nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

CIFS Share not accessible

Divine

Hello.

Please i have an issue with one of the cifs share. We are unable to access it no matter what. When we run the "vserver security file-directory show" command, this is what displays, even though we've given "Everyone" access. We also added the domain admin credentials to the BUILTIN/administrators but it still won't give access.

vserver security file-directory show -vserver svm*********** -path /vol/Library_Project

Vserver: svm_**********
File Path: /vol/Library_Project
File Inode Number: 64
Security Style: ntfs
Effective Style: ntfs
DOS Attributes: 30
DOS Attributes in Text: ---AD---
Expanded Dos Attributes: -
UNIX User Id: 0
UNIX Group Id: 0
UNIX Mode Bits: 0
UNIX Mode Bits in Text: ---------
ACLs: NTFS Security Descriptor
Control:0x9504
Owner:BUILTIN\administrators
Group:BUILTIN\administrators
DACL - ACEs
DENY-Everyone-0x1f01ff-OI|CI
ALLOW-$$$$$$$$\#########-0x1f01ff-OI|CI
ALLOW-$$$$$$$$\#######-0x1301bf-OI|CI
ALLOW-$$$$$$$$\######-0x1f01ff-OI|CI
ALLOW-$$$$$$$$\######-0x1f01ff-OI|CI
ALLOW-$$$$$$$$\######-0x1301bf-OI|CI

Find more posts tagged with

Accepted answers

Ontapforrum

No worries.

To be honest, It's a very tricky situation, I don't know what was the need for 'deny' to be in the security group permissions, it is dangerous, simply b'cos it takes precedence.

In any case, you might have to try these steps:

1) Take ownership of the share

Windows cmd promt (admin rights):
\>takeown /F x:\path\to\share
2) Remove 'deny'.
If the step 1 succeeds, right-click on the share, properties, select 'security tab', click advanced, change permissions, then select 'deny' and click 'remove'.

or
Try with ONTAP CLI
https://docs.netapp.com/us-en/ontap-cli-97/vserver-security-file-directory-ntfs-dacl-remove.html#description

In none works and you keep getting permission denied, then might want to just delete the share/volume and recreate one if there was no data. If there was data, you might want to just vol copy/mirror to another volume and then re-create the share and permissions. [Avoid deny in future]

All comments

Ontapforrum

Following output looks ok?

::> vserver cifs show

::> vserver cifs share show

Check the date/time of the NetApp filer

::>

Check the date/time of the Windows DC

Make sure the time is with-in 5 mnt difference.

Divine

Hi Ontapforum. Other cifs shares are accessible except this one. This is the only share giving us this problem.

Ontapforrum

Do you mind sharing screenshot of the error ? When you say only share giving problem, is it visible ? It is not visible at all ?

Can we see output of the CLI for the specific share ?

Divine

Hi, please see attached.

netapp security error.docx

PuTTY log 2.txt

cedric_renauld

Hello,

Have you check @same time of access the event of the Ontep ?

event show

Divine

We will check and revert. Thanks!

Ontapforrum

Thanks for sharing the putty-output, CAUSE is clearly seen in the output of this command.
::> vserver security file-directory show -vserver svm_temssna002 -path /vol/Library_Project
UNDER DACL - ACEs:
DENY-Everyone-0x1f01ff-OI|CI <<-------Cause: DENY permissions will supersede any ALLOW permissions, no matter the user or group.

Workaround:
Since the DENY permission will prevent this, the DENY permission must be removed first. To resolve this issue, change the owner of the share to a user account (that has MODIFY or FULL CONTROL), not a group, then remove the DENY permission from EVERYONE. That should fix the issue.

Divine

Thanks, Ontapforrum. We will try this first thing Monday morning. However, if you don't mind, can you share the command to change the owner of the share?