Network Folders with NTFS permissions [Staging]

• If you need to use Network Folders and preserve NTFS permissions, it is strongly recommended to run FileCloud on Windows Servers instead of Linux.
• If you are running FileCloud on Linux and want to preserve NTFS Permissions, a Windows Server running the FileCloud Helper Service is required (See more information)
• Starting with FileCloud 15.0, it is recommended to install and use Memcache to improve performance when using network folders with NTFS permissions

• When user membership in a AD group is modified, that change is not propagated immediately and is cached by Windows. As a result, if you change a user group membership, it might not be picked up NTFS helper immediately. It might take some time ranging from 10 minutes to several hours before the change is picked up. If you need the changes to be picked up immediately, you can restart the helper service.
• Make sure that don't have a local machine account name as the domain user account. This will cause problems.
• If you get authzinitializecontextfromsid errors, make sure the account running the Helper service has full permissions to look up user accounts, Also make sure the user account name is not the same as the computer name, use a different name.

NTFS special permissions

When sharing a network folder with special permissions ensure that the options below are enabled. By enabling the options below the user will still be limited to have access
only to the folders or sub-folders the administrator allows however this grants the ability to FileCloud to read and display the needed information for that specific user.

NTFS permissions include both standard and special permissions. Standard permissions on a folder are Full Control, Modify, Read & Execute, List Folder Contents, Read, and Write. Standard file
permissions are the same, with the exception of List Folder Contents. Special permissions are considerably more granula.


For Microsoft Documentation ( https://technet.microsoft.com/en-us/library/2006.01.howitworksntfs.aspx )

Use Qualified names in multidomain AD networks

Most organizations that have more than one domain have a legitimate need for users to access shared resources that are located in a different domain.

• Controlling this access requires that users in one domain can also be authenticated and authorized to use resources in another domain.
• To provide authentication and authorization capabilities between clients and servers in different domains, there must be a trust between the two domains.
• Trusts are the underlying technology by which secured Active Directory communications occur and are an integral security component of the Windows Server network architecture.

For example, in an organization called MyCompany, there are two internal domains: domainA and domainB.

• Active Directory communications between domainA and domain occur through a trust

• USER1 is authenticated in domainA
• There is a shared NTFS permissions based LAN folder on domainA
• Suppose FileCloud is installed on domainB and a USER1 wants to logon and access the Shared folder on domainA, FileCloud needs to do verification of NTFS permissions using a fully qualified username which looks like USER1@domainA instead of just USER1.

A  Fully Qualified User Name is required in this case to correctly look up the User Name who is not in the current domain that FileCloud is running on.

To configure FileCloud Server to use qualified user names:

1. On the FileCloud server, navigate to the following directory:
   
   

   c:\xampp\htdocs\config

2. Open the following file for editing:
   
   

   cloudconfig.php

3. Add the following line:
   
   

   define("TONIDO_USE_QUALIFIEDNAMES_FOR_NTFS", 1);

4. Save and close the file.

NTFS permission checks reads the tokenGroupsGlobalAndUniversal attribute of the SID specified in the call to determine the current user's group memberships. To simplify granting accounts permission to query a user's group information, add accounts that need the ability to look up group information to the Windows Authorization Access Group. Please make sure to add the Windows Authorization Access Group to the FileCloud Account Group that you have created.