sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-08-03 04:22:09 +03:00
Code Activity

provision: No longer use the wheel group in new AD Domains

Browse Source 
The issue here is that if we set S-1-5-32-544 (administrators) to a
GID only, then users cannot force a mandetory profile to be owned by
administrators (which is a requirement).

There is no particularly useful reason for us to enforce this matching
a system group.

Andrew Bartlett
This commit is contained in:
Andrew Bartlett
2012-10-16 13:08:22 +11:00
parent b557f34c80
commit 9eb022c8c6
6 changed files with 29 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
source4/scripting/python/samba/upgradehelpers.py
View File

@ -251,7 +251,7 @@ def newprovision(names, creds, session, smbconf, provdir, logger):
hostname=names.netbiosname.lower(), hostip=None, hostip6=None,
invocationid=names.invocation, adminpass=names.adminpass,
krbtgtpass=None, machinepass=None, dnspass=None, root=None,
nobody=None, wheel=None, users=None,
nobody=None, users=None,
serverrole="domain controller",
backend_type=None, ldapadminpass=None, ol_mmr_urls=None,
slapd_path=None,
@ -615,7 +615,7 @@ def update_gpo(paths, samdb, names, lp, message, force=0):
if resetacls:
try:
setsysvolacl(samdb, paths.netlogon, paths.sysvol, names.wheel_gid,
setsysvolacl(samdb, paths.netlogon, paths.sysvol, names.root_gid,
names.domainsid, names.dnsdomain, names.domaindn, lp)
except TypeError, e:
acl_error(e)