Can’t change permissions – “The parameter is incorrect”

[jtrahan]

I believe I figured out the problem. It appears to be an issue with the Parent folder's ACL setup.

Lets say you grant "Doman Admins" with the permission "This Folder, Sub Folder, & Files" with full access to the share folder. Whenever a user with the default group of Domain admins creates a new folder, the folder on the unix side gets setup as domain admins. The parent folder also has Everyone full access and propogates down to the child folder. Now you go to the sub folder and want change or remove the Everyone Full access to allow ONLY domain admins access to that folder. What appears to be happening is that it's trying to modify the unix side's acl and trying to reapply the "default:group" acl and its getting rejected at that point.

In order for me to make it stop giving the incorrect paramter error I had to go to the child folder and remove the domain admins which makes it basically reset for that folder. Then I can change any other permssion as needed. Then when I try to reapply full access so that new child folders under this child will propogate I then get the error again.

Hope this makes sense.

I also discovered a security issue. Lets say your parent folder has Everyone full access, but the child folder everyone was read only access. Anyone fitting the everyone category has the ability to rename the folder. I found that they cannot delete the folder which is a good thing, but having the ability to rename a folder imo is bad security.

[arunasad]

Grievous, what information exactly you need? I and others have given our network details and explained when the error occurs. There must something different in your environment… I am a bit surprised that nearly 3 months since my original post and after so many people reporting this you still can’t confirm that this is a problem…

Netgear tech support guys have confirmed that they can reproduce this by simply following their own instructions on http://www.readynas.com/?p=1987. Can’t you just check my case notes and speak to a technician who provided a workaround? He could reproduce this straight away. He also promised to provide a permanent fix in a future firmware release…

[Grievous]

arunasad, I'll quote my post.

Ced, You said that you specified domain user permissions, and then tried to delete them?

Here's what I want. A screenshot of your Frontview permissions, a screenshot of your share permissions in Windows, and then a screenshot of the folder permissions. However I want the screenshots to show what exactly it is you're trying to set the permissions to, before you hit "apply". Send them to me as logs(information is in my signature).

I've asked a couple of times now that someone provide me with the information, no one wants to. Following the previously given instructions, it works just fine for me. And by the way, support cannot promise a fix for an issue.

jtrahan, was that domain admin group permission set via frontview, or on the share via windows?

Regarding the security issue, I have a share configured with everyone having full control, then a folder within that share with everyone having read & execute, then when logged in as a normal domain user(not a member of domain admins) I can't change the name of that folder that's set as read & execute for the everyone group.

[dromand]

I am also having this issue for me it seems to have appeared after updating to 4.2.15. Windows 2008 Server AD domain based network mix of Win 7 and XP Clients. I have made NO CHANGES to permission on the NAS share.

Creating a new folder on the share results in the same issues as other are having. Domain users are blocked from accessing the folder. I have tried modifying the rights from the Server, Win xp client and Win 7 client to no avail. I have tried removing the domain uses group using the windows client but based on above the NAS apparently assigns those rights.

Trying to modify domain user rights on a folder that already existed prior to applying the update also was unsuccessful and in fact fubar'd user access to the folder.

on the new folder reviewing the advanced settings I found that root was the owner of the folder - i then took control with my user account which is also a domain admin - attempted to change permissions - no go

under advance permissions it shows permission as special - not inherited and this folder only. Apparently 4.2.15 borked all the AD settings on the NAS. Looks like this has been happening for a while - hopefully netgear will actually decide to fix it - essentially the NAS is now a BRICK for me

edit: also i did contact netgear support and was told that tech support is aware of the issue and has a fix but it would cost me either 75.00/hr or 299.00 for a support contract in order to get it resolved. Clearly netgear is aware of the issue and apparently is looking at it as a way to increase their revenue.

[Conn]

arunasad, I'll quote my post.

Ced, You said that you specified domain user permissions, and then tried to delete them?

Here's what I want. A screenshot of your Frontview permissions, a screenshot of your share permissions in Windows, and then a screenshot of the folder permissions. However I want the screenshots to show what exactly it is you're trying to set the permissions to, before you hit "apply". Send them to me as logs(information is in my signature).

I've asked a couple of times now that someone provide me with the information, no one wants to. Following the previously given instructions, it works just fine for me. And by the way, support cannot promise a fix for an issue.

jtrahan, was that domain admin group permission set via frontview, or on the share via windows?

Regarding the security issue, I have a share configured with everyone having full control, then a folder within that share with everyone having read & execute, then when logged in as a normal domain user(not a member of domain admins) I can't change the name of that folder that's set as read & execute for the everyone group.

I've just sent you the screenshots you've asked for. If you need anything else, please let me know.

[Grievous]

Conn, thanks. Just to clarify about screenshot 7, when you add that user and hit apply is that when you're running into the "Parameter is incorrect" error? Because it looks like the permission for that user has already been applied since the apply button is grayed out(or nothing has been edited yet?)

[Conn]

Conn, thanks. Just to clarify about screenshot 7, when you add that user and hit apply is that when you're running into the "Parameter is incorrect" error? Because it looks like the permission for that user has already been applied since the apply button is grayed out(or nothing has been edited yet?)

That's correct. I had not hit apply yet on the properties screen, but I did hit advanced so that you could see the advanced security setting for the folder.

[Grievous]

Something else...

With the share hidden from windows via the $ at the end, how exactly are you browsing to it? Are you using \\nas\ or \\nas\c\ (as the admin)?

[Conn]

Something else...

With the share hidden from windows via the $ at the end, how exactly are you browsing to it? Are you using \\nas\share$ or \\nas\c\share$ (as the admin)?

When I'm trying to edit folder security, I use a shortcut on my Windows XP computer which is pointing at \\nas\share$. I then right click the folder within the share and edit the security permissions. This uses my domain user account which is a member of domain admins, so I'm supposed to have full control over the folders.

[Grievous]

Ok, we've got it reproduced in the office(finally). Now that we can observe the issue, we can work on a fix. However, I don't have any sort of estimate of at this point how long it's going to take on our end.

If I need more information, or have more information, I'll let you guys know in this thread.

[arunasad]

Ok, we've got it reproduced in the office(finally). Now that we can observe the issue, we can work on a fix. However, I don't have any sort of estimate of at this point how long it's going to take on our end.

If I need more information, or have more information, I'll let you guys know in this thread.

Finally some progress!
Grievous, do you know what in your test environment was preventing to reproduce this until now? Just wondering if this could be used as a workaround.

[dromand]

any update this is causing major headaches for my users

[Grievous]

any update this is causing major headaches for my users

Refer to my post above.

[smemaine]

Ok, we've got it reproduced in the office(finally). Now that we can observe the issue, we can work on a fix. However, I don't have any sort of estimate of at this point how long it's going to take on our end.

If I need more information, or have more information, I'll let you guys know in this thread.

I've been watching this thread for a few days hoping for some relief. We've got a ReadNas 2100 in a Windows 2003 domain. We experienced the permissions issue which seemed to be coincident with this log entry:
Wed Nov 17 07:47:24 EST 2010 Your ReadyNAS device has been updated with a new firmware image. (RAIDiator-x86 4.2.15)

We have been limping along since that time. The only work around I have found is to:

1) Explore the share from a windows box (I'm doing it as a member "Domain Admin" and "Administrators")
2) goto properties->Security-Advanced
3) remove the Domain Users group (which on my box has permission set to 'none'
4) Click Apply and the Domain User group re-appears (without adding it) and "Full Control" shows under permissions

You seem to be able to set other attributes at this point.
I have done it for multiple files/folders if the permissions are all the same.

There is a very complex mapping going between Linux and Windows permissions that's causing this to be a difficult problem to define (from our user persepctive). The above workaround seems to allow the users to go about their business but it may be specific to our Active Directory defaults and other factors.

If I go to properties->Security and try to reset the permission on Domain Users I get the error: "The parameter is incorrect" after hitting the Apply button.

Hope this helps somebody....

I wonder if a roll-back for RAIDiator-x86 4.2.15 is an option while we wait?

[dromand]

I've tried that workaround to no avail. Even as a member of domain admins with full rights - i can't remove the Domain users group without getting the paramet is incorrect. Essentially my users are locked out of folders now - i've had to move the items to a portable hard drive for them to be able to access things. At this point - I think I'm going to have to purchase another NAS to use as netgear can't seem to fix the issue