SMBCACLS(1) User Commands SMBCACLS(1) (NAME) smbcacls - ACL NT (SYNOPSIS) smbcacls {//server/share} {/filename} [-D|--delete=ACL] [-M|--modify=ACL] [-a|--add=ACL] [-S|--set=ACLS] [-C|--chown=USERNAME] [-G|--chgrp=GROUPNAME] [-I|--inherit=STRING] [--recurse] [--propagate-inheritance] [--save=savefile] [--restore=restorefile] [--numeric] [--sddl] [--query-security-info=INT] [--set-security-info=INT] [-t|--test-args] [--domain-sid=SID] [-x|--maximum-access] [-?|--help] [--usage] [-d|--debuglevel=DEBUGLEVEL] [--debug-stdout] [--configfile=CONFIGFILE] [--option=name=value] [-l|--log-basename=LOGFILEBASE] [--leak-report] [--leak-report-full] [-R|--name-resolve=NAME-RESOLVE-ORDER] [-O|--socket-options=SOCKETOPTIONS] [-m|--max-protocol=MAXPROTOCOL] [-n|--netbiosname=NETBIOSNAME] [--netbios-scope=SCOPE] [-W|--workgroup=WORKGROUP] [--realm=REALM] [-U|--user=[DOMAIN/]USERNAME[%PASSWORD]] [-N|--no-pass] [--password=STRING] [--pw-nt-hash] [-A|--authentication-file=FILE] [-P|--machine-pass] [--simple-bind-dn=DN] [--use-kerberos=desired|required|off] [--use-krb5-ccache=CCACHE] [--use-winbind-ccache] [--client-protection=sign|encrypt|off] [-V|--version] (DESCRIPTION) samba(7) . smbcacls (ACL) NT SMB . ACL (ACE) . (OPTIONS) smbcacls . ACL ACL FORMAT . -a|--add acl ACL . . -M|--modify acl () ACE . ACE ACL . -D|--delete acl ACE . ACE ACL . -S|--set acl ACL . ACL . ACL revision type owner group . -C|--chown name -C . SID S-1-x-y-z . -M OWNER:name . -G|--chgrp name -G . SID S-1-x-y-z . -M GROUP:name . -I|--inherit allow|remove|copy <> -I . allow . remove copy . remove ACE . copy ACE . --propagate-inheritance ACE . INHERITANCE . --save savefile DACL sddl restore . SACL . --restore savefile DACL . --recurse / . ( save ) --numeric ACL . SID ACE . -m|--max-protocol PROTOCOL_NAME SMB smbcacls . NT1 SMB1 . SMB2 SMB3 SMB2 SMB3 . Windows 2012 max-protocol SMB3 . -t|--test-args . --query-security-info FLAGS security-info . --set-security-info FLAGS security-info . --sddl ACL sddl. --domain-sid SID SID sddl. -x|--maximum-access ACL . SMB . -?|--help . --usage . -d|--debuglevel=level level 0 10 . 1 . . 0 . 1 - . 1 . 3 . log level /etc/samba/smb.conf . --debug-stdout (debug) STDOUT . STDERR . --configfile= . client smb encrypt . /etc/samba/smb.conf . . --option== smb.conf(5) "" "" . . --option=name=value . -l|--log-basename=logdirectory / (log/debug). ".progname" ( log.smbclient log.smbd ). . --leak-report talloc . --leak-report-full talloc . -V|--version . -R|--name-resolve=NAME-RESOLVE-ORDER IP . . --name-resolve=NAME-RESOLVE-ORDER . : "lmhosts" "host" "wins" "bcast". : o lmhosts: IP lmhosts . lmhosts NetBIOS ( lmhosts(5) ) . o host: IP /etc/hosts NIS DNS. IRIX Solaris /etc/nsswitch.conf . NetBIOS 0x20 () . o wins: IP wins server. WINS . o bcast: (broadcast) interfaces . . /etc/samba/smb.conf (name resolve order) . lmhosts, host, wins, bcast. name resolve order /etc/samba/smb.conf . -O|--socket-options=SOCKETOPTIONS TCP . socket options /etc/samba/smb.conf . -m|--max-protocol=MAXPROTOCOL ( ) . client max protocol /etc/samba/smb.conf . -n|--netbiosname=NETBIOSNAME NetBIOS Samba . netbios name /etc/samba/smb.conf . /etc/samba/smb.conf . --netbios-scope=SCOPE NetBIOS ( NetBIOS scope) nmblookup NetBIOS . NetBIOS rfc1001.txt rfc1002.txt . NetBIOS NetBIOS . -W|--workgroup=WORKGROUP SMB . smb.conf . NetBIOS SAM ( SAM ) . workgroup /etc/samba/smb.conf . -r|--realm=REALM (realm) . realm /etc/samba/smb.conf . -U|--user=[DOMAIN\]USERNAME[%PASSWORD] SMB . %PASSWORD . USER ( % ) LOGNAME ( ) . Kerberos . (plaintext) . . . -A . . Samba kinit . Samba ( ps ) (race condition) . -N|--no-pass . . . . --password . . Samba kinit . --password PASSWD PASSWD_FD (FD) . PASSWD_FILE ( ) . . ! Samba ( ps ) (race condition) . --pw-nt-hash NT (NT hash) . -A|--authentication-file=filename . : username = password = domain = ! -P|--machine-pass (machine account) . --simple-bind-dn=DN (DN) (simple bind). --use-kerberos=desired|required|off Samba Kerberos . Kerberos IP DNS . Samba (ccache) Kerberos . ccache -U|--user Kerberos ( kinit) . Kerberos --use-krb5-ccache . client use kerberos /etc/samba/smb.conf . --use-krb5-ccache=CCACHE (credential cache) Kerberos . --use-kerberos=required . --use-winbind-ccache winbind. --client-protection=sign|encrypt|off . client protection /etc/samba/smb.conf . : --option=clientsmbencrypt=OPTION --option=clientipcsigning=OPTION --option=clientsigning=OPTION. ACL . ACL : REVISION: OWNER: GROUP: ACL::// o OD - "Owner Defaulted" - SID . o GD - "Group Defaulted" - SID . o DP - "DACL Present" - (DACL) . o DD - "DACL Defaulted" - DACL . o SP - "SACL Present" - (SACL) . o SD - "SACL Defaulted" - SACL . o DT - "DACL Trusted" o SS - "Server Security" o DR - "DACL Inheritance Required" - DACL (ACE) . o SR - "SACL Inheritance Required" - SACL ACE . o DI - "DACL Auto Inherited" - DACL (ACE) . o SI - "SACL Auto Inherited" - SACL ACE . o PD - "DACL Protected" - DACL ACE . o PS - <> - SACL ACE . o RM - <> - (resource manager) . o SR - <> - (self-relative) . (revision) ACL ACL Windows NT . . . (owner) (group) SID . SID S-1-x-y-z . ACE <> SID . SID S-1-x-y-z . type flags mask SID . type ALLOWED DENIED SID . flags ACE . smbcacls --propagate-inheritance . (XX) <<|>> . o (OI) (Object Inherit) 0x1 o (CI) (Container Inherit) 0x2 o (NP) (No Propagate Inherit) 0x4 o (IO) (Inherit Only) 0x8 o (I) ACE (ACE was inherited) 0x10 SID . NT . o R - o W - o X - o D - o P - o O - : o READ - 'RX' o CHANGE - 'RXWD' o FULL - 'RWXDPO' (INHERITANCE) ACE ACE . ACE (OI) (CI) . --propagate-inheritance ACE . o ACE (OI)(OI) . o ACE (I) . ACE() (NP) . o ACE (OI) - (IO) . ACE ( ). ACE ACE . o ACE (CI) . o ACE (OI) (CI) ACE . (OI)(READ) +-parent/ (OI)(READ) | +-file.1 (I)(READ) | +-nested/ (OI)(IO)(I)(READ) | +-file.2 (I)(READ) (CI)(READ) +-parent/ (CI)(READ) | +-file.1 | +-nested/ (CI)(I)(READ) | +-file.2 (OI)(CI)(READ) +-parent/ (OI)(CI)(READ) | +-file.1 (I)(READ) | +-nested/ (OI)(CI)(I)(READ) | +-file.2 (I)(READ) (OI)(NP)(READ) +-oi_dir/ (OI)(NP)(READ) | +-file.1 (I)(READ) | +-nested/ | +-file.2 (CI)(NP)(READ) +-oi_dir/ (CI)(NP)(READ) | +-file.1 | +-nested/ (I)(READ) | +-file.2 (OI)(CI)(NP)(READ) +-parent/ (CI)(OI)(NP)(READ) | +-file.1 (I)(READ) | +-nested/ (I)(READ) | +-file.2 ACL ( -I) . ACE (CI) (OI) . (EXIT STATUS) smbcacls . . smbcacls 0 . smbcacls ACL 1 . 2 . (VERSION) 4.24.6 Samba . (AUTHORS) Samba Andrew Tridgell . Samba Samba Team Linux . smbcacls Andrew Tridgell Tim Potter . DocBook Samba 2.2 Gerald Carter . DocBook XML 4.2 Samba 3.0 Alexander Bokovoy . Samba 4.24.6 08/16/2026 SMBCACLS(1)