Nutanix Files SMB Share默认权限

Standard share
BUILTIN\\Administrators: Allow FullControl
BUILTIN\\Users: Allow FullControl

Distributed share
BUILTIN\\Administrators: Allow FullControl
BUILTIN\\Users: Allow ReadAndExecute, Synchronize
<\/pre><\/div>
\n
\n
\nYou can modify or remove these default permissions as needed for your environment. You can use  Microsoft Management Console<\/b><\/a> (MMC), and so onto manage the file shares and their permissions. 
\n
\nLet\u2019s try to understand this by an example <\/b>
\nThere are 2 shares GENERAL (Non-distributed) and HOME (distributed)
\n
\n
code:<\/b>
 share.list
Share name: smb_gp
File server name: demofs
Share type: GENERAL

Share name: smb_demo
File server name: demofs
Share type: HOME
<\/pre><\/div>
\n
\nShare Path :- \\\\demofs\\smb_demo\\tld<\/b>
\n
\n
code:<\/b>
File Server = demofs 
smb_demo= Home Share
tld = first root level directory 
filesuser1=user directory 
smb_gp= GENERAL Share
Users : afsadmin ( admin privileges) filesuser1 (domain user) 
<\/pre><\/div>
\n
\nThere are two user accounts, let\u2019s look at their group membership
\n
\n
code:<\/b>
> Get-ADPrincipalGroupMembership afsadmin | select Name

Name
----
Domain Users
Administrators
Schema Admins
Enterprise Admins
Domain Admins


> Get-ADPrincipalGroupMembership filesuser1 | select Name

Name
----
Domain Users
Minerva_User
<\/pre><\/div>
\n
\n
\nLet\u2019s validate Home Share first. <\/b>
\n
\n
code:<\/b>
> get-acl \\\\demofs\\smb_demo | select owner, group, accesstostring | fl


Owner          : BUILTIN\\Administrators
Group          : BUILTIN\\Users
AccessToString : CREATOR OWNER Allow  FullControl
                 BUILTIN\\Administrators Allow  FullControl
                 BUILTIN\\Users Allow  ReadAndExecute, Synchronize


> get-acl \\\\demofs\\smb_demo\\tld | select owner, group, accesstostring | fl


Owner          : AFSLAB\\afsadmin
Group          : AFSLAB\\Domain Users
AccessToString : AFSLAB\\afsadmin Allow  FullControl
                 CREATOR OWNER Allow  FullControl
                 BUILTIN\\Administrators Allow  FullControl
                 BUILTIN\\Users Allow  ReadAndExecute, Synchronize



> get-acl \\\\demofs\\smb_demo\\tld\\filesuser1 | select owner, group, accesstostring | fl


Owner          : AFSLAB\\afsadmin
Group          : AFSLAB\\Domain Users
AccessToString : AFSLAB\\afsadmin Allow  FullControl
                 CREATOR OWNER Allow  FullControl
                 BUILTIN\\Administrators Allow  FullControl
                 BUILTIN\\Users Allow  ReadAndExecute, Synchronize

<\/pre><\/div>
\n
\nSo \"filesuser1\" is a domain user who has ReadAndExecute, Synchronize permission by default on user directory names \"filesuser1\". However, this user can't create a file in user folder name tld. 
\n
\nEasiest way to manage all this is MMC from where you can change the permissions. 
\n
\n
<\/a><\/p>
\n
\nLet's take a look at a general share named smb_gp and for same users. You can notice that BUILTIN\\Users have full control. 
\n
\n
code:<\/b>
> get-acl \\\\demofs\\smb_gp | select owner, group, accesstostring | fl


Owner          : BUILTIN\\Administrators
Group          : BUILTIN\\Users
AccessToString : CREATOR OWNER Allow  FullControl
                 BUILTIN\\Administrators Allow  FullControl
                 BUILTIN\\Users Allow  FullControl
<\/pre><\/div>","quoteUsername":"proyoung","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
            

             
就像
             
报价
             

             

              

               

                分享
               
              
            
           

          

         

         

          

         
        

        

         

          
2回答
          
         
         

          

           

            
             

              
             
             

           
           

            

             Userlevel 2
           
           

            
            + 4
           
          
          

           

            

             

              DavidN
             
            
开拓者
            
37回复
            

              

               2年前
               

                2019年10月10日
              
           
          
          

           是否有任何Powershell/ACLI/NCLI命令来设置共享权限(最好是远程?)

           
Set-ACL/Get-ACL只操作NTFS ACE/ acl不共享权限在我的测试…
          

           

           
\n
\nSet-ACL\/Get-ACL only manipulate NTFS ACE\/ACLs not Share Permissions in my testing...","quoteUsername":"DavidN","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
            

             
就像
             
报价
            
           
           

          
         
         

          

           

            
             

              

               J
             
             

           
           

            

             Userlevel 4
           
           

            
            + 12
           
          
          

           

            

             

              j_seet
             
            
开拓者
            
35个回复
            

              

               1年前
               

                2020年10月23日
              
           
          
          

           
谢谢你！
             @proyoung．这篇文章帮助我弄清楚了如何改变每个用户的共享权限。我在这里找到的其他信息https://portal.nutanix.com/page/documents/details?targetId=Acropolis-File-Services-Guide-v20:acr-file-share-assign-permission-t.html没有你的帖子那么详细。
           

           
是否有人知道分配权限的步骤是否有所改进?在Nutanix中创建共享似乎不寻常和断开连接，然后必须打开Windows MMC控制台来配置用户级别的权限，甚至需要通过cmdline来完成。
           
希望能在Prism/Prism中央控制台中实现所有这些功能。
           

           

           

          
          

           

           
Thank You @proyoung<\/user-mention>\u00a0.\u00a0 This post is what helped me figure out how to change permissions per user per share.\u00a0 Only other info I found was here:\u00a0https:\/\/portal.nutanix.com\/page\/documents\/details?targetId=Acropolis-File-Services-Guide-v20:acr-file-share-assign-permission-t.html<\/a>\u00a0which isn\u2019t as detailed as your post.<\/p>
\u00a0<\/p>
Does anyone know whether the steps for assigning permissions has improved?\u00a0 Seems unusual and disconnected to create the share in Nutanix then have to open a Windows MMC console to configure the user level permissions or even need to do it via a cmdline.<\/p>
Would have expected to be able to do all this from within Prism\/Prism Central console.<\/p>
\u00a0<\/p>
\u00a0<\/p>
\u00a0<\/p>","quoteUsername":"j_seet","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
            

             
就像
             
报价
            
           
           

          
         
        
        

         

          
回复