Admin no longer has access to all volumes on the Mac

Servers by nature require much higher security than client stations. Just think about it, if compromised, the data of a complete community or group could be compromised and exploited to their detriment. In OS X Server, your highest authority is with the original administrator, but actually it is also not! ..... Since the introduction of SID as a further protection layer, and even before, we have seen that the admin user is only allowed to make changes within a specific framework. Best is to read a bit and more about the subject. There are lots available : The blogs of Jesus Vigo with TechRepublic, Rich Trouton from DerFlounder and of course it will help to read the books from Reid Bondonis and use them as a practical tool whilst setting up and learning. Also worth watching are the videos from Todd Olthoff on Server.

In short, when more access is required, consider it carefully, plan for what, when, where and the duration. And Backups, plenty thereof. You might make more than one mistake, with the subsequent restores. Also have a look at this discussion: How do I set privileges on shared folders so complete workgroups has r/w access to all folders?

Leo

You can enable the option with:

sudo serveradmin afp:admin31GetsSp=yes

Then restart AFP to activate the change

sudo serveradmin stop afp

sudo serveradmin start afp

Note: this works for AFP only, not for SMB.

OS X client defaults to SMB, so you either need to force AFP on the client or disable SMB on the server.

If SMB isn't required, I'd take the 'DIsable SMB' route:

sudo serveradmin stop smb

If you prefer to keep SMB running, the client should connect with and afp URL

ex: afp://10.0.0.2

hope that helps

jeff

For SMB, enable administrators to see all volumes and shared folders with:

sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server VirtualAdminShares -bool YES

restart SMB

sudo serveradmin stop smb
sudo serveradmin start smb

Hopefully that does the trick :-)

Jeff

Thank you for pointing us in the right direction!

I wanted admin shares over AFP ONLY, with SMB disabled, but the solution above did not work so i did some digging.

The correct (TWO) settings are:

afp:SpecialAdminPrivs=yes

afp:admin31GetsSP=no

SpecialAdminPrivs - Grant administrator users root user read/write privileges. Default =no

admin31GetsSP - Set to yes to force administrator users on Mac OS X to see sharepoints instead of all volumes. Default =yes

also i had to append 'settings' after 'sudo serveradmin'

so:

sudo serveradmin settings afp:SpecialAdminPrivs=yes
sudo serveradmin settings afp:admin31GetsSp=no
sudo serveradmin stop afp
sudo serveradmin start afp

http://www.manualslib.com/manual/8664/Apple-Mac-Os-X-Server.html?page=137#manual

http://www.manualslib.com/manual/8664/Apple-Mac-Os-X-Server.html?page=140#manual

oops, forgot

afp:adminGetsSP=no

adminGetsSP - Set to yes to force administrator users on Mac OS 9 to see sharepoints instead of all volumes.Default =no

so:

sudo serveradmin settings afp:SpecialAdminPrivs=yes
sudo serveradmin settings afp:admin31GetsSp=no
sudo serveradmin settings afp:adminGetsSp=no
sudo serveradmin stop afp
sudo serveradmin start afp

AGH! it seems there is no way for AFP to show BOTH Root volumes AND defined share points at the same time (like default behavior), if Server.app is installed...

am i crazy or?

OS X Server: Allowing administrators to access all volumes and shared folders over SMB - Apple Support

Agh, sorry, missed the AFP request. I'll leave this link here as it may be helpful for someone in the future.

AND, uninstalling server.app does NOT return the default behavior of showing BOTH root volumes AND share points over AFP! 😟