins?

I've binded Mavericks to a Windows network with Active Directory, turned on File Sharing under System Preferences > Sharing, and added the Domain Admins group; how can I configure permissions so that the Domain Admins can read and write to and from all files and folders on the MAC HD without affecting other user's permissions?
If I "apply to enclosed items..." the Domain Admins' Read & Write permissions from the root volume then Everyone (gets unintentionally propagated) can access all files!
Ideally, the Domain Admins need the same permissions as the root administrator even after a new user has logged onto the MAC and had their Home Folders created in the future; In other words I need them to be able to access files and folders for all accounts past, present and future, but all other user's access must stay the same. Does that make sense?
Is this even possible with AD binding? Would having a MAC OSX Server/Open Directory facilitate this better?
Any help would be much appreciated!

I tried adding the Domain Admins to the wheel group, but that never helped either. Also the "apply to enclose items" only seems to work for the entire share (left side)--not individual users or groups (right sde).

Similar Messages

How to set up a basic file sharing server for my small architectural business?

I have no idea if I have posted in the correct area as this is my first forum post within the apple support community!
I have been using a 21.5" imac running 10.6.8 for the past 5 years to run my small home based architectural design business. I have been using the internal hard drive & backing up the necessary data to a simple usb external hard drive. I am now looking to firstly purchase a new imac 27" retina and purchase new autocad lt 2015 for mac software. I am looking to have another imac (my old mac) running in conjunction with the new mac. I want both macs to be able to access the same data and am slightly unsure what is the best way to achieve this.....As my old mac is currently only running snow leopard and an old version of autocad for mac 2011 it wont run on any more recent OS. Essentially i believe I have 2 main options with this.... (1) I Accept that I have to purchase 2 no. autocad lt 2015 licences @ a cost of £2300. Or option (2), I only run autocad on the new mac as this will be the primary station and the old mac used for primarily for admin & accounts. I have also recently discovered that it is possible to rent autocad licences for £300p/a which may also be another option (3)!
I previously had a problem where my hard drive failed on my mac & lost all data on the internal hard drive, luckily I had been backing up all data regularly to my external hard drive and now loss occurred! Obviously with any new system I want to ensure that my data is safe!
I currently utilise about 250GB of data for business operations but this will obviously grow with time.
In the future I would like to have the option of potentially being able to access the network data remotely via macbook pro whilst abroad although at this stage this really isnt my primary objective. Although I believe I could achieve this through apple remote desktop.
I suppose I should provide some information with regard to the required speed of the system...I regularly open 50-100 photos at the same time totalling around 250-500MB. I would like the system to be able to handle this fairly easily.
I have been trawling through forums and to be honest they are totally confusing me. I have also spent time on the phone to the apple business team and have also discussed my objectives with a member of the apple team in store.
There have been various options advised to me and I really do not know which is the most appropriate route forward.
1 - Using a mac mini as the file server and linking the 2 mac devices to this and backing up the mac mini to an external hard drive to ensure no loss of data.
2 - Using a time capsule as a file server and linking the 2 mac devices to this and backing up the TC to an external hard drive to ensure no loss of data.
3 - Using the new mac hard drive and linking the 2 macs via thunderbolt (old mac does not have thunderbolt and so I guess I would need another new mac?!) and then backing up the data to a time capsule.
4 - Using a RAID based server and linking the 2 no. macs.
Sorry to ramble but any advice really would be greatly received!

Hi sblemings,
Welcome to the community.
I think with your scenario you should ask yourself, how complicated do you want the setup to be and how much time would you have to be able to resolve an issue should one occur with this setup.
All the options that have been advised would work but they come with complexity and therefore time.
1 - Using a mac mini as the file server and linking the 2 mac devices to this and backing up the mac mini to an external hard drive to ensure no loss of data.
2 - Using a time capsule as a file server and linking the 2 mac devices to this and backing up the TC to an external hard drive to ensure no loss of data.
3 - Using the new mac hard drive and linking the 2 macs via thunderbolt (old mac does not have thunderbolt and so I guess I would need another new mac?!) and then backing up the data to a time capsule.
4 - Using a RAID based server and linking the 2 no. macs.
Sorry to ramble but any advice really would be greatly received!
option 1
Would be a way to achieve what you want, it would centralise your files and you would only need to backup your file server (as long as all the files you wanted backed up were on it). This could be achieved either using the client and sharing various folders or using Server which would give you more options than you would possibly need.
option 2
This is exactly like option 1 except that you wouldn't have to administer another mac however you may limit any future growth.
option 3
This option I probably wouldn't pick, you could achieve this with firewire and use a firewire to thunderbolt adapter (saves you having to buy a new iMac)
option 4
This option would, depending on your RAID level, give you disk redundancy but remember you would still need to back this up, as RAID is NOT a backup solution.
I would also ask is there a pressing need to keep the old iMac in service and complicating things by having a server / NAS? Could you not just transfer all your information over to this and continue with the one backup? I would say that doing it this was would be the simplest way of achieving what you want from what I can take from your question.
As for remotely accessing your data, if you have the right hardware the way to achieve this would be to use a VPN and connect back to your data. However a potentially easier way for you ,would be to use a service like logmein or teamviewer to connect back.
Hope this helps, and by all means any questions please ask.
Dan
How to set up a basic file sharing server for my small architectural business?

Problem with File Sharing-Permissions throughout Folders

I'm having an odd problem when setting up a Mac Pro with File Sharing. I have a second Hard Drive in it which is a Server Drive to be shared as a networked Hard Drive for both my MBP and my Fiancee's MBP. Here is the problem I have.
I set up File Sharing and set up both her ID and my ID. Since this is done she is able to get to drive from my MBP and she is able to get to the drive from her MBP. I am able to read or write to those folders. She is able to view them but is unable to write to them.
I went to the Server Drive icon on the Mac Pro's Desktop. When I right click and do "Get Info" and select Sharing I can tell her ID is not listed on any of the Folders. She is listed as Read and Write for the entire Hard Drive (which is an internal drive). I am also listed as Read and WRite and then it lists Everyone and says No Access. The same is listed in System Preferences in File Sharing. I have heard this Everyone 'No Access' can cause problems but I prefer not to give access to everyone. The only other option is Read Only and Read and Write. Also, when I have Everyone selected the - sign is greyed out so I'm unable to remove Everyone.
To continue, what is strange is I thought with it saying on the Server Drive itself for my Fiancee, read & write, that it would say this on every Folder inside. Yet when I select any Folder inside on the Server Drive and select Get Info it says for me "Read & Write" and for Staff "Read Only" and for Everyone "Read only" I'm not even sure where Staff comes fro and of course Everyone is Read Only and my Fiancee not even listed. It just seems that these file sharing permissions are not replicated througout all the Folders when I select it for the Hard Drive itself. What could be causing this and how can I get the same to go throughout the Folders? I know manually I could change them all but this would take a long time and likely still be a problem when any additional Folders are added.

1. I have turned logged into it from my MBP while at Home and if I'm logged in as Guest I only see the Server Drive which is good. My concern is that if I log in with my login I then sell all Folders including the Main 'Macintosh HD' At least as a guest I can only see the Server Drive but is it any way I can stop it from showing all the other folders on the computer since I have no reason to do that?
When you login to a mac as an administrator it is normal to see all the contents of the volumes connected to that mac.
2. Also, I would like to disable all access for Guest. Yet I have it list Everyone or Guest in the file sharing and I have no way of deleting this. I don't want a Guest to be able to connect to this computer or share any files at all on it. Is there any way to disable this?
Goto system preferernces-->accounts
click on the lock to and enter your password to unlock the preference pane.
Then select the guest account. Then uncheck the 2 check boxes. The account should now have 'disabled' underneath it.
3. Security: How secure is this? I am using it on a Home Wi-Fi network with an Airport Base Station 1GB. I have the Leopard filewall set to "Set Access for Specific Services" since it won't work with "Allow only essential services" I hope my home network is more security but with Back to my Mac how hard would it be for someone to be able to find this computer on the network? I don't do any filesharing on my MBP but do have it set up for File Sharing but only with my login ID.
If you have your base station set to distribute ip addresses then it is acting as a NAT router and will firewall you.
I have not setup back to my mac yet so can't comment on its security. Although I would suggest a strong password.
have a read of Mac OS X 10.5: About Back to My Mac security
My method of remote access is to use SSH and run screen sharing over an SSH tunnel.

What's the best Bluetooth file sharing app for iPhone

I'm trying to find a good BT file sharing app for an iPhone 5. I've noticed that the iPhone 5 won't even detect devices such as other phones or computers with BT but seems to have no issue with BT accessories such as satnav. My iPod touch has no problem detecting any BT device which seems odd.
So, is there a good BT file sharing app availble for an iPhone 5?

You won't find any Bluetooth File Sharing app that will work with non-iOS devices. That is something iOS simply does not support.

HT201301 I see some iOS apps in the file sharing list for my iPad device but I do not see the same APP on the file sharing list of my other iOS device

There are some iOS apps appear in the file sharing list of my iPad that does not appear in my iPhone file sharing list. Why is that and why iBook App does not show on the sharing list of my iPad?

The apps which show on the file sharing section on your iPad when connected to your computer's iTunes, you have exactly the same apps installed on your iPhone - they are not separate iPad and iPhone apps that you have installed on your iPad/iPhone, and only the iPad version supports file sharing ?
For iBooks, that won't show, it doesn't support file sharing. You can add ibooks / epubs / PDFs to your computer's iTunes library (the iBooks app if you are using a Mac with OS X Mavericks on it) via File > Add To Library, and you sync them to a device via its Books tab :
If you want to copy them off the device to your computer's iTunes (to the iBooks app on Mavericks) then File > Devices > Transfer Purchases will copy them over (that will copy PDFs and epubs from the iBooks app on your device, not just ibooks).

File Sharing Permissions to Documents Without Having to Assign Each?

Not sure where else to ask this.
Background - work environment. Small 3 person office. Airport network. All computers Duo2Core with 10.5.1.
On my iMac - I have this configuration: Home>Public>Shared>Clients> Abel thru Zulu - (separate folders for each client), and inside each client folder, subfolders such as "Correspondence", "Documents", "Research" and so forth.
When I create a new document, for example - Clients>Charlie>Documents: "Work Paper", and I want my staff to have read/write access in order to revise or supplement "Work Paper", I have to manually Get Info for the documet, type in my password, unlock the little lock, and assign Read/Write.
I understand the security aspect, but for the Clients folder ONLY, I'd like any new document I create and place in there to automatically have Read/Write permissions for my staff.
Know little to nothing about Apple Script, but that's probably the only way to work around the routine of manually going to "Get Info" six dozen or more times a day.
So - anybody got a script that will do the trick? If so, a little instruction on setting it up would also be most appreciated.

I've been fiddling with sharing things between my two admin users on my computer, so that both have read and write permissions to files. I seem to have gotten it right, anyway, I just added a couple of jpegs to the folder from my primary account, logged into the other admin account, opened a jpeg, edited it and saved it with no problem, and did the same with my test account. Perhaps this will help you.
1. The users have to be members of the same group, in my case I picked the group "staff" since both admin users are members of that group, as well as the test account
2. I created a folder in the Sharing folder, called it "readwrite"
3. I then launched Terminal and entered this command:
NoobiX:~ francine$ chmod +a "staff allow write,append,writeattr,writeextattr,fileinherit,directoryinherit" /Users/Shared/readwrite
hit Return. Then did this command:
NoobiX:~ francine$ chmod +a "staff allow addfile,add_subdirectory,delete_child,writeattr,writeextattr,directoryinherit" /Users/Shared/readwrite
hit Return again. Note there are spaces between chmod, +a, the permissions list, and the path.
I then added the files to the readwrite folder, logged in to the other staff accounts, and successfully edited the added files. I then returned to my account, opened one of the edited files and made another change and saved it. Looks like it is working as intended.
Francine
Francine
Schwieder

OS X File Sharing permissions

I have set up a small office network over a WLAN, in which I have computers H2 & H3, which are Mac Minis (late 2012, i5 dual core, 4GB RAM), and two MacBook Pros (late 2008 and late 2010). I am using H3 to store the project folders and have given permissions to various sharing-only users (A, B, C) I created on H3 System Preferences as read only or read and write according to the projects they are working on. This all seemed to work ok, but strange things started to happen:
1. If A is using H2 (or a MBP) and logs in to a project folder on H3 to which he has read and write permissions, and creates a new sub-folder within this, often (but not always) the owner of the folder sitting at H3 cannot see the contents of the new sub-folder. The folder icon shows up with a small red circle with a white dash through it, and says that I do not have permissions to view that sub-folder.
2. For a user at H3 to delete the folder created remotely by A (either from H2 or one of the MacBook Pros) an admin password is required. Why should this happen? H3 is the owner of the folder, and as it lives locally on his drive surely he should be able to do this? It seems to require going into System Preferences>File Sharing, right clicking the folder in questions, and selecting "Apply Permission to Enclosed Items" after which it's possible to delete the folder. However this is a pain to keep doing every time one wants to delete a folder.
3. Once a user is logged in sometimes it is not possible for him to disconnect
Please advise as I am trying to work in an organised way using File Sharing but keep getting stumped.
Spent nearly 2 hours on phone with Apple Support, who first advised software update to 10.9.5, and when this still didn't resolve the issue they seem to be stumped too!

By default, Mac uses POSIX permissions which do not inherit to the sub folders and you are forced to do the apply permissions to apply the permissions on the top level folders to the items created below. You need to set ACL permissions on the folder for the files to pull the inherited permissions. This is easily done with Mac Server, however it sounds like you are not using the server app so you will need to use the chmod commands in terminal in order to set the ACL permissions. If you Google something like "set acl permissions mac os 10.9," there are a number of articles with different ways you can set them and get them working the way you are looking for.

File Sharing Permissions Problem When NEW Files Created

My wife & I have a home office network setup for our business, and are having trouble with shared files over the network. We're both on Macs, and all of our client files reside on an internal hard drive in my Mac Pro. I've set her up as a "Sharing Only" user on my computer (which matches the username & password of her account on her iMac), and have properly setup file sharing in both the System Preferences, and in the directory itself that we want shared. I've also applied the permissions to all files & folders below the main folder, and she can view, open and save whatever she needs and it works great.
*Here's where the problem comes in...* If either of us create a NEW file or folder, the other person doesn't have WRITE access to it (we can browse and open it fine). The second I go to update a file she created, it won't let me over-write it, and I have to go into the permissions for that specific file and give myself Read/Write access. I've experimented with "Groups", and assigned both of us a special group, and applied that group access to that directory, but it doesn't make any difference when a NEW file or folder is created - it doesn't copy the parent directory permissions to itself, it makes one of us the owner, and nobody else has access.
Is there any way around this? We're both constantly creating new files, and it really hampers our workflow to have to keep re-applying file permissions every time one of us creates something new. Ideally, any new files created within that main client folder would automatically have the same permissions as the parent directory. Any help would be greatly appreciated! Thanks!!

Here's how to do this with Access Control Lists.
1) Go to System Preferences -> Accounts. Unlock the padlock. Click the + button. Make a new group. Call this group "sharing" for the purposes of this exercise. Add the users you want to the group.
2) Make a new empty folder in /Users/Shared. Call it "sharefolder".
3) Log in to an admin account and paste all three of these lines at once into Terminal:
sudo chmod +a "sharing allow delete,chown,list,search,add_file,\
addsubdirectory,delete_child,file_inherit,directoryinherit" \
/Users/Shared/sharefolder
4) From now on, any files you create or copy to the sharefolder or to any of its subfolders will inherit read+write permission for all users in the group. If you have any existing files that you want to move into the sharefolder, a simple move by drag & drop won't cause the permissions to propagate. you need to hold down the option key while dragging them in. This will copy them over, ensuring that the ACL permission is properly inherited.
One other caveat: Files created by a small number of OS X apps won't inherit the permissions properly if saved directly into the ACL folder hierarchy. TextEdit is one such app. Save TextEdit files in a temporary location first, and then copy them in. Then they will have the correct permissions.

Apple File Sharing Permissions

I have a folder I'd like to share that is located on a Snow Leopard Machine. I'd like all the users to mount the folder over AFP (Apple file sharing, not Samba or FTP) but mount it as read-only. The folder itself has permissions on it that allow 1 admin user account read/write access, and Everyone else Read-only access. There is only 1 other user account on the machine. Let's call these "admin" and "user1". user1 should have read-only access to the folder. But when I connect to the Snow Leopard machine and mount the folder, it's read/write. The only way I can have the folder mounted using the user1 account and keep it read-only is to also set permissions for admin to be read-only.
Why would this be the case? Why is AFP granting read/write access to every user if the only user that should have it is admin?

Previously, you didn't have Read and execute permissions for the group, now you do.
Also, it didn't list any ACLs under the listing?
You can set ACLs with chmod, but you can also set them up with the sharing preferences. When you give other people access, it sets the appropriate ACLs. I would use the Sharing prefs set them.

File Sharing Webserver for Windows

Hi all,
I've a mac mini (late 2012, yosemite, server 4) with a strange problem.
I host multiple sites and use file sharing smb. When I edit a file on my mac (connected thru smb) and save it on the server, everything works fine. I can reload the site and the new/edited file is used.
When I do the same on a windows machine (same user, etc), I can open, edit and save the file but, for some reason, it doesn't work when I reload the site.
What should I do to make this also work directly on a windows machine?

Some extra info:
The difference between edited files from a mac and from a windows machine is that files from a mac have "everyone read only" and from a windows machine have "everyone no access" (besides the normal spotlight, users, etc. Those are the same).
So it seems that there's a difference in permissions based on mac/windows, even with the same user?

File Sharing permissions

I have 2 iBooks in the same office. They are set for file sharing. I have trouble moving files from one computer to the other. Always get the message that I don't have the proper permissions. How does one resolve this problem - so that all files can be easily moved from one computer to the other?
Thanks
Charles

Not sure what folders you['re trying to copy/move from/to.
Go get SharePoints from , http://www.hornware.com
Install on both macs.
Configure shared folders & permissions using this fine utility.
(sharepoints app manages the samba server files that regulate sharing permissions. It's a GUI view into the smb.conf setup)

File Sharing Permissions Issue

We are using file sharing between macs in an art department, where we are sharing out one folder that contains many sub folders that contain art divided by customer name and job/art numbers. Whenever an artist makes a new folder (or copies a "Template" folder) into the shared working folder I have to then go to that artists machine and tell the Mac to copy permissions to all enclosed folders in order for another user to access the files contained within the new folders.
Is there a way to make all enclosed folders in the shared folder inherit permissions? We have 15 artists sharing files, so fixing sharing permissions several times a day is getting old.

you can put a name of a group instead of a specific user name in the command. for example you can put "staff" in there which is a group that contains all users with accounts on the machine. or you can just put "everyone" instead of "username" and that will work for all users including guest users. you can also make a group in system preferences->accounts, add the users you want to that group and use the name of that group in the command.

Question on File Sharing Settings For Windows 7

Should be a simple question. Am just switching over from Windows 2000, SQL 2000, IIS 6, and CF7 TO: Win 7 SP1 64-bit, SQL 2008, CF 9 and IIS 7.
Just installed IIS 7.5 on the new Win 7 machine (my development PC for creating/testing CF pages), and included the IIS 6 compatibility components. However, web pages are not being displayed.
Question: With Windows 7, do you have to remove the checkmark in Folder Options for "USE SHARING WIZARD", as you had to do with Windows XP's "SIMPLE FILE SHARING"?
In WinXP, by removing SIMPLE FILE SHARING, it brought up the WEB SHARING tab when you right-clicked a folder, allowing you to run your local web pages. Is this how it should be with Windows 7, in order to get my "localhost" web pages to dispay?
Lastly, if I do need to make this change, will it have any impact on File Sharing settings I've already made with my router, to allow FILE SHARING between laptop and desktop, via the router?
Thanks much for the advice.
Gary

Some extra info:
The difference between edited files from a mac and from a windows machine is that files from a mac have "everyone read only" and from a windows machine have "everyone no access" (besides the normal spotlight, users, etc. Those are the same).
So it seems that there's a difference in permissions based on mac/windows, even with the same user?

Seeking a document management and file sharing solution for an online client portal

Hi
Late last year our developers created a Member’s Portal for a client’s website (built with WordPress) enabling Members to have a secure area for a discussion forum and crucially, secure
document storage and access, and file-sharing. The WordPress plugin chosen for the Portal was WP-Client.
We have a problem though and I wonder if you or anyone can help?
Basically, the solution was supposed to be like Dropbox or Google Drive but within the Portal but with slight differences. The problem is that the current solution we have isn’t like either
and has various flaws which make it unpopular with most members. It uses free software called kcfinder – see
http://kcfinder.sunhater.com/ as the basis for the file management systems.
So we are seeking to change the file management system. This system must do the following:
It’s got to be intuitive e.g. the action open or download must be ‘typical’ (it is not so in kcfinder you have to right click to download for instance
You must be able open an Office document (especially Word, Excel and Powerpoint) online in situ within the portal. Currently in kcfinder you have to download it.
You must be able to edit it online. Currently you have to download it, open it, edit it, re-upload it and overwrite it.
The client uses Sharepoint (I think that’s part of MS Office 365) and wants to be able to I think drag docs from there straight into the Portal file management system (I think at the moment they have to download a file from Sharepoint to their hard drive
and then upload to kcfinder.
We are currently investigating using a WP plugin for Google Drive
https://wp-glogin.com/drive/ and Google Apps for work to create some sort of file management system that meets the requirements.
However having loaded the plugin, the developer has found that two issues remain that so far defeat us:
Firstly, and this seems to be applicable to using Google Drive outside the portal as well as in it - you can’t edit Word docs online in Google Drive without creating a Google Doc. This means we get duplicate docs which we don’t want – and they’re in
the wrong format. We want Word and no duplication. The members/users don’t have time to delete and change the format back to Word. I guess the same applies to other Office docs.
Second, apparently you can’t create a new folder in Google Drive in the portal.
So my question for this forum is really what can you suggest, either as a fix to the Google Drive solution or is there a totally different plugin or set up we can use? Ideally it should
be Office-based or friendly since most of our users use Microsoft Office.
The other proviso is that it must be affordable. We/client cannot afford the $10 per user per month that some systems charge. The attractiveness of the Google option is not only the wide
use of Google Docs (notwithstanding the fact that you can't open Word in GD instead it creates a duplicate in GD) but the fact that the plugin is cheap.
Thanks in anticipation.

Hi,
Why don't you take a look at Office Web App server which provides browser-based file viewing and editing services for Office files:
https://technet.microsoft.com/en-us/library/jj219435.aspx
It can be integrated with your customized website, and provide the ability to online view/editing Office documents..
Hope it helps.
Aravindhan Battepati

File Sharing permissions not saving on second drive

Hello,
in my Mac Pro running 10.5.6 I have a second drive that I recently installed, This drive has two folders in it that i wish to share. So I did the following steps:
System Preferences > Sharing > File Sharing (SMB Sharing is being used as well as AFP)
I then clicked the Shared Folders + and added folder1
The following users were automatically added
MyAccount Read and Write
MyAccount Read and Write
Everyone Read and Write
Whenever i edit these permissions or attempt to add another user everything seems to of gone fine, but when i close System Preferences and reload it i get the following
folder1 is still shared
and the permissions are still the same as above.
I've looked at editting the smb.conf file in /etc/smb.conf but i don't want to do that unless necessary. Also it doesn't appear that any of the other settings are saved here any information would be appreciated.
Thanks

This was due to the disk being a DOS-format

File sharing permissions for AD Domain Admins?

Similar Messages

Maybe you are looking for