About kodavali

kodavali · ‎2016-09-09

PSTK 4.2 PowerShell 5.1 (Server 2016 TP5) ONTAP 9.0

kodavali · ‎2016-09-09

Yes it worked for me. Only difference is i used "$True" instead "$true" (all small characters). when i use all small characters it did not set the value. Here is the output. PS C:\test> Get-NcCifsSecurity -VserverContext infra|format-list IsAesEncryptionEnabled : False IsPasswordComplexityRequired : True IsSigningRequired : False IsSmbEncryptionRequired : False KerberosClockSkew : 5 KerberosKdcTimeout : 3 KerberosRenewAge : 7 KerberosTicketAge : 10 LmCompatibilityLevel : lm_ntlm_ntlmv2_krb NcController : 10.195.49.190 SessionSecurityForAdLdap : UseStartTlsForAdLdap : False Vserver : infra IsAesEncryptionEnabledSpecified : True IsPasswordComplexityRequiredSpecified : True IsSigningRequiredSpecified : True IsSmbEncryptionRequiredSpecified : True KerberosClockSkewSpecified : True KerberosKdcTimeoutSpecified : True KerberosRenewAgeSpecified : True KerberosTicketAgeSpecified : True UseStartTlsForAdLdapSpecified : True PS C:\test> Get-NcCifsSecurity -VserverContext infra | Set-NcCifsSecurity -IsSigningRequired $True WARNING: 'KerberosKdcTimeout' parameter is not available for Data ONTAP 9.0 and up. Ignoring 'Kerberos KdcTimeout'. KerberosClockSkew KerberosRenewAge KerberosTicketAge ----------------- ---------------- ----------------- 5 7 10 PS C:\test> Get-NcCifsSecurity -VserverContext infra|format-list IsAesEncryptionEnabled : False IsPasswordComplexityRequired : True IsSigningRequired : True IsSmbEncryptionRequired : False KerberosClockSkew : 5 KerberosKdcTimeout : 3 KerberosRenewAge : 7 KerberosTicketAge : 10 LmCompatibilityLevel : lm_ntlm_ntlmv2_krb NcController : 10.195.49.190 SessionSecurityForAdLdap : UseStartTlsForAdLdap : False Vserver : infra IsAesEncryptionEnabledSpecified : True IsPasswordComplexityRequiredSpecified : True IsSigningRequiredSpecified : True IsSmbEncryptionRequiredSpecified : True KerberosClockSkewSpecified : True KerberosKdcTimeoutSpecified : True KerberosRenewAgeSpecified : True KerberosTicketAgeSpecified : True UseStartTlsForAdLdapSpecified : True

kodavali · ‎2016-09-08

I tried this way and it worked Get-NcCifsSecurity -VserverContext infra | Set-NcCifsSecurity -IsSigningRequired $False Not sure if this is the mothod works for you

kodavali · ‎2016-06-23

Dear PowerShell community, We are pleased to announce the availability of NetApp PowerShell Toolkit 4.2 The NetApp PowerShell Toolkit 4.2 unifies all of NetApp’s PowerShell modules into a single package; The unified toolkit provides end-to-end automation and storage management across NetApp’s storage platforms of your datacenter and Hybrid Cloud – spanning 7-mode and clustered Data ONTAP running on FAS or AFF in your datacenter, ONTAP Select running on commodity hardware and ONTAP Cloud instances running on the public cloud. This release provides complete API coverage to ONTAP 9.0 and is backward compatible with previous ONTAP releases as well. NetApp PowerShell Toolkit 4.2 is compatible with Microsoft Windows Server 2016. Please download the new PowerShell ToolKit from here.

kodavali · ‎2014-03-19

SMB 3.0 is only available in cDot. As of now, Product Management does not have any plans to bring SMB 3.0 to 7-mode. - Chowdary

kodavali · ‎2014-03-11

Here the concern should be AD authentication (Kerberos). When we create CIFS server, it will register it as computer account in AD. If the end users use any alias apart from CIFS server name to access the shares, then the authentication fall back to NTLM. Kerberos authentication does not work. What is the rational behind using the DNS alias instead of CIFS server?

kodavali · ‎2014-02-24

By default windows sets the mapped dirve label with the associated path. Through GPO, we can set a label to the mapped drive under "Label as" option. Either you have to use the GPO or use logon script to map drive and rename it. Sample script on Microsoft site : http://gallery.technet.microsoft.com/scriptcenter/7dd02dca-d177-478b-9a20-d0210413ab2d

kodavali · ‎2014-02-16

the folder will be automatically created only when the user directly log on to the controller using domain credentials. If that is not the option, as long as the folder name is appropriately named as per the format you have chosen in the options cifs.home_dir_namestyle. If the option is not configured the default would be ntname and should the folder be the username then it will automatically mapped, but the folder should be there for mapping to be successful.

kodavali · ‎2014-02-10

this should work.

kodavali · ‎2014-02-06

1. homedirectory created for each user normally will have the same username as the directory under the searc_path. Share the search_path and extract the directory names and cross check randomly the directory name with the username in the permissions tab on the folder. 2. drive mapping has to be done from the AD. Storage can only facilitate the homedirectory space. In the migration scenario, if you can keep the new storage name (\\cifsservername) same as the old name, then you can avoid doing the re-mappings.

kodavali · ‎2014-02-06

there is no force user kind of functionality, but you can use -forcegroup" functionality for CIFS access. set the necessary permissions to the UNIX group on the directory or volume. configure that group as "-forcegroup" on the share.

kodavali · ‎2014-02-05

Hi David, most common cause of these errors during the CIFS server creation are : 1. time skew difference between the DC and the controllers : max accepted time skew difference is 5 min. if the difference is higher than that then we get no logon servers available error. 2. DNS configuration - either it is DNS server is taking longer time to respond to the queries or there is DNS name space disjoin issue. Regards, Chowdary

kodavali · ‎2014-02-05

Can you explain the scenario little more detailed? why do you want to add the computer account access to the NFS export? Please provide following information 1. volume/qtree security style of the NFS export 2. name mapping configuration 3. How does the access works? is that the windows sytem account which is trying to access the NFS export or any application running in system account is accessing the NFS export?

kodavali · ‎2013-09-27

Those machines are in same work-group, we still need to provide credentials because the credentials are not centralized. Workaround would be create same user:password on both controller and windows server. Windows 7 on wards, operating system has option to store the credentials so that wont be prompted for credentials in the subsequent access.

kodavali · ‎2013-09-27

in 8.2 clustered ontap we have local users and groups and that can be used in this scenario, but CIFS server has to be joined to the AD domain. Workgroup mode is planned for future release

kodavali · ‎2013-09-26

if one of the below licenses other than CIFS configured you can run CIFS setup and can access C$. iSCSI, FC NFS But the functionality is limited. for full CIFS features you need CIFS license.

kodavali · ‎2013-09-10

domain admin password change will not effect CIFS server. Admin password is only need while joining to AD. Once the computer account is created a corresponding account password will be created and will be authenticated by the computer account password when ONTAP contacts AD.

kodavali · ‎2013-08-21

SMB 3.0 is not available in 7-mode. This option should be set. cifs.smb2.signing.required off

kodavali · ‎2013-08-21

There are few things changed Windows 2012 1. Secure Negotiation - Enable SMB signing and check 2. SID Compression - Applies to the Windows 2012 DCs. Check the article http://support.microsoft.com/kb/2774190 SMB 1.0 will work because these doesn't come into picture when negotiated with SMB 1.0

kodavali · ‎2013-08-14

hope you have compared the settings between the filers. what is different on this filer? you can disable cifs.oplocks.enable and check.

kodavali · ‎2013-08-14

check the following options : wafl.default_unix_user pcuser cifs.guest_account pcuser cifs.LMCompatibilityLevel 1

kodavali · ‎2013-07-10

When you view the permissions of the share from the explorer you are seeing the security tab not the share permissions. You can use computer management to view the share permissions.

kodavali · ‎2013-07-09

Hi Regis, If Linux servers are already been authenticated by AD, why would you need name-mapping? Once you configure CIFS server AD DC is added as an LDAP server to the Vserver and LDAP schema configuration is setup automatically. What is the challenge here and Is there something I am missing here? - Chowdary.

kodavali · ‎2013-07-09

in 8.2 we have local users and groups. Probably you can use that remote office scenario.

kodavali · ‎2013-06-04

what is the lmcompatibility setting on the controller and the singing settings?

Re: Set-NcCIfsSecurity HELP

Re: Set-NcCIfsSecurity HELP

Re: Set-NcCIfsSecurity HELP

NetApp PowerShell Toolkit 4.2 released!

Re: ONTAP 8.2 with SMB 3.0

Re: Question on Vserver / CIFS server naming..

Re: Parenthetical UNC path is displayed in mapped AD home directory

Re: cifs homedir autocreate

Re: Creating Symbolic Links via RHEL 6.x on NetApp CIFS/SMB2 Mounted Filesystem

Re: How to check AD user who set home directory

Re: CIFS share root access / force user samba equivalent

Re: 8.2 C-Mode cifs create error message - MS_LSA

Re: Give a Windows machine account access to a NFS Share

Re: Workgroup authentication without prompt

Re: pass thru authentication

Re: CIFS not licensed but still able to access the c$

Re: What change must bedone on netapp filer if AD domain admin passwd changes

Re: SMB2 - Windows Server 2012 - System error 58 has occurred.

Re: SMB2 - Windows Server 2012 - System error 58 has occurred.

Re: Fix to remove locking of files in CIFS share

Re: Can mount nfs with read and write, Cant create or delete file in CIFS ?

Re: Permissions on CIFS Share

Re: winbind authentification

Re: Active Directory Authentication

Re: signed smb connection gives error: SPNEGO- NTLMSSP negotiation in wrong state