Can’t change permissions – “The parameter is incorrect”

[arunasad]

I have three ReadyNAS Pro Business boxes on Windows Server 2003 domain.

Just noticed that there are some issues with changing permission on Windows machines. Basically if a user creates a folder and then he or an administrator tries to change some permissions (add additional user, propagate permissions to child objects, allow or disallow inheritance) this fails with error
“An error occurred applying security information to: <path/folder> The parameter is incorrect”
Or:
“Unable to save permissions changes on <foldername> The parameter is incorrect”

The same happens for the domain administrator account which was used to add ReadyNAS to a domain.
If I try to add additional user this actually works even after the error is displayed, however it doesn’t propagate down and only affects one folder.

This definitely used to work so I suspect problem occurred after one of the recent firmware updates. I am currently on 4.2.13, but the same was happened on 4.2.12 (just upgraded hoping this would sort the problem).

Also, this seems to affect only newly created folders. With old folders everything works fine.

Any ideas how to fix this?

[arunasad]

Have a case opened regarding this issue with Netgear support. It has now been escalated to Lever-3 but still no suggestions.

This is causing problems on our network as I can’t set correct permissions for newly created home and profile folders.

I am tempted to try removing one of the ReadyNAS devices from AD and then re-adding it with another domain admin account. Would this cause any additional problems with permissions on existing shares and folders?

[kasan]

Support team member will contact you regarding this. Thanks.

[dbuschjr]

I am having the exact same problem. How do we resolve this?

[Grievous]

arunasad and dbuschjr, What is the client OS you guys are using? I know there's a server 2003 domain involved, but with just a brief check on my end using a windows 7 client to edit the permissions, it works for me.

edit: Also, one other thing. Would it be possible for you to give us a sample of the folder path for one of these instances where it occurs? And by that I mean \\nas_hostname\sharename\folder\folder\folder that way we can see if there's any ascii characters in that path that may be affecting it that we wouldn't normally see in basic testing.

[arunasad]

I don't have any Win 7 clients in the domain, but the same occurs on Windows XP and Server 2003 machines.
Folder path would be \\svr-oxf-nas1\Profiles-Oxf\TEST

Edit:
Received first response from level 3 support. They can recreate the problem and say this must be to do with newer version of Samba.

I hope solution or workaround will come soon. It's a major issue if we can't modify folders' permissions inside shares.

[beisser]

I don't have any Win 7 clients in the domain, but the same occurs on Windows XP and Server 2003 machines.
Folder path would be \\svr-oxf-nas1\Profiles-Oxf\TEST

Edit:
Received first response from level 3 support. They can recreate the problem and say this must be to do with newer version of Samba.

I hope solution or workaround will come soon. It's a major issue if we can't modify folders' permissions inside shares.

do you have a case number?

[arunasad]

Original case number #12974969.
It looks like Level 3 support assigned a new number #12976372

[emcandrew]

I am also having this problem.

[arunasad]

This seems to be related to the "Domain Users" security group. At lease for me. Thanks to level-3 support I have a workaround now.

This is a workaround I used:
Using a windows client and administrator account remove Domain Users from share's root and add everyone instead. Re-Adding domain users also seems to works, but you have to use Advanced Security window and make sure permissions apply to "This Folder Only"
Set required permissions on the next level folders but DO NOT use "domain users". Other security groups seems to be fine, but as soon as you try to use "domain users" issue re-appears. Also, "everyone" for me only works on share's root. If I try to use "everyone" instead of "domain users" on next level folders it doesn't make any difference.

Issue also reappears for me if a profile folder is created automatically by Active Directory. What I have to do is log-on as a user and create folder manually. Then I can edit permissions as an administrator. A bit messy but al least works.

Hopefully a proper fix will come soon.

[emcandrew]

Thanks, that works for manual creation (as long as I do the steps), but I can't take this thing to production until I can migrate all of my existing share ACL's to it as well. Robocopy throws fits still...

I just bought two of these for just a little over 7k and they're worthless to me at this point...

2010/08/31 16:39:15 ERROR 87 (0x00000057) Copying NTFS Security to Destination Directory [file path]
The parameter is incorrect.

[Grievous]

Ok guys, we need a specific step by step set of instructions to try and reproduce this, including exactly what OS the domain is running, what OS the client is, and exactly how you're trying to adjust permissions. No matter what I do, works just fine for me, so there's obviously something being missed here.

[arunasad]

Grievous,

Some background of my network:
Windows Server 2003 domain.
Windows XP clients.
3 sites in different geographical locations connected by VPN.
3 ReadNAS Pro Business (one in each site). All three affected. All running 4.2.12 firmware.
Tried to upgrade one of the devices to 4.2.13. This didn't fix the issue, but device froze two nights in a row after the upgrade so had to downgrade.

Regarding step by step instructions - I can reproduce this simply following instructions on ReadyNAS website http://www.readynas.com/?p=1987
Level-3 support engineer said he could also recreate this using the same instructions. Check notes of case #12976372.
Critical step here seems to be adding "Domain Users" security group to the share. Even if this succeeds any further attempts to edit permissions on next level folders fail.

I can also recreate this without using Domain Users group is if I allow Active Directory to automatically create user’s profile folders on ReadyNAS. There is no Domain Users group in the permission list, but “parameter incorrect” error appears trying to add any additional security group to newly created profile folder. If profile folder is created manually issue does not occur even when permission list looks exactly the same.

If you still can't reproduce this there seems to be something else involved.

I have an acceptable workaround now, but it would be great if the issue is properly fixed. Especially knowing that this doesn't affect only me and your own engineers can recreate it.

[smdh]

Is there any way to get on a mailing list for when this is corrected? As others have stated, until this is fixed, the NAS is basically useless as the work around listed isn't a work around for us as the "domain users" account isn't involved in this situation for us either.

[ab4ok]

I've experienced similar quirks in AD administration. My config:

2 ReadyNAS 3200 units, both on the latest firmware 4.2.13
Windows 2000 domain (will soon be moving to Win2008R2)
Win XP clients

My experience:
1. I create a share in NAS per instructions found on this site
2. I use Win2000 Server, logged in as administrator to create directories in NAS-created share
3. If I try to change permissions on NAS folder and propogate down it leads to a world of hurt. Found it best to leave NAS folder "as is" and focus on permissions of directories created in Windows.
4. ReadyNAS automatically adds groups/users, "Domain Users", "Everyone", "root (Unix)", "CREATE GROUP", CREATE USER" (though some of these not immediately visible), and set to "This folder only".
5. Sometimes I want my "Domain Users" to have read-execute permissions on all folders within a share and another group to have full permissions. If I try to change the Domain Users permissions at a higher level and propogate throughout it often errors out with "parameter is incorrect." If I try to remove the "Domain Users" group and then re-add it with the permissions I want I get similar results.

My work-around for "Domain Users" issue:
1. Let ReadyNAS set permssions however it wants on it's "share."
2. Create my folder(s) from within Windows under the ReadyNAS share.
3. If I want all "Domain Users" to have certain permissions I first create a group called something like, "All_Domain_Users" and add the group "Domain Users" as a member of the group. Then I assign the group "All_Domain_Users" to my WIndows folder(s) with the required permissions and for "This folder, subfolders and files."
4. It seems that ReadyNAS will still add the users and groups it wants to add, even when I try to remove them and propogate downward so I gave up trying to change them.

I just figured the problems I was having was because we're still on WIn2000. Hope this helps someone.