I recently upgraded my Samba install and happily noticed that it
automagically created groups for BUILT-IN/Administrators and
BUILT-IN/Users in my LDAP user store.
Can I use these groups like I would normally use them on other systems?
Can I use them as primary groups for my various users and whatnot? Can I
map the Administrators group to my "root" Posix group? etc?
Thanks!

Tue, 2006-09-19 at 12:44 -0400, Eric A. Hall wrote:
I recently upgraded my Samba install and happily noticed that it
automagically created groups for BUILT-IN/Administrators and
BUILT-IN/Users in my LDAP user store.

Can I use these groups like I would normally use them on other systems?
Can I use them as primary groups for my various users and whatnot? Can I
map the Administrators group to my "root" Posix group? etc?

No, you cannot use them as primary groups, Windows requires that the
primary groups is a domain group, builtin groups are not domain groups.
The Administrators group can be used if you want to give administrative
privileges locally (builtin groups do not have any effect on other
machines) without giving admin privs on other machines as it would
happen by adding a user to the Domain Admins.

Simo.

9/20/2006 10:35 AM, Simo Sorce wrote:
Tue, 2006-09-19 at 12:44 -0400, Eric A. Hall wrote:
>I recently upgraded my Samba install and happily noticed that it
>automagically created groups for BUILT-IN/Administrators and
>BUILT-IN/Users in my LDAP user store.
>>
>Can I use these groups like I would normally use them on other systems?
>Can I use them as primary groups for my various users and whatnot? Can I
>map the Administrators group to my "root" Posix group? etc?

No, you cannot use them as primary groups, Windows requires that the
primary groups is a domain group, builtin groups are not domain groups.

Yeah okay, they are local groups not network groups.

I can add (eg) the Domain Users group to the local Users group, and assign
my ACLs and whatnot to the latter, correct?

I just want to make sure that these aren't handled special by Samba. They
used to be reserved group names and I want to make sure they are
real/normal groups now (apart from the scope issue above).