CIFS creation fails with LDAP Error The user has insufficient access rights

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 1,360

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

Applies to

ONTAP 9
CIFS

Issue

CIFS creation fails with below error

::*> cifs server create -vserver svm1 -cifs-server cifs1 -domain domain.com -ou CN=Computers

In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of a Windows account with sufficient privileges to add computers to the "CN=Computers" container within the "domain.com" domain.

Enter the user name: user

Enter the password:

Error: Machine account creation procedure failed

[ 16507] Loaded the preliminary configuration.

[ 16849] Created a machine account in the domain

[ 16850] SID to name translations of Domain Users and Admins completed successfully

[ 16872] Successfully connected to ip 10.x.x.x, port 88 using TCP

[ 16917] Successfully connected to ip 10.x.x.x, port 464 using TCP

[ 16961] Kerberos password set for 'cifs$@domain' succeeded

[ 16961] Set initial account password

**[ 17017] FAILURE: Unable to set machine account attribute**'msDS-SupportedEncryptionTypes': Insufficient access

[ 17059] Deleted existing account 'CN=cifs,CN=Computers,DC=domain,DC=com'

Error: command failed: Failed to create the Active Directory machine account "cifs". Reason: LDAP Error: The user has insufficient access rights.

Packet trace collected show DC is respoding with insufficientAccessRights when modifying "msDS-SupportedEncryptionTypes" after cifs creation.

No Source Destination Proto Info

1 10.x.x.x 10.y.y.y LDAP modifyRequest(9) "CN=cifs,CN=Computers,DC=domain,DC=com"

protocolOp: modifyRequest (6)

    modifyRequest

        object: CN=cifs,CN=Computers,DC=domain,DC=com

        modification: 1 item

            modification item

                operation: replace (2)

                modification msDS-SupportedEncryptionTypes

                    type: msDS-SupportedEncryptionTypes

                    vals: 1 item

                        AttributeValue: 30

2 10.y.y.y 10.x.x.x LDAP modifyResponse(9) insufficientAccessRights (00002098: SecErr: DSID-031514B3, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0\n)