Question:
Can I globally prevent the security settings for shares from being changed?
Answer:
This is not possible globally, but only for each share individually.
You can use the Windows tools to set the permission. But there is also a command line tool “sharesec”, with which it is possible to set the desired permissions.
There is a good description here:
https://wiki.samba.org/index.php/Setting_up_a_Share_Using_Windows_ACLs
Sharesec could be used like this:
sharesec testshare -m S-1-1-0:ALLOWED/0X0/CHANGE
sharesec testshare -a S-1-5-21-2438365080-1175145288-4246282840-512:ALLOWED/0X0/FULL
sharesec testshare -v-view-all
REVISION:1
CONTROL:SR|DP
OWNER:
GROUP:
ACL:S-1-1-0:ALLOWED/0x0/CHANGE
ACL:S-1-5-21-2438365080-1175145288-4246282840-512:ALLOWED/0x0/FULL