Q. I am using winbind to get ADz user on samba. The problem i facing is related with group.
To clear the problem i am taking an example There is a AD user that belong to "Domain users" and "Marketting" Group, the new file/folder created by that user has group ownership "Domain users" but i want that "Marketting" should be group owner. Is it possible without setting SGID bit? Is there any short of primary group feature in AD?.
Ans.
There is, and only (fortunately) for POSIX compatibility. AD makes no
real use of it, it's just normally set to what Domain Users equates to.
I have modified it for accounts used on UNIX OSs that want a different
group FROM AD as primary group (note: I have found that attempting to
point it to an (effective) GID that's not derived from AD, I always
found failed, and AD would either deny the update or reset it to Domain
Users).
If you use something like adsiedit, the user attribute you want is
primaryGroupID. And (being as I used winbind with RID mapping for UID
and GID currently, I make sure I find what id (from the UNIX command
line) perceives as the GID for the AD group I'm interested in, then set
that value using adsiedit, as the primaryGroupID in AD for the user
account.