topic Re: CIFS Share not accessible in ONTAP Discussions

CIFS Share not accessible

Divine — Wed, 04 Jun 2025 09:43:34 GMT

Hello.

Please i have an issue with one of the cifs share. We are unable to access it no matter what. When we run the "vserver security file-directory show" command, this is what displays, even though we've given "Everyone" access. We also added the domain admin credentials to the BUILTIN/administrators but it still won't give access.

vserver security file-directory show -vserver svm*********** -path /vol/Library_Project

Vserver: svm_**********
File Path: /vol/Library_Project
File Inode Number: 64
Security Style: ntfs
Effective Style: ntfs
DOS Attributes: 30
DOS Attributes in Text: ---AD---
Expanded Dos Attributes: -
UNIX User Id: 0
UNIX Group Id: 0
UNIX Mode Bits: 0
UNIX Mode Bits in Text: ---------
ACLs: NTFS Security Descriptor
Control:0x9504
Owner:BUILTIN\administrators
Group:BUILTIN\administrators
DACL - ACEs
DENY-Everyone-0x1f01ff-OI|CI
ALLOW-$$$$$$$$\#########-0x1f01ff-OI|CI
ALLOW-$$$$$$$$\#######-0x1301bf-OI|CI
ALLOW-$$$$$$$$\######-0x1f01ff-OI|CI
ALLOW-$$$$$$$$\######-0x1f01ff-OI|CI
ALLOW-$$$$$$$$\######-0x1301bf-OI|CI

Re: CIFS Share not accessible

Ontapforrum — Fri, 24 Nov 2023 11:59:55 GMT

Following output looks ok?

::> vserver cifs show

::> vserver cifs share show

Check the date/time of the NetApp filer

::>

Check the date/time of the Windows DC

Make sure the time is with-in 5 mnt difference.

Re: CIFS Share not accessible

Divine — Fri, 24 Nov 2023 13:00:07 GMT

Hi Ontapforum. Other cifs shares are accessible except this one. This is the only share giving us this problem.

Re: CIFS Share not accessible

Ontapforrum — Fri, 24 Nov 2023 13:56:51 GMT

Do you mind sharing screenshot of the error ? When you say only share giving problem, is it visible ? It is not visible at all ?

Can we see output of the CLI for the specific share ?

Re: CIFS Share not accessible

Divine — Fri, 24 Nov 2023 16:37:33 GMT

Hi, please see attached.

Re: CIFS Share not accessible

cedric_renauld — Sat, 25 Nov 2023 16:25:19 GMT

Hello,

Have you check @same time of access the event of the Ontep ?

event show

Re: CIFS Share not accessible

Divine — Sat, 25 Nov 2023 19:57:43 GMT

We will check and revert. Thanks!

Re: CIFS Share not accessible

Ontapforrum — Sat, 25 Nov 2023 20:56:24 GMT

Thanks for sharing the putty-output, CAUSE is clearly seen in the output of this command.
::> vserver security file-directory show -vserver svm_temssna002 -path /vol/Library_Project
UNDER DACL - ACEs:
DENY-Everyone-0x1f01ff-OI|CI <<-------Cause: DENY permissions will supersede any ALLOW permissions, no matter the user or group.

Workaround:
Since the DENY permission will prevent this, the DENY permission must be removed first. To resolve this issue, change the owner of the share to a user account (that has MODIFY or FULL CONTROL), not a group, then remove the DENY permission from EVERYONE. That should fix the issue.

Re: CIFS Share not accessible

Divine — Sat, 25 Nov 2023 21:33:39 GMT

Thanks, Ontapforrum. We will try this first thing Monday morning. However, if you don't mind, can you share the command to change the owner of the share?

Re: CIFS Share not accessible

Ontapforrum — Sun, 26 Nov 2023 18:27:23 GMT

No worries.

To be honest, It's a very tricky situation, I don't know what was the need for 'deny' to be in the security group permissions, it is dangerous, simply b'cos it takes precedence.

In any case, you might have to try these steps:

1) Take ownership of the share

Windows cmd promt (admin rights):
\>takeown /F x:\path\to\share
2) Remove 'deny'.
If the step 1 succeeds, right-click on the share, properties, select 'security tab', click advanced, change permissions, then select 'deny' and click 'remove'.

or
Try with ONTAP CLI
https://docs.netapp.com/us-en/ontap-cli-97/vserver-security-file-directory-ntfs-dacl-remove.html#description

In none works and you keep getting permission denied, then might want to just delete the share/volume and recreate one if there was no data. If there was data, you might want to just vol copy/mirror to another volume and then re-create the share and permissions. [Avoid deny in future]

Re: CIFS Share not accessible

Divine — Mon, 27 Nov 2023 15:14:13 GMT

Thank you, Ontapforrum. It worked! We used a different admin account to take ownership of the share/file and we removed "deny".

Re: CIFS Share not accessible

Ontapforrum — Mon, 27 Nov 2023 16:38:55 GMT

Great stuff. Well done. Thanks for the update.