Vserver CIFS create when joining SVM to CIFS domain or DC connection after cifs create fails when SMB3 encryption enforcing is enabled
Applies to
- ONTAP 9
- CIFS
- Active Directory(AD)
- Domain Controller(DC)
- SMB3 encryption is enforced
Issue
- Cannot join SVM to CIFS domain
::> vserver cif create -vserver SVM-CIFS -cifs-server cifsserver01 -domain test.domain -auth-user-type domain-user
Error: Machine account creation procedure failed
Loaded the preliminary configuration.
Created a machine account in the domain
Successfully connected to ip 10.67.221.15, port 445 using TCP
Encountered NT error (NT_STATUS_NOT_SUPPORTED) for SMB command Negotiate
Unable to connect to LSA service on (Error: RESULT_ERROR_SPINCLIENT_CMD_FAILED)
No servers available for MS_LSA, vserver: 4, domain:
FAILURE: Unable to make a connection test.domain Result: RESULT_ERROR_SECD_NO_SERVER_AVAILABLE
Could not find Windows SID 'S-1-5-21-3573561394-2323426838'
Deleted existing account 'CN=cifsserver01,CN=Computers,DC=TEST,DC=TEST1'
Error: command failed: Failed to create the Active Directory machine account "cifsserver01". Reason: SecD Error: no server available.
- SVM to DC connection fails after SMB3 encryption enforcing is enabled at DC side.
CIFS SMB2 Share mapping - Client Ip = 10.67.221.10
[ 0 ms] Login attempt by domain user Demo\user1 using NTLMv2 style security
[ 1] Successfully connected to ip 10.67.221.15, port 445 using TCP
[ 1] Encountered NT error (NT_STATUS_NOT_SUPPORTED) for SMB command Negotiate
[ 1] Unable to connect to NetLogon service on dc1.demo.local (Error: RESULT_ERROR_SPINCLIENT_CMD_FAILED)
[ 1] No servers available for MS_NETLOGON, vserver: 3, domain: demo.local.
**[ 1] FAILURE: Unable to make a connection (NetLogon:demo.local), Result: RESULT_ERROR_SECD_NO_SERVER_AVAILABLE
[ 1] CIFS authentication failed