Printer fails to save the scanned file on the CIFS share

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 198

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

Applies to

ONTAP 9
CIFS
NTFS

Issue

The printer fails to save a scanned file on a CIFS share

Note: This refers to client specific behaviour of accessing and creating files on a CIFS share, not merely accessing a CIFS share.

Share Level ACL indicates user user1 has permission to access the share

Example:

::> vserver cifs share access-control show -vserver vs1 -share share1                                                                                      
               Share       User/Group                  User/Group  Access
Vserver        Name        Name                        Type        Permission
-------------- ----------- --------------------------- ----------- -----------
vs1            share1      test\user1                  windows     Full_Control

File level ACL (DACL) indicates user1 has no permissions on the volume

Note: user1 is not in Administrators group

Example:

::> vserver security file-directory show -vserver vs1 -path /test_volume
                Vserver: vs1
              File Path: /test_volume
      File Inode Number: 64
         Security Style: ntfs
        Effective Style: ntfs
         DOS Attributes: 10
DOS Attributes in Text: ----D---
Expanded Dos Attributes: -
           UNIX User Id: 0
          UNIX Group Id: 0
         UNIX Mode Bits: 555
UNIX Mode Bits in Text: r-xr-xr-x
                   ACLs: NTFS Security Descriptor
                         Control:0x9504
                         Owner:BUILTIN\Administrators
                         Group:BUILTIN\Administrators
                         DACL - ACEs
                           ALLOW-CTS\Administrator-0x1200a9-OI|CI

Note: No user1 entry under DACL - ACEs

Another indicator is lack of effective permissions for the user:

Example:

::> vserver security file-directory show-effective-permissions -vserver vs1 -win-user-name user1 -path /somewhere/test_volume
                               Vserver: vs1
                     Windows User Name: user1
                        Unix User Name: pcuser
                             File Path: /somewhere/test_volume
                       CIFS Share Path: -
                 Effective Permissions: 
Effective File or Directory Permission: 0x100000
                                        Synchronize
[...]

Packet trace shows the printer can connect to the CIFS share (Tree Connect successful), but get STATUS_ACCESS DENIED when creating a scanned pdf file

Example:

14 2023-08-16 11:04:15,167250 172.10.10.10 172.10.10.30 SMB2                                Tree Connect Request Tree: \\172.10.10.30\share_name

15 2023-08-16 11:04:15,167823 172.10.10.30 172.10.10.10 SMB2        STATUS_SUCCESS          Tree Connect Response

[...]

20 2023-08-16 11:04:15,467650 172.10.10.10 172.10.10.30 SMB2 47115 2680570868 2680571072 3745887559 Create Request File: 202309160001.pdf

21 2023-08-16 11:04:15,467788 172.10.10.30 172.10.10.10 SMB2 445 3745887559 3745887636 2680571072 Create Response, Error: STATUS_ACCESS_DENIED

Note: Tree Connect is successful, but the Create File Response is STATUS_ACCESS_DENIED