topic Re: Preventing access from some Windows clients to a CIFS share in Network and Storage Protocols

Preventing access from some Windows clients to a CIFS share

REGIS_GARRUCHET — Thu, 05 Jun 2025 06:25:13 GMT

Hi,

IHAC who needs to narrow acces to some shares from only a few Windows clients.

The behavior they want is the same as for a NFS mount only available to some NFS clients.

This Netapp controller is NTFS-only, so there is only NTFS qtrees and no unix right anywhere.

What is available today on their controller:

- every share has some security ACL specifying users and groups who can acces the share.

- the issue is that shares are available from any Windows client in the domain

What theyr would like:

- For some shares, they want only some PCs to have access to the share.

Anyone has an idea ?

Best regards,

Regis

Re: Preventing access from some Windows clients to a CIFS share

SUDHEER_H21 — Wed, 13 Jun 2012 20:08:59 GMT

Hi,

You have a CIFS share option: cifs.enable_share_browsing. It's ON by default. This feature when turned off, prevents users from seeing directories they do not have permission to access. Please let me know if this works.

Cheers,

Sudheer.

Re: Preventing access from some Windows clients to a CIFS share

scottgelb — Wed, 13 Jun 2012 20:15:16 GMT

You can also enable per cifs share with cifs shares –change share -accessbasedenum

Re: Preventing access from some Windows clients to a CIFS share

kodavali — Thu, 14 Jun 2012 06:57:19 GMT

I believe you are looking to restrict the access to the share from some client PCs even though the user logged in has access to it. unfortunately, you cannot apply client based restrictions on the shares. Windows allows user based restrictions so is OnTAP.

Otherway is to restric the users who has access to the shares loging into those client machines through local access in the security policy but not share base.

Re: Preventing access from some Windows clients to a CIFS share

REGIS_GARRUCHET — Thu, 14 Jun 2012 07:04:39 GMT

@Scott and Sudheer

Hi,

The goal was to restrict access of the share to only some PCs, so a user can acces to the share from PC1 but can not from PC2.

So "cifs shares" command or "cifs access" commands are no help here, neither is the browsing option.

Regis

Re: Preventing access from some Windows clients to a CIFS share

REGIS_GARRUCHET — Thu, 14 Jun 2012 07:07:46 GMT

Thank you kodavali,this what I try to do.

I was thinking using the "IP-qual" tag in the usermap.cfg file but I think it won't help here since it is a ntfs-only filer.

So I will say to the customer, it is not possible due to CIFS limitation.

Regis

Re: Preventing access from some Windows clients to a CIFS share

stjerna — Thu, 14 Jun 2012 13:14:19 GMT

Probably not something that helps you right nw but might be good to know for the future:

This can be done in Data ONTAP Cluster-Mode using export policies - these works for all file protocols.

--erik

Re: Preventing access from some Windows clients to a CIFS share

REGIS_GARRUCHET — Thu, 14 Jun 2012 15:08:07 GMT

@sterna

You're right: it might be useful in the future. This customer has an old filer running ONTAP 7.3.6 and won't update it before they buy another one.

Regis

Re: Preventing access from some Windows clients to a CIFS share

GLENYU5820 — Mon, 18 Mar 2013 23:36:51 GMT

Hi Regis,

I think you might have solution till now.

export-policy is for IP access limitation, you can create/apply it at the vserver or volume level.

ACL is for user id level limitation.

Thanks

Glen