Split Permissions for Server Configuration

I'm currently migrating our organization to Exchange 2010. We have 3 different Exchange servers worldwide and different administrators for each. I'm trying to give the other 2 remote sites "Server Configuration" administration so that they may
manage their own Databases and Receive connectors, etc.
When I give their users the Server Configuration rights in RBAC, it's giving them rights to edit databases in ALL locations, not just their own. And this is when I have the scope set to only their OU which contains their server.
Is there a way for me to give them rights to only their server configuration and not all of the servers in the organization?

I've given the remote admin account "Administer Data Store" rights in ADSIEdit at the server level, however they are still unable to make any database changes, everything is locked. Does anyone know exactly what rights are required for users
to make changes to DB's, add DB's, etc. on their server?
EDIT: OK, I've got my answer after a little digging around. This is just for reference:
First I found this article which specifies how to make a custom write scope for specific DB's. This is great, except for the fact that I want full Server management including Receive Connectors, Virtual Directories, etc.
http://social.technet.microsoft.com/Forums/exchange/en-US/d07dbae1-0187-4a71-8798-4471f331f2c8/exchange-2010-rbac-database-and-server-customwritescope?forum=exchange2010
So I found another article on TechNet which talks about writing a custom write scope for a Server.
http://technet.microsoft.com/en-us/library/dd335146(v=exchg.150).aspx
And here's more detail on the actual command and how to point it to the correct AD Site.
http://technet.microsoft.com/en-us/library/dd335137(v=exchg.150).aspx
So in the end, I created two write scopes for two of our remote sites that have Exchange Servers. Then I copied the "Server Management" RBAC role and forced the custom Server Scope I defined. The result is exactly what I want, they
have full server management but only within their own scope. Any changes outside of the scope on a different server get a Denied message.
Thanks for all the responses.

Similar Messages

Best practice for server configuration for iTunes U

Hello all, I'm completely new to iTunes U, never heard of this until now and we have zero documentation on how to set it up. I was given the task to look at best practice for setting up the server for iTunes U, and I need your help.
*My first question*: Can anyone explains to me how iTunes U works in general? My brief understanding is that you design/setup a welcome page for your school with sub categories like programs/courses, and within that you have things like lecture audio/video files and students can download/view them on iTunes. So where are these files hosted? Is it on your own server or is it on Apple's server? Where & how do you manage the content?
*2nd question:* We have two Xserve(s) sitting in our server room ready to roll, my question is what is the best method to configure them so it meets our need of "high availability in active/active mode, load balancing, and server scaling". Originally I was thinking about using a 3rd party load balancing device to meet these needs, but I was told there is no budget for it so this is not going to happen. I know there is IP Failover but one server has to sit in standby mode which is a waste. So the most likely scenario is to setup DNS round robin and put both xserves in active/active. My question now is (this maybe related to question 1), say that all the content data like audio/video files are stored by us, (We are going to link a portion of our SAN space to Xserve for storage), if we are going with DNS round robin and put the 2 servers in Active/Active mode, can both servers access a common shared network space? or is this not possible and each server must have its own storage space? And therefore I must use something like RSYNC to make sure contents on both servers are identical? Should I use XSAN or is RSYNC good enough?
Since I have no experience with iTunes U whatsoever, I hope you understand my questions, any advice and suggestion are most welcome, thanks!

Raja Kondar wrote:
wht is the Best Practice for having server pool i.e
1) having a single large serverpool consisting of "n" number of guest vm
2) having a multiple small serverpool consisting of less of number of guest vm I prefer option 1, as this gives me the greatest amount of resources available. I don't have to worry about resources in smaller pools. It also means there are more resources across the pool for HA purposes. Not sure if this is Official Best Practice, but it is a simpler configuration.
Keep in mind that a server pool should probably have up to 20 servers in it: OCFS2 starts to strain after that.

Setting workgroup backup permissions for server admin user

I apologize in advance for what is probably a trivial question. At school I have set up a Tiger server on a PPC desktop. Open directory is implemented and managed remotely on my personal desktop machine using Workgroup manager. The local server admin account is different from the remote workgroup manager account. I have been backing up using rsync from my machine by logging in with ssh and the Workgroup manager account. Now I want to use ChronoSync on the server machine to set up a simple incremental backup routine. The problem is that ChronoSync runs under the server admin account which does not have permissions to access the group accounts. What is the best way for me to give the server admin account "global" permissions so it can backup the files and directories that were set up using Workgroup manager?
iMac Intel Mac OS X (10.4.9)
iMac Intel Mac OS X (10.4.9)

Hi,
User Account Control treats members of the Administrators group as standard users.
With UAC enabled, members of the local Administrators group run with the same access token as standard users. Only when a member of the local Administrators group gives approval can a process use the administrator’s full access token. This process is the
basis of the principle of Admin Approval Mode.
When an administrator logs on to Windows Vista or newer, the Local Security Authority (LSA) creates two access tokens. If LSA is notified that the user is a member of the Administrators group, LSA creates the second logon that has the administrator rights
removed (filtered).
To work around this issue, use the net use command together with a UNC name to access the network location.
Programs may be unable to access some network locations after you turn on User Account Control in Windows Vista or newer operating systems
http://support.microsoft.com/kb/937624
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Remote Desktop Service Manager - configure permissions for Remote Desktop Users to Send Message, Disconnect, Logoff

Hello, dear colleagues.
We are using Windows Server 2012 R2 as Remote Desktop Server. Also use Windows Server 2008 R2 with Remote Desktop Service Manager to control RDS user sessions (Send Message, Disconnect, Logoff, Query Info).
Send Message, Disconnect, Logoff options works only for users in Administrators group.
I can't to configure permissions for Remote Desktop Users, specific user or AD group.
To set permissions I'm running RDS Host Configuration on Windows Server 2008 R2 and connect to Windows Server 2012 R2. Then double-click
RDP-Tcp, Security tab, add specific user account , AD group or configure
advanced permissions
for Remote Desktop Users.
But, as I sad above, these options works only for users in Administrators group. How to make it work for Remote Desktop Users or specific user, AD group?
Thanks.
P.S. If move specific user from Remote Desktop Users group to Administrators group on
Windows Server 2012 R2 - it works.

Hi,
You can prevent administrators from changing the permissions for a connection by applying the
Do not allow local administrators to customize permissions Group Policy setting.
This Group Policy setting is located in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Security
Apart there is one command with which you can set the permission for that check the related
article. Additionally checkthis
thread for more detail.
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Users and permissions for a small home server

Hello community,
I have been using Linux on the desktop for many years now, but unfortunately my knowledge about servers is very limited, almost non-existent. Therefore my question is most probably equally well fitting here and into the newbie corner.
I'm trying to set up a little home server which should be in charge of following tasks:
- CUPS print server in the local network
- access to shared files through NFS in the local network
- backup (again over NFS)
- an Owncloud server
- maybe a mail server in the long run (NSA, paranoia, etc. )
For now I have set up the print server, the NFS server and was working on the Owncloud installation, when Owncloud gave me some errors with users and permissions. So I was led to the idea of rethinking the users and permissions on server. So far there is only the root user who may do everything. This seems like a quite unsafe configuration. I'd like to make it safer. First, the printer, the backup and the locally shared files should be accessible from the local network only. SSH access should also be accessible locally only. The Owncloud file folder should be accessible from the internet, but of course only for the Owncloud users registered to the Owncloud server.
What is the best way to set up users and permissions for such a set up?
Thanks for any hints,
PhotonX

Hi, i think it depends who are you serving for, if you are just serving for a small office or home server or a big organization. The following quick thinking just came to me:
I think cups set automatically a system user of its own, and runs as it, so no trouble there. Cups also has the option to set users and it uses the system users as default, i think it depends in in how many printers/users your have in your server.Users that can manage cups are in the lp group.
For nfs every user should have their home, samba is also a good option if you have windows computer in your network and it integrates better with graphical file managers like nautilus in the clients side, but it is a hassle to configure.
You should run the web server (owncloud ) as it own user, maybe you can manage to set something up for owncloud in the filesystem, but owncloud uses a database, and the users for owncloud are stored in there, and they are not system users.
You can configure ssh for local use only enabling the corresponding subnets in your /etc/sshd.conf and optionally but recommended you can set a firewall and permissions. You can use iptables but i prefer ufw for simple setup.
I think you should read the wiki:
https://wiki.archlinux.org/index.php/users_and_groups
and the other respective topics in the wiki.
Also as an advice i know that arch linux is a great distribution, but you have to do more work to mantain a stable server. I would recommend debian or another more conservative distro, but of course it is your choice.
Last edited by hydrosIII (2014-11-06 06:26:45)

Service Manager Data Warehouse Install - Analysis Server Configuration For OLAP Cubes Fail

Hello everyone,
I have an issue with my installation of the Data Warehouse for System Center Service Manager 2012 SP1.
My install environment is the following:
Windows Server 2012 – System Center Service Manager (Successfully Installed) - Virtual
Windows Server 2012 – System Center Data Warehouse (Pending) - Virtual
Windows Server 2012 – MS SQL Server 2012 – Physical, Clustered 1<sup>st</sup> of Four Servers
The SQL Server is a clustered installation with named instances, specifically for SharePoint and Service Manager. Each instance has its own IP address and dynamic ports are turned off. I’m installing using the domain administrator account and I also chose
to run the installer as administrator. The domain admin has sysadmin rights to the service manager server and instance I’m trying to install on. However, the account does not have sysadmin rights to some of the other instances.
The install is smooth up until it needs to connect to the Analysis server database. I have tried connecting to the analysis servers on other SQL servers on site and all were successful. The only difference between the older SQL servers, the SQL 2012 development
server and the SQL 2012 Production server I’m trying to install to is that the that the domain admin account doesn’t have sysadmin access on all the databases on the new production server. The SQL server is being installed and configured by a contractor so
if you all have troubleshooting suggestions, I’ll need to coordinate with the contractor.
Starting with the screen below, I began searching for help online. There seems to be no one else with this issue or it is not documented properly. I opened a ticket with MS, called the contractor and troubleshot with him, troubleshot as far as I could on
my own and I’m still at a loss as to what is preventing the installer from connecting specifically to the analysis server.
I first thought the installer was at issue or that the data warehouse sever was at issue. But all signs are pointing at the SQL server. The installer is able to connect to all the other SQL servers – including other 2012 servers (same versions) – so it can’t
be the installer. I’m pretty sure the SQL server is going to be at issue.
After looking at this error, I opened the resource monitor and clicked the dropdown to see if it was trying to connect to the correct server and it was. I then connected to the old and new test and development servers successfully. Then connected to the
SQL 2008 R2 production cluster successfully. I then compared the two servers. The only difference other than the version numbers is that the admin account doesn’t have sysadmin rights on all the SQL 2012 database servers. But the database servers are not the
problem. The analysis servers are.
I then checked the event logs and they are empty as far as this issue is concerned. Actually, there are no errors on the SQL 2012 production box and the Data Warehouse box. I then checked the log that the installer creates during every step of the installation
and this is what is created when the dropdown is clicked for the analysis server configuration screen. The log file location is:
“C:\Users\admin\AppData\Local\Temp\2\SCSMSetupWizard01.txt”
In the file is the following text.
01:03:34:Attempting connection to SQL Server 2012 management scope on SCSMSQL2012
01:03:34:Using SQL Server 2012 management scope on SCSMSQL2012
01:03:36:Collecting SQL instances on server SCSMSQL2012
01:03:36:Attempting connection to SQL Server 2012 management scope on SCSMSQL2012.johnsonbrothers.com
01:03:36:Using SQL Server 2012 management scope on SCSMSQL2012.johnsonbrothers.com
01:03:38:Found SQL Instance: SCSMSQL2012\PWGSQL2012
01:03:38:Found SQL Instance: SCSMSQL2012\SCSMSQL2012
01:03:39:Error:GetSqlInstanceList(), Exception Type: Microsoft.AnalysisServices.ConnectionException, Exception Message: A connection cannot be made. Ensure that the server is running.
01:03:39:StackTrace:   at Microsoft.AnalysisServices.XmlaClient.GetTcpClient(ConnectionInfo connectionInfo)
   at Microsoft.AnalysisServices.XmlaClient.OpenTcpConnection(ConnectionInfo connectionInfo)
   at Microsoft.AnalysisServices.XmlaClient.OpenConnection(ConnectionInfo connectionInfo, Boolean& isSessionTokenNeeded)
   at Microsoft.AnalysisServices.XmlaClient.Connect(ConnectionInfo connectionInfo, Boolean beginSession)
   at Microsoft.AnalysisServices.Server.Connect(String connectionString, String sessionId, ObjectExpansion expansionType)
   at Microsoft.SystemCenter.Essentials.SetupFramework.HelperClasses.SetupValidationHelpers.GetASVersion(StringBuilder sqlInstanceServiceName)
   at Microsoft.SystemCenter.Essentials.SetupFramework.HelperClasses.SetupValidationHelpers.GetSqlInstanceList(String sqlServerName, Int32 serviceType)
I’m now investigating the issue according to this output, and decided to ask you all if you’ve run into this issue and found a resolution.

I am running into same issue . But I don't anything in the instances section related to portipv6 . I do see in the listener section , I tried to remove it . But it comes up again . Please help
<ConfigurationSettings>
<Security>
<RequireClientAuthentication>0</RequireClientAuthentication>
<SecurityPackageList/>
</Security>
<Network>
<Listener>
<RequestSizeThreshold>4095</RequestSizeThreshold>
<MaxAllowedRequestSize>0</MaxAllowedRequestSize>
<ServerSendTimeout>60000</ServerSendTimeout>
<ServerReceiveTimeout>60000</ServerReceiveTimeout>
<IPV4Support>2</IPV4Support>
<IPV6Support>2</IPV6Support>
</Listener>
<TCP>
<MaxPendingSendCount>12</MaxPendingSendCount>
<MaxPendingReceiveCount>4</MaxPendingReceiveCount>
<MinPendingReceiveCount>2</MinPendingReceiveCount>
<MaxCompletedReceiveCount>9</MaxCompletedReceiveCount>
<ScatterReceiveMultiplier>5</ScatterReceiveMultiplier>
<MaxPendingAcceptExCount>10</MaxPendingAcceptExCount>
<MinPendingAcceptExCount>2</MinPendingAcceptExCount>
<InitialConnectTimeout>10</InitialConnectTimeout>
<SocketOptions>
<SendBufferSize>0</SendBufferSize>
<ReceiveBufferSize>0</ReceiveBufferSize>
<DisableNonblockingMode>1</DisableNonblockingMode>
<EnableNagleAlgorithm>0</EnableNagleAlgorithm>
<EnableLingerOnClose>0</EnableLingerOnClose>
<LingerTimeout>0</LingerTimeout>
</SocketOptions>
</TCP>
<Requests>
<EnableBinaryXML>0</EnableBinaryXML>
<EnableCompression>0</EnableCompression>
</Requests>
<Responses>
<EnableBinaryXML>1</EnableBinaryXML>
<EnableCompression>1</EnableCompression>
<CompressionLevel>9</CompressionLevel>
</Responses>
<ListenOnlyOnLocalConnections>0</ListenOnlyOnLocalConnections>
</Network>
<Log>
<File>msmdredir.log</File>
<FileBufferSize>0</FileBufferSize>
<MessageLogs>Console;System</MessageLogs>
<Exception>
<CreateAndSendCrashReports>0</CreateAndSendCrashReports>
<CrashReportsFolder/>
<SQLDumperFlagsOn>0x0</SQLDumperFlagsOn>
<SQLDumperFlagsOff>0x0</SQLDumperFlagsOff>
<MiniDumpFlagsOn>0x0</MiniDumpFlagsOn>
<MiniDumpFlagsOff>0x0</MiniDumpFlagsOff>
<MinidumpErrorList>0xC1000000, 0xC1000001, 0xC100000C, 0xC1000016, 0xC1360054, 0xC1360055</MinidumpErrorList>
<ExceptionHandlingMode>0</ExceptionHandlingMode>
<MaxExceptions>500</MaxExceptions>
<MaxDuplicateDumps>1</MaxDuplicateDumps>
</Exception>
</Log>
<Memory>
<HandleIA64AlignmentFaults>0</HandleIA64AlignmentFaults>
<PreAllocate>0</PreAllocate>
<VertiPaqPagingPolicy>0</VertiPaqPagingPolicy>
<PagePoolRestrictNumaNode>0</PagePoolRestrictNumaNode>
</Memory>
<Instances/>
<VertiPaq>
<DefaultSegmentRowCount>0</DefaultSegmentRowCount>
<ProcessingTimeboxSecPerMRow>-1</ProcessingTimeboxSecPerMRow>
<SEQueryRegistry>
<Size>0</Size>
<MinKCycles>0</MinKCycles>
<MinCyclesPerRow>0</MinCyclesPerRow>
<MaxArbShpSize>0</MaxArbShpSize>
</SEQueryRegistry>
</VertiPaq>
</ConfigurationSettings>

NWDI for the 04s preview fails with 'SLD name-server configuration error'

After the installation, everything seems to work fine except that when I go to CMS, the links on the top seems to be hardcoded to point to http://pwdf3102:50100/dtr, even in the Domain Data. When I tried to change it to my local server, it keeps complaining about "Unexpected error; inform your system administrator: <Localization failed: ResourceBundle='com.sap.cms.util.exception.CMSExceptionMessages', ID='SLD name-server configuration error', Arguments: []> : Can't find resource for bundle java.util.PropertyResourceBundle, key SLD name-server configuration error"
Any suggestions on how to work around this? Thanks.

Brian,
Try to import the model file first by going to SLD->Administration->Import CIM Model. If the problem sticks, then try to remove the systems. The preview version has lots of pre-exist system name in the technical system, which you can find giving errors since they're not reachable. So you can remove them from SLD (Home->Technical Systems) if they are preventing you from procceeding.
You need to go to http://server:port/dtr/system-tools/administration/NameServerConfiguration to update the name server as well.
Hope this helps...
Message was edited by: Yujian Yan

Configure SAP for server-side trust

Hi all,
I am installing BusinessObejcts XI integration for SAP Solution. I need configure SAP for server-side trust. I have read BussinessObjects XI Integration for SAP Solution Installation Guide. In chapter 6, It introduce how to configure SAP Server-Side trust. But I don't understand how to configure SAP for server-side trust, specially configure SAP Cryptographic. Would you please to give me more detailed explanation?
Please advise,
Duypm

Hi Duypm,
the SAP server side configuration is part of the Installation Guide Chapter 6. It starts on Page 94.
If you unclear about this and what SNC configuration means for the SAP server make sure you talk to the administrator for the SAP system. You need administrative rights for the SAP system and the system will have to be restarted as outlined in the installation guide
Ingo

The FTP server configured for this site doesn't seem to match the URL you entered. Make sure that you use the Upload to FTP Host feature in Muse to publish the site directly to the final location and that you are logging on to In-Browser Editing with the

When i tried to login in inbrowserediting.adobe.com i see that:
The FTP server configured for this site doesn't seem to match the URL you entered. Make sure that you use the Upload to FTP Host feature in Muse to publish the site directly to the final location and that you are logging on to In-Browser Editing with the same user.
What does it mean? What is problem?

Hi,
I have just created my First website using Muse and Its all been uploaded to my FTP server but i cant access the in browser editing which was the whole reason why i re-done the website for my client using muse
its saying the following
"The FTP server configured for this site doesn't seem to match the URL you entered. Make sure that you use the Upload to FTP Host feature in Muse to publish the site directly to the final location and that you are logging on to In-Browser Editing with the same user. server configured for this site doesn't seem to match the URL you entered. Make sure that you use the Upload to FTP Host feature in Muse to publish the site directly to the final location and that you are logging on to In-Browser Editing with the same user."
Yet i Can access my website fine "www.calmwood.com.au"
My ftp server responds to either the IP Address or the DNS Address www.calmwood.com.au
so i am not understanding how it thinks its different. when its fully referenced
any help would be appreciated.
thanks

Split valuation for configurable material

Dear expert,
Is it possible to create split valuation for configurable material type (KMAT). I have create split valuation. But when i create material with material type KMAT, the split valuation category can't filled/ edited. Why?

Thanks Charlie..
But, if i maintain semifinished product by batch. Means i have one material number with 2 batch which are sweet and sour. I managed the quantity using batch. Before, i think i used split valuation to managed the value of sweet and sour. If split valuation doesn't work for configurable material, how to manage the value of this 2 batch?

Why can't Firefox set permissions for Snow Leopard Server Web-Site Wikis

I've established a web-site for collaboration of planning for a state-wide NGO and a local citizens-government oversight commission.
I'm using Snow Leopard Server v10.6.4, to drive the web-site, which includes the use of wikis.
In creating a wiki and setting permissions, I find that I cannot set permissions for users or groups to 'read only' from the default 'read & write' while using Firefox. However, I CAN set them to 'read only' using Safari. And, once the permission has been modified in Safari, THEN it can be modified in Firefox.

Solution found at http://michaeljin.wordpress.com/2010/01/05/locked-out-of-mac-os-x-server/
It’s blog update time! Updates have been a little scarce lately, been super busy with getting trophies on PS3
Anyway, recently encountered the following with a Mac mini server running Snow Leopard Server:
Despite being able to ARD / Screenshare the Mac mini, I was unable to get any further than the login window. Authentication credentials are obviously valid. No weird access permissions have been set. However, the weird thing was, I can connect to the server via Server Admin tools (from another Mac) and all other services were running without a hitch.
After much head scratching it turns out to be a sACL (Service Access Control List) issue.
This thread solved the mystery!
http://discussions.apple.com/thread.jspa?threadID=1654864
To save you the trouble, I’ll lay it out here. I cannot take credit for this, but Randall can!
Open Server Admin on a computer (any), and connect with the local admin to the machine.
Select the server and authenticate.
Select Settings, then go to Access. You’ll want to make sure that Login Window and SSH have the local admin account listed if you select the option to “Allow only these users”. For now, I would suggest making sure all services have “Allow all users and groups” selected.
If (as in my case) it was set to Allow All in the first place, simply toggle the settings – back and forth.
Save.
Try logging in again… should be a good one!

Clamav / freshclam mac osx server 10.6.3 ? permissions for freshclam.conf

Hi
Anyone else having this issue: http://www.clamxav.com/index.php?page=dl
I'm behind an authenticating proxy, so I edit the freshclam.conf file to activate its proxy settings. Now I can get the files. But then the freshclam.conf file won't read properly when run by launchd. I can run freshclam under sudo in the terminal, but if I don't sudo it, I get the same error as appears in the log. I find on the net how to set its permissions to be read properly when launched via the launch daemon, but then get a different error is because the permissions are too lax.... they must be less than 700, but it just won't work.
Then the console tells me that freshclam has Error Can't Parse the config file, followed a moment later by launchd telling me that freshclam is exiting, then throttling respawn, then relaunching freshclam with a new ID, and so on infinitely every 10s. I can't find any matching launchctl process that might be doing this.
So for now I've given up; I've kind of solved my problem by turning it all off by uncommenting the Example line in the freshclam.conf file.
And the website mentioned above says that clamav is not compatible with 10.6. Why then is it installed?
I'll try again but for now I'm beat. Anyone with similar experiences, in particular with solutions, including the correct permissions for freshclam.conf, please let me know what worked for you.
Thanks
Chris

ctzsnooze wrote:
And the website mentioned above says that clamav is not compatible with 10.6. Why then is it installed?
It is referencing the clamxav client. That application will not run on 10.6. This is not the same animal that is installed as part of OS X 10.6 server. The server install is chugging away without any errors on the Leopard and Snow Leopard servers I maintain.
Are you dealing with a Mac OS X mail server issue or is this on a client machine?

Printer Server configuration for APEX 3.1.2 in 10g XE

I have APEX3.1.2 installed in 10g XE and I am going thorough the OTN tutorial "[Oracle Application Express 3.0-- Building a Functional Application"|http://www.oracle.com/technology/obe/apex/obe30/apexdev30.htm#l7] in the section "Editing Application Objects".
When I click "Print Attribute" of a page region, it displayed "{color:#ff0000}Report printing is currently not available, there is no print server configured{color}".
Can you tell me what this means and how to resolve it. All I have is APEX3.1.2 installed in 10gXE.
I have searched this forum and it seems that I have to install/configure a printer server?
Thanks!
Kevin

Dan,
I have the same problem as Kevin.
Your answer to his question can be very helpful. But if I follow the link you provide, I cant find the step 5.2.
Step 5.1 is clear. But what are the tasks of step 5.2?
I hope that you can tell me this.
Thank you.
Carlos

Permissions for Linux user accessing Leopard share

We have a very simple networking setup at our video post production facility. Basically, files are shared everywhere and to everyone. No open directory or DNS serving. Just AFP and SMB.
Our Linux based Smoke/Flame/Lustre system needs access to the files severed/shared by an Xserve with a big attached RAID. It has no problem connecting or seeing the files. However, it typically is denied write permissions. When the Smoke operator creates a folder on the share he can't access the folder until I grant the Others/Everyone group read and write perms. The Linux user logs in with the same user account that everyone else uses.
Some time ago, the always smashing Gerrit DeWitt gave me some terminal commands to set ACLs for users/groups of this shared RAID. They work beautifully and I have had no permissions issues since applying them. Except for this Linux system.
Would it be good practice to use this command to set the Everyone group permissions for this share?
sudo chmod -R +ai "group:everyone allow readattr,readextattr,readsecurity,\
list,search,read,execute,writeattr,writeextattr,delete,\
append,write,deletechild,add_file,addsubdirectory,\
fileinherit,directoryinherit" "/Volumes/RAIDH/Smoke_InfernoStorage"
Also, is there some configuration change I could make to the Linux system to make it a little more Mac compatible in this area?
Thanks

It's worth checking into - let us know what you find. What you describe certainly sounds like a problem with permission propagation settings for SMB / Samba since the AFP side works fine.
I've seen other posts about problems that crop up because of differences in the versions of Samba employed between systems, so that's a possibility as well. And I'd have no suggestions for you in that regard other than some searching of the web for clues as to how to work with that issue.
-Doug

SQL Server Configuration Manager

Hello,
I have a SQL 2008 SP3 install on Server 2012. It is clustered active/active. When opening SQL Server Configuration Manager > SQL Server Services, I receive the following message: The server threw an exception [0x80010105]
I have tried restarting WMI and this didn't resolve the issue as many posts and blogs have suggested.
I found this article: http://support.microsoft.com/kb/2849344 but it only applies to SQL Server 2008R2 not 2008 that we have installed.
It states to grab a msclus.dll out of %windir%\syswow64 on a Windows 2008R2 box. A 32bit msclus.dll file or a 64bit file does not exist on a 2008R2 box in this directory. There is one in %windir%\system32 directory but the article clearly states
it exists in the Syswow64 folder.
Any help would be appreciated.
Thanks,
zWindows

Hi zWindows,
According to your description, the msclus.dll does exist in %windir%\system32 directory in your Windows Server 2008R2. I check this file in my cluster environment, it does exist in %windir%\winsxs directory. Personally, it belongs to system files, and maybe
saved in different system path due to the system version and bit. The different path will not affect to copy this file to the related directory. Then, register this .dll file on each node of the cluster.
About this exception [0x80010105], we need to verify if you change service account to a new domain user by SQL Server Configuration Manager in a clustered SQL Server instance. If yes, you need to ensure that Everyone is added to "Remote Launch" and "Remote
Activation" DCOM permissions, and new domain user account have read rights in WMI.
For more information about exception 0x80010105, you can review the following article.
http://blogs.msdn.com/b/sql_server_reflections/archive/2012/08/28/unable-to-change-the-service-account-of-a-clustered-sql-server-instance-the-server-threw-exception-0x80010105.aspx
Regards,
Sofiya Li
Sofiya Li
TechNet Community Support

Split Permissions for Server Configuration

Similar Messages

Maybe you are looking for