Nutanix文件SMB共享默认许可

Standard share
BUILTIN\\Administrators: Allow FullControl
BUILTIN\\Users: Allow FullControl

Distributed share
BUILTIN\\Administrators: Allow FullControl
BUILTIN\\Users: Allow ReadAndExecute, Synchronize
<\/pre><\/div>
\n
\n
\nYou can modify or remove these default permissions as needed for your environment. You can use  Microsoft Management Console<\/b><\/a> (MMC), and so onto manage the file shares and their permissions. 
\n
\nLet\u2019s try to understand this by an example <\/b>
\nThere are 2 shares GENERAL (Non-distributed) and HOME (distributed)
\n
\n
code:<\/b>
 share.list
Share name: smb_gp
File server name: demofs
Share type: GENERAL

Share name: smb_demo
File server name: demofs
Share type: HOME
<\/pre><\/div>
\n
\nShare Path :- \\\\demofs\\smb_demo\\tld<\/b>
\n
\n
code:<\/b>
File Server = demofs 
smb_demo= Home Share
tld = first root level directory 
filesuser1=user directory 
smb_gp= GENERAL Share
Users : afsadmin ( admin privileges) filesuser1 (domain user) 
<\/pre><\/div>
\n
\nThere are two user accounts, let\u2019s look at their group membership
\n
\n
code:<\/b>
> Get-ADPrincipalGroupMembership afsadmin | select Name

Name
----
Domain Users
Administrators
Schema Admins
Enterprise Admins
Domain Admins


> Get-ADPrincipalGroupMembership filesuser1 | select Name

Name
----
Domain Users
Minerva_User
<\/pre><\/div>
\n
\n
\nLet\u2019s validate Home Share first. <\/b>
\n
\n
code:<\/b>
> get-acl \\\\demofs\\smb_demo | select owner, group, accesstostring | fl


Owner          : BUILTIN\\Administrators
Group          : BUILTIN\\Users
AccessToString : CREATOR OWNER Allow  FullControl
                 BUILTIN\\Administrators Allow  FullControl
                 BUILTIN\\Users Allow  ReadAndExecute, Synchronize


> get-acl \\\\demofs\\smb_demo\\tld | select owner, group, accesstostring | fl


Owner          : AFSLAB\\afsadmin
Group          : AFSLAB\\Domain Users
AccessToString : AFSLAB\\afsadmin Allow  FullControl
                 CREATOR OWNER Allow  FullControl
                 BUILTIN\\Administrators Allow  FullControl
                 BUILTIN\\Users Allow  ReadAndExecute, Synchronize



> get-acl \\\\demofs\\smb_demo\\tld\\filesuser1 | select owner, group, accesstostring | fl


Owner          : AFSLAB\\afsadmin
Group          : AFSLAB\\Domain Users
AccessToString : AFSLAB\\afsadmin Allow  FullControl
                 CREATOR OWNER Allow  FullControl
                 BUILTIN\\Administrators Allow  FullControl
                 BUILTIN\\Users Allow  ReadAndExecute, Synchronize

<\/pre><\/div>
\n
\nSo \"filesuser1\" is a domain user who has ReadAndExecute, Synchronize permission by default on user directory names \"filesuser1\". However, this user can't create a file in user folder name tld. 
\n
\nEasiest way to manage all this is MMC from where you can change the permissions. 
\n
\n
<\/a><\/p>
\n
\nLet's take a look at a general share named smb_gp and for same users. You can notice that BUILTIN\\Users have full control. 
\n
\n
code:<\/b>
> get-acl \\\\demofs\\smb_gp | select owner, group, accesstostring | fl


Owner          : BUILTIN\\Administrators
Group          : BUILTIN\\Users
AccessToString : CREATOR OWNER Allow  FullControl
                 BUILTIN\\Administrators Allow  FullControl
                 BUILTIN\\Users Allow  FullControl
<\/pre><\/div>","quoteUsername":"proyoung","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
            

             
喜欢
             
引用
             

             

              

               

                分享
               
              
            
           

          

         

         

          

         
        

        

         

          该主题已关闭以供评论
        
        

         

          
2个答复
          
         
         

          

           

            
             

              
             
             

           
           

            

             UserLevel 2
           
           

            
            +5
           
          
          

           

            

             

              戴维
             
            
引导者
            
42个答复
            

              

               2年前
               

                2019年10月10日
              
           
          
          

           是否有任何PowerShell/ACLI/NCLI命令可以设置共享权限（最好是远程？）

           
SET-ACL/GET-ACL仅操纵NTFS ACE/ACL在我的测试中不共享权限...
          

           

           
\n
\nSet-ACL\/Get-ACL only manipulate NTFS ACE\/ACLs not Share Permissions in my testing...","quoteUsername":"DavidN","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
            

             
喜欢
             
引用
            
           
           

          
         
         

          

           

            
             

              

               j
             
             

           
           

            

             UserLevel 4
           
           

            
            +12
           
          
          

           

            

             

              J_SEET
             
            
开拓者
            
35个答复
            

              

               1年前
               

                2020年10月23日
              
           
          
          

           
谢谢你
             @proyoung。这篇文章帮助我弄清楚如何每股更改每个用户的权限。我发现的其他信息在这里：https://portal.nutanix.com/page/documents/details?targetid = acropolis-file-services-guide-v20:acr-file-file-file-share-assign-permisign-permission-permission-t.html不如您的帖子那么详细。
           

           
有人知道分配许可的步骤是否有所改善？在Nutanix中创建共享似乎是不寻常的和断开的，然后必须打开Windows MMC控制台才能配置用户级别的权限，甚至需要通过CMDLine进行操作。
           
本来可以期望能够从棱镜/棱镜中央控制台内完成所有这些。
           

           

           

          
          

           

           
Thank You @proyoung<\/user-mention>\u00a0.\u00a0 This post is what helped me figure out how to change permissions per user per share.\u00a0 Only other info I found was here:\u00a0https:\/\/portal.nutanix.com\/page\/documents\/details?targetId=Acropolis-File-Services-Guide-v20:acr-file-share-assign-permission-t.html<\/a>\u00a0which isn\u2019t as detailed as your post.<\/p>
\u00a0<\/p>
Does anyone know whether the steps for assigning permissions has improved?\u00a0 Seems unusual and disconnected to create the share in Nutanix then have to open a Windows MMC console to configure the user level permissions or even need to do it via a cmdline.<\/p>
Would have expected to be able to do all this from within Prism\/Prism Central console.<\/p>
\u00a0<\/p>
\u00a0<\/p>
\u00a0<\/p>","quoteUsername":"j_seet","translations":{"Common":{"like":"Like","unlike":"Unlike"},"Forum":{"Quote":"Quote","Share":"Share"}}}">
            

             
喜欢
             
引用