DFS Assistance

Question

I am using powershell to create the shares:

$fspath = "SERVERNAME"
$dfspath = "SERVERNAME"

#Build user folder with permissions
if ( !(Test-Path $fspath) )
{
    #Create user folder on server.
    New-Item -Path $fspath -ItemType Directory

    #Set owner and ntfs permissions
    $acl = Get-Acl $fspath

    $DArule = new-object System.Security.AccessControl.FileSystemAccessRule "DOMAIN\Domain Admins", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow"
    $DArule1 = new-object System.Security.AccessControl.FileSystemAccessRule "DOMAIN\adaxessvcadm", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow"
    $userrule = new-object System.Security.AccessControl.FileSystemAccessRule "DOMAIN\%username%", "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow" 

    $acl.AddAccessRule($DArule)
    $acl.AddAccessRule($DArule1)
    $acl.AddAccessRule($userrule)
    $acl.SetOwner((New-Object System.Security.Principal.NTAccount("DOMAIN\%username%")))

    Set-Acl $fspath $acl
}

#Setup dfs link for homedir
if ( !(Test-Path $dfspath) )
{
    #Create the DFS link
    Invoke-Expression -Command "dfsutil.exe link add $dfspath $fspath"

    #Set the referral target time
    Invoke-Expression -command "dfsutil.exe property ttl set $dfspath 5400"
}

I have verified that all DFS shares have the adaxes service account having the correct access.
Here is the error that I am recieving. How do I fix the issue?
The security identifier is not allowed to be the owner of this object.

Thank you,

Tony

Answer 1

Hello Tony,

Could you make sure that the user whose credentials are used to run the script, has the SE_RESTORE_NAME (SeRestorePrivilege) privilege? It is required to have a possibility to set owners. For details, have a look at the following article on Microsoft forums: https://msdn.microsoft.com/en-us/librar ... s.85).aspx.

Comments

Support,

Please let me know where I should look for this permission being set. Is this on the share or the account itself?

Thanks,

Tony

---

Hello Tony,

Please let me know where I should look for this permission being set.

Have a look at the following article by Microsoft: https://docs.microsoft.com/en-us/previo ... 3(v=ws.11).

Is this on the share or the account itself?

This permission should be granted to the user whose credentials are used to run the script. In your case it is the account of the default service administrator.