Review TrueNAS private SMB datasets with two separate users

Bottom line: Define who may open the private data and who may maintain it before selecting a share preset. Test two distinct user identities and the intended administrator, and keep folder visibility separate from access to its contents.

Source fact: what the authority says

The TrueNAS private SMB guide requires both dataset and share ACL permissions to allow or prevent access to a private dataset share. It distinguishes the filesystem ACL from the share ACL, which controls what a user can see or access through Windows File Explorer. For private datasets nested under a shared parent, it directs restricting share ACLs and notes that other dataset names may remain visible while access to their contents is blocked. The guide requires an appropriate SMB user or directory membership and says root and built-in accounts cannot access SMB shares.

What the source does not establish

This article addresses the versioned private-share permission decision, not a guarantee that a selected preset has met a particular confidentiality policy. Folder-name visibility, file access and administrative maintenance must be accepted according to the owner’s separate requirements.

Applicability questions

• Which dataset, share path and parent dataset are actually involved?
• Which identity owns the private data, and which administrator needs maintenance access?
• Should another user see the folder name, open its contents, or neither?
• What effective dataset and share permissions apply to each test identity?

DSE recommendation: controlled next steps

The following steps are DSE recommendations based on the cited source.

DSE recommends an access matrix with separate rows for the private user, another ordinary user and the approved maintenance administrator. Define allowed read, change and maintenance operations in plain language. Do not use the same cached client session as evidence for all three identities.

Review both permission layers against that matrix. Keep the parent dataset and each nested private dataset explicit in the path diagram. Avoid making a broad parent permission change merely to resolve a single share-creation error without reviewing the other directories beneath it.

Use a proposed disposable dataset with harmless files for the first trial. Have the owner decide whether displaying another folder’s name violates the requirement even if its contents cannot be opened. Record that requirement before interpreting the client view.

Preserve the initial ACLs and approved administration path. If an extra group is needed, describe its intended membership and rights rather than granting broad access to make the test pass. Keep the privacy decision and maintenance exception visible to the data owner.

Verification and evidence

Proposed verification: establish separate authenticated sessions for the intended user and excluded user, then test the named file operations and any required folder visibility. Record the effective identity and requested path with each result. Check the maintenance administrator separately without treating that privileged result as an ordinary user test.

Compare the observed results with both ACL exports and the access matrix. Investigate an unexpected permission at the exact dataset and share before changing inherited access broadly. Retain redacted evidence and remove the disposable data through the agreed cleanup procedure after the owner accepts the bounded test.

Official references

• TrueNAS — Setting Up SMB Private Dataset Shares — official product documentation; confirm the installed release and configuration.

Source review completed October 29, 2026. Recheck the official documentation and deployment-specific applicability before a production change.