After AD reorganization the DACLs changed to SID resulting in Access Denied
Applies to
- ONTAP 9
- Active Directory (AD)
- CIFS/SMB
Issue
- After AD server reorganization, users are unable to access CIFS shares and the DACL display in the file-directory show output changed to SID.
- Example:
3/16/2016 10:58:22 user-01 DEBUG secd.unexpectedFailure: vserver (vserver_1) Unexpected failure. Error: Lookup of CIFS account SID procedure failed
[ 3 ms] Using a cached connection to user-6.naslab.local
[ 4] Could not find Windows SID 'S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx'
**[ 5] FAILURE: SID lookup failed
3/16/2016 10:56:19 user-01 DEBUG secd.unexpectedFailure: vserver (vserver_1) Unexpected failure. Error: Lookup of CIFS account SID procedure failed
[ 2015] Successfully connected to 10.61.92.xxx:445 using TCP
[ 2037] Successfully authenticated with DC user-6.naslab.local
[ 2046] Could not find Windows SID 'S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx'
**[ 2046] FAILURE: SID lookup failed
- Security trace displays the following:
Protocol: cifs
Volume : -
Share: SHARENAME
Path: /<path>/file.pdf
Win—User: DOMAIN\user123
UNIX-user: root
Session-ID: 999999999999999999
NODEEXAMPLE-1 1 Security Style: NTFS and Access is denied. The
NT ACL requested permissions are not
granted by the ACE while
opening existing file or
directory. Access is not
granted for: "Read Control",
"Read Attributes",
"Read EA", "Read"
- Below error is seen when
vserver security file-directory show -vserver <> -path <>is run.
Vserver: VSERVER
File Path: /volume/<path>/file.pdf
File I node Number: 10101010
Security Style: ntfs
Effective Style : ntfs
DOS Attributes : 20
DOS Attributes in Text: ---A----
Expanded Dos Attributes: —
UNIX User Id: 65534
UNIX Group Id: 65534
UNIX Mode Bits: 777
UNIX Mode Bits in Text : rwxrwxrwx
ACLs : NTFS Security Descriptor
Control:Ox8808
Owner:DOMAIN\user123
Group:DOMAIN\Domain Users
DACL - ACEs
ALLOW-S-1-5-21-0000000000-0000000000-0000000000-512-Ox1f01ff- (Inherited)
ALLOW-S-1-5-21-0000000000-0000000000-0000000000-1106-Ox1301bf- (Inherited)
Vserver: VSERVER(internal ID: 3)
Lookup of CIFS account SID procedure succeeded
[0 ms] Using a cached connection to name.example.com
[25] Could not find Windows SID
's-1-5-21-0000000000-0000000000-0000000000-512'
Vserver: VSERVER(internal ID: 3)
Lookup of CIFS account SID procedure succeeded
[0 ms] Using a cached connection to name.example.com
[25] Could not find Windows SID
's-1-5-21-0000000000-0000000000-0000000000-1106'