Custom role with Remove-NcSnapshot returning error 403, but still deletes snapshots

DAU — Tue, 14 Oct 2025 23:46:26 GMT

I created a new role that should only have snapshot permissions to volumes ending with _stg:

security login role create -role stg-admin -vserver dc -cmddirname "volume" -access readonly
security login role create -role stg-admin -vserver dc -cmddirname "vserver" -access readonly
security login role create -role stg-admin -vserver dc -cmddirname "network interface" -access readonly
security login role create -role stg-admin -vserver dc -cmddirname "volume snapshot" -query "-volume *_stg" -access all

A new user with that role is not able to delete a random snapshot for vol1, but is able to delete snapshots from vol2_stg. So permissions are working properly. The problem is I'm getting "Remove-NcSnapshot : [403]: not authorized for that command" on both examples, even when it does successfully delete the vol2_stg vol snapshot. Am I missing a permission it's expecting even though it is successfully deleting them? Or is this a bug in NetApp.ONTAP module?

Re: Custom role with Remove-NcSnapshot returning error 403, but still deletes snapshots

chamfer — Wed, 15 Oct 2025 22:18:52 GMT

Hi @DAU ,

Can you advise what version of ONTAP you are using?

Re: Custom role with Remove-NcSnapshot returning error 403, but still deletes snapshots

DAU — Thu, 16 Oct 2025 15:02:37 GMT

We're on 9.15.1P11

topic Custom role with Remove-NcSnapshot returning error 403, but still deletes snapshots in Microsoft Virtualization Discussions

Custom role with Remove-NcSnapshot returning error 403, but still deletes snapshots

Re: Custom role with Remove-NcSnapshot returning error 403, but still deletes snapshots

Re: Custom role with Remove-NcSnapshot returning error 403, but still deletes snapshots