Global task: there are domain groups, using one global share for all users. These groups have to see file objects which have access set only to their groups. For example, user1 in group1 and group2 have to see folders and files with ACLs set to group1 or group2 , but no others. This is solved by ACL ofc.Software: Samba-4.3.5 as AD member (fileshare) running in OpenVZ container on ProxMox VE (pve-manager/3.4-6/102d4547 kernel: 2.6.32-39-pve). Hardware node has enabled acl support for /var/lib/vz. /etc/pve/nodes/VMID.conf has Domain controllers are also Samba. MOUNT_OPTS=rw,acl,user_xattr,realtimesmb.conf: [global] workgroup = MDS security = ADS realm = MDS.LOCAL netbios name = MSRV server role = auto encrypt passwords = yes auth methods = winbind log level = 0 vfs:1 idmap config * : backend = rid idmap config * : range = 300000-400000 idmap config * : base_rid = 0 idmap config * :schema_mode = rfc2307 idmap_ldb:use rfc2307 = yes winbind nss info = rfc2307 winbind trusted domains only = no winbind use default domain = yes winbind enum users = yes winbind enum groups = yes winbind refresh tickets = yes max log size = 1000 syslog = 1 passdb backend = tdbsam obey pam restrictions = yes vfs objects = acl_xattr #acl_xattr:ignore system acls = yes map acl inherit = yes store dos attributes = yes unix password sync = yes load printers = no show add printer wizard = no disable spoolss = yes printcap name = /dev/null os level = 1 case sensitive = no hide unreadable = yes log writeable files on exit = yes deadtime = 600 ea support = yes#======================= Share Definitions =======================[m]comment = Mailbrowseable = yespath = /opt/mguest ok = noread only = nocreate mask = 0777directory mask = 0777strict sync = yessync always = yesinherit permissions = Yesinherit acls = Yesinherit owner = Yesinherit permissions = yesacl group control = Yesacl map full control = Yesveto files = /.snap/quota*/RECYCLER/*.vmx/autorun.inf/hide files = .recyclevalid users = +MDS\all MDS\adminadmin users = +MDS\it MDS\administrator MDS\adminhide unreadable = yesvfs objects= full_audit, recyclefull_audit:facility=LOCAL5full_audit:priority=NOTICEfull_audit:prefix = %M(%I)|%ufull_audit:success = write rename unlink mkdir rmdirfull_audit:failure = write rename unlink mkdir rmdirrecycle:repository = .recyclerecycle:keeptree = yesrecycle:maxsize = 104857600recycle:exclude = ~$*,*.tmp,*.bakaccess based share enum = yesmap acl inherit = yesEverything seems ok: ACLs are present, I can modify them. User1 from group1 sees his folder and no others. But the problem is next: when I adding group2 to user1 groups he can see appropriate files or folders (that belongs to group2) only when he logouts and logins back on his PC. Not on the fly. Tested on Windows 7 PCs.Disconnecting share and mapping it back, restarting samba fileserver doesn't help. Only logout-login.What's wrong?
samba 4 NT ACL on Win7
acl;openvz;samba4