topic Re: ONTAP 9.9.1P7 Cifs Setup in new SVM failed in ONTAP Discussions

ONTAP 9.9.1P7 Cifs Setup in new SVM failed

KPKarthik1 — Wed, 04 Jun 2025 10:02:04 GMT

when we tried to setup CIFS in a new svm it fails please find the bellow error. we already have 4 SVM's running cifs on this cluster. recently we upgraded from 9.7P17 to 9.9.1P7

ibmnas2117::> vserver cifs create -cifs-server Deibmsvi10059 -vserver svm_Dehensvj72 -domain hengroup.net -ou OU=Filer,OU=servers,OU=DE,OU=Units -default-site "" -status-admin up

In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of a Windows account with sufficient
privileges to add computers to the "OU=Filer,OU=servers,OU=DE,OU=Units" container within the "hengroup.net" domain.

Enter the user name: XXXX

Enter the password:

Warning: An account by this name already exists in Active Directory at CN=DEIBMSVI10059,OU=Filer,OU=servers,OU=DE,OU=Units,DC=henkelgroup,DC=net.
If there is an existing DNS entry for the name DEIBMSVI10059, it must be removed. Data ONTAP cannot remove such an entry.
Use an external tool to remove it after this command completes.
Ok to reuse this account? {y|n}: y

Error: Machine account creation procedure failed
...
[ 3908] SID to name translations of Domain Users and Admins
completed successfully
[ 3937] Modified account 'cn=DEIBMSVI10059,OU=Filer,OU=servers,OU=
DE,OU=Units,dc=HENKELGROUP,dc=NET'
[ 3942] Successfully connected to ip 139.3.202.61, port 88 using
TCP
[ 3964] Successfully connected to ip 139.3.202.61, port 464 using
TCP
[ 3976] Kerberos password set for
'DEIBMSVI10059$@hengroup.net' succeeded
[ 3976] Set initial account password
[ 4006] Successfully connected to ip 139.3.202.61, port 445 using
TCP
[ 4026] Successfully connected to ip 139.3.202.61, port 88 using
TCP
[ 4094] CIFS server account password does not match password
stored in Active Directory (KRB5KDC_ERR_PREAUTH_FAILED)
[ 4094] Failed to initiate Kerberos authentication. Trying NTLM.
[ 4099] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED)
for SMB command SessionSetup
[ 4115] Encountered NT error (NT_STATUS_AUTH_LOGON_FAILURE) for
SMB command SessionSetup
[ 4128] Successfully connected to ip 139.3.202.61, port 88 using
TCP
[ 4194] CIFS server account password does not match password
stored in Active Directory (KRB5KDC_ERR_PREAUTH_FAILED)
[ 4194] Failed to initiate Kerberos authentication. Trying NTLM.
[ 4200] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED)
for SMB command SessionSetup
[ 4219] Encountered NT error (NT_STATUS_AUTH_LOGON_FAILURE) for
SMB command SessionSetup
[ 4219] Unable to connect to NetLogon service on
dedussvpdc01.hengroup.net (Error:
RESULT_ERROR_GENERAL_FAILURE)
**[ 4220] FAILURE: Unable to make a connection
** (NetLogon:hengroup.net), result: 3
[ 4220] Unable to make a NetLogon connection to
dedussvpdc01.hengroup.net using the new machine
account

Error: command failed: Failed to create the Active Directory machine account "DEIBMSVI10059". Reason: general failure.

The SPN is resolving and DNS entries and machine account are already created

Re: ONTAP 9.9.1P7 Cifs Setup in new SVM failed

Mjizzini — Wed, 13 Apr 2022 09:00:40 GMT

Delete the existing machine account "DEIBMSVI10059" from OU=Filer, OU=servers, OU=DE, OU=Units,DC=henkelgroup,DC=net.

Re: ONTAP 9.9.1P7 Cifs Setup in new SVM failed

KPKarthik1 — Wed, 13 Apr 2022 09:12:27 GMT

even i tried it but didn't succeed

ibmnas2117::> vserver cifs create -cifs-server Deibmsvi10059 -vserver svm_dehensvj72 -domain hengroup.net -ou OU=Filer,OU=servers,OU=DE,OU=Units -default-site "" -status-admin up

Enter the user name: xxxx

Enter the password:

Error: Machine account creation procedure failed
[ 12943] Loaded the preliminary configuration.
[ 15143] Created a machine account in the domain
[ 15143] SID to name translations of Domain Users and Admins
completed successfully
[ 15240] Successfully connected to ip 10.23.19.28, port 88 using
TCP
[ 15640] Successfully connected to ip 10.23.19.28, port 464 using
TCP
[ 15742] Kerberos password set for
'DEIBMSVI10059$@hengroup.net' succeeded
[ 15742] Set initial account password
[ 16142] Successfully connected to ip 10.23.19.28, port 445 using
TCP
[ 16534] Successfully connected to ip 10.23.19.28, port 88 using
TCP
[ 18373] Unknown user (KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN)
[ 18373] Failed to initiate Kerberos authentication. Trying NTLM.
[ 18566] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED)
for SMB command SessionSetup
[ 18761] Encountered NT error (NT_STATUS_AUTH_LOGON_FAILURE) for
SMB command SessionSetup
[ 19055] Successfully connected to ip 10.23.19.28, port 88 using
TCP
[ 20896] Unknown user (KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN)
[ 20896] Failed to initiate Kerberos authentication. Trying NTLM.
[ 21087] Encountered NT error (NT_STATUS_MORE_PROCESSING_REQUIRED)
for SMB command SessionSetup
[ 21282] Encountered NT error (NT_STATUS_AUTH_LOGON_FAILURE) for
SMB command SessionSetup
[ 21282] Unable to connect to NetLogon service on
usrhlsvpdc02.hengroup.net (Error:
RESULT_ERROR_GENERAL_FAILURE)
**[ 21282] FAILURE: Unable to make a connection
** (NetLogon:hengroup.net), result: 3
[ 21282] Unable to make a NetLogon connection to
usrhlsvpdc02.hengroup.net using the new machine
account
[ 21584] Deleted existing account
'CN=DEIBMSVI10059,OU=Filer,OU=servers,OU=DE,OU=Units,DC=he
nkelgroup,DC=net'

Error: command failed: Failed to create the Active Directory machine account "DEIBMSVI10059". Reason: general failure.

Re: ONTAP 9.9.1P7 Cifs Setup in new SVM failed

Mjizzini — Wed, 13 Apr 2022 09:49:50 GMT

It could be related to Microsoft CVE-2021-42287 Authentication Updates.

How does KB5008380 Microsoft CVE-2021-42287 Authentication Updates in Enforcement mode impact ONTAP 9 CIFS Operations

Re: ONTAP 9.9.1P7 Cifs Setup in new SVM failed

KPKarthik1 — Thu, 12 May 2022 10:16:11 GMT

Hello All

After Enabling aes encryption in Vserver. SVM CIFS setup was successful

vserver cifs security modify -vserver svmname -is-aes-encryption-enabled true