MAC permissions to Windows File Server -

[Koldov]

I'm pretty sure I've asked this a few times before, but don't think I've ever really got to the solution!

 

My Headteacher demanded a Mac (to use SIMS, Microsoft Office/Outlook, and Chrome browser)... and I thought I had smoothed out most of the issues, but recently they are complaining that the Windows server shares are not appearing.

 

Added to this we are coming up to our performance management reviews and they are moderated by the Headteacher.

 

This means (as we store the documents on the server), that they are going into lots of folders/files and amending/editing them.

 

Unfortunately we are still plagued by the fact that when they do this it renders the file unusable by anyone else.

 

In the past I worked out that it seems to be a combination of things depending on what they are doing with the file, but the only resolution I could find doesn't seem to work for all scenarios.

 

Basically there are two things that happen:

 

1. When working on the document (Example_Word.docx) every edit that is save produces a folder with a random file in. It's a temporary file Office opens whilst working on a document, which it then deletes and writes the edits to the original file. The only issue is that the Mac/User doesn't seem to be able to delete these 'temp' files once they are finished editing and saves the document, leaving hundreds of random folders/files.

 

 

One fix for this has something to do with adding explicit permissions for the user (adding the user account to the R/W ACL on the parent folder), which this folder does have, but I can't go into every folder they might use and do this.

 

2. The other issue we are seeing, is that (and I'm not exactly sure how this happens) if they save or move the file some other way, the file gains some sort of permissions from a user (or machine) account which the Windows Server cannot resolve or identify (S-1-5-88-3-33216)... Once it gets to that point the file seems to stop inheriting any other permissions from its folder and therefore nobody else can see this file. If I delete the rogue permission, it immediately populates with the correct permissions...

 

 

 

I have seen a couple of apparent fixes and one of those is to remove the 'everyone' share permission from the share permissions.

 

Unfortunately this is just a folder in a huge shared drive and the folder itself isn't shared, so I would need to remove it from the root (which has folder with over 300GB worth of files) and I'm very wary of messing with permissions on such a large amount of data.

 

Does anyone know what the actual cause of these issues is and the 'correct' way to resolve them?

Edited October 31, 2023 by Koldov

[bezzoh]

Shares may not appear for a couple reasons. 1) I think there's a policy about them appearing on the desktop... check out /Volumes to see if they're actually mapped. If its permissions its because all users need read on the 'parent' folder thats being shared so on \\servername\share not just the permissions on \\servername\share\myfolder

 

As for the Mac behaviour adding/changing permissions, you want to make sure they don't have 'full access' just give users 'change'. You don't want user action being able to change NTFS permissions on network file shares.

[Koldov]

Sorry I should have mentioned that my Mac knowledge is practically zero, so it would be helpful if any answers could be worded ELI5 style...

 

Thanks, it isn't so much about the shares appearing (sometimes they do and sometimes they don't) but recently they are saying that when they click on them nothing appears (I think spinning wheel of death) and it just won't connect. The only thing I can think of that I've changed was an in-place from 2012R2 to 2019... I don't think it coincides directly, but sometimes the users just struggle on for ages without telling you and then decide it gets so bad they tell you and expect a 5 minute fix because they've been dealing with it for so long that they've had enough. Or 'think' they've told you, or just mention it and never give you the thing to fix it.... The Headteacher has complained about it and then when I ask for his Macbook, he's too busy, then I don't see them for a few weeks until they come to complain about it again... I've said it's like asking a mechanic to fix your car and then driving off... then coming back a week later to complain it isn't fixed!

 

Interesting point regarding the share permissions/NTFS permissions. I think when I started (many years ago) I was shown the way to create shares was 'share permission' = 'everyone' and then NTFS permissions give the user 'full control'... I didn't really understand back then and I can see that's an issue but I inherited a full to bursting physical server and a staff share with many weird and wonderful permissions (and a lot of 'legacy') and haven't ever had the guts to change it.

 

Not that I want to off-topic, but do you all set NTFS permissions for users at 'modify' then?

Edited October 31, 2023 by Koldov

[3s-gtech]

My first thought would be to nuke the Full Control permission, which it looks like you have throughout those shares for those users.

 

Unless you have very specific requirements, this should not be granted to your users, as it allows them to alter the ACLs. See where I'm going with this...?

[Koldov]

If its permissions its because all users need read on the 'parent' folder thats being shared so on \\servername\share not just the permissions on \\servername\share\myfolder

 

It might be permissions for these particular folders, but it's a bit more complicated... the '\\servername\share' has full permissions for a security group (Staff) which they are explicitly part of and so does the folder '\\servername\share\myfolder' (inherited), but the subfolders in that '\\servername\share\myfolder\folder1' have inheritance disabled (sensitive data) and are not 'shared' specifically (purely because it is a sub-sub-folder of a shared folder), only certain users (of which they are one) are given access with 'Full Control' NTFS permissions granted and 'Authenticated Users' (again they should be in this group) have read.

 

As for the Mac behaviour adding/changing permissions, you want to make sure they don't have 'full access' just give users 'change'. You don't want user action being able to change NTFS permissions on network file shares.

 

'Change' is a share permission, do you mean 'Modify' in the NTFS security permissions?

 

My first thought would be to nuke the Full Control permission, which it looks like you have throughout those shares for those users.

 

Unless you have very specific requirements, this should not be granted to your users, as it allows them to alter the ACLs. See where I'm going with this...?

 

Yes, thanks. So I've got another chance to look at this again for a few minutes... I tried a test folder and it hit a security permission it couldn't change (file in a non-inherited sub-folder I think) and when I quit it left the permissions in an inconsistent state, does it just ignore it if you continue instead of quit...?

 

I would just remove it from the root folder, but the trouble has traditionally been that all folders inherit from the 'root' and this folder has the NTFS Security permission of 'Staff' (security group) having full control, so unfortunately it has always propagated to every sub folder ('Share permission is Everyone = Full Control) so it means a change to the NTFS security permissions on the root and then propagate through 100s of GB and thousands of files:

 

This PC > Data Drive (F:\) > Staff Folder (shared as Q:\)> 70+ subfolders > 300+ GB of data = 'Staff' (security group) NTFS permission = Full control

 

There is another similar folder I'd like to tackle, but for some reason the Headteacher has never complained about files creating the issues in my OP...

 

This PC > Data Drive (F:\) > Admin Folder (shared as M:\) > 100+ subfolders > 100+ GB of data = 'Admin' (security group) NTFS permission = Full Control

 

They are a member of both security groups...

 

Is there anything special permission that I need to give a Mac, application on a Mac (or Mac user) to be able to work with Windows shares?

 

I've seen a couple of things on the server:

 

One being an 'Apple Mac SMB Share Access' security group.

 

The other being on the DC - Primary Group - There is no need to change Primary Group unless you have Macintosh or POSIX-compliant applications...

 

It's so annoying... I just can't get them onto a Window laptop... Even though every application he uses is Microsoft (Office etc.) or OS agnostic like the Chrome browser.... and now Windows 11 looks more like MacOS than ever... it can't just be the position of the @ symbol on the keyboard can it?

 

EDIT: Added to that, I don't have a Mac (obviously) that I can test and I can never get theirs as it's pretty much 'in use' all day... everyday!

Edited November 6, 2023 by Koldov

[Face-Man]

Mac's in a PC environment are a nightmare so you have my sympathy...

 

Mac's don't see NTFS permissions so your head can with their mac can easily browse and of your network shares that are open to "everyone" . (try going to c$ on your server). The only way to mange what they can see is via the share permission

 

https://learn.microsoft.com/en-us/answers/questions/72076/assign-access-permission-on-a-shared-folder

 

personally in your review I would ask the school to either send you on training or pay for a mac expert to come in or support you to resolve the issue.

You can't be expected to know everything about every operating system without extra support.

[3s-gtech]

Yes, thanks. So I've got another chance to look at this again for a few minutes... I tried a test folder and it hit a security permission it couldn't change (file in a non-inherited sub-folder I think) and when I quit it left the permissions in an inconsistent state, does it just ignore it if you continue instead of quit...?

It just ignores and carries on.

[NeoNebula]

Hi! Just saw your post. Well, when editing documents, Office for Mac creates temporary files for its operations. These files should be deleted after the work is done, but due to permission issues, they remain, leaving clutter.This can often be resolved by adjusting the permissions on the server. You've mentioned adding the user to the R/W ACL on the parent folder. While it's impractical to do this for every folder, you might consider setting a more general permission rule at a higher directory level that propagates down. However, be cautious with this approach as it might inadvertently grant broader access than intended.Another approach is to use a script that periodically cleans up these temporary files.Well, if you need visual content or more info, here's one tutorial, which I personally found helpful: