Rights to Samba and Win AD?

Question

Debian

There is a server. Samba is spinning on it. Everything seems to be fine. But I cannot distribute the rights to folders from Windows through checkboxes. Those. I have a folder \\server\share\folder, I want the folder to be readable by Everyone, and the user User can also be changed. The trouble is that when I start to change the rights, the rights "Domain Users" and "Everyone" are automatically attached to me. And full rights. Can't figure out what I did wrong.

[global]
workgroup = KP
realm = KP.RND
security = ADS
encrypt passwords = true
server string = FS at Uni
dns proxy = no
socket options = TCP_NODELAY
domain master = no
local master = no
preferred master = no
os level = 0
domain logons = no
load printers = no
show add printer wizard = no
printcap name = /dev/null
disable spoolss = yes
idmap config * : range = 10000-20000
idmap config * : backend = tdb
winbind enum groups = yes
winbind enum users = yes
winbind use default domain = yes
# template shell = /bin/bash
# template homedir = /share
winbind refresh tickets = yes
hide files = /$RECYCLE.BIN/desktop.ini/lost+found/Thumbs.db /
# acl compatibility = auto
map acl inherit = yes
vfs object = full_audit
log level = 0 vfs:0
max log size = 0
syslog = 0
[users]
comment = User Folders
path = /share/users
admin users = "@KP\ Domain Administrators"
read list = "@KP\Domain Users"
write list = "@KP\Domain Users"
locking = no
read only = no

If there's anything else you need to post, let me know. Thanks

Answer 1

I think I have found the solution I need. What does it have to do with the 3-year-old post here on the toaster
Combining Samba and Active Directory (with setting rights from Windows)
in the directory description itself, you need to add
after that, the rights began to be distributed normally from Windows Explorer. And the plus was also that when a folder is created, it is immediately given the rights of the creator's user, i.e. another user cannot delete it (well, except for the admin)
more specifically, now the ball looks like this
[public]
comment = Public resource
path = /share/public
admin users = "@KP\Domain Admins"
locking = no
read only = no
vfs objects = acl_xattr
but I think it can be moved to [global]

Answer 2

You still need ACL support by the file system, if you please, study the samba documentation =)
https://wiki.samba.org/index.php/Operating_system_...