topic Re: Delegating CIFS Rights in Network and Storage Protocols

Delegating CIFS Rights

bsmitty23 — Thu, 05 Jun 2025 07:10:36 GMT

Hi All,

We've recently migrated our Shared drives to CIFS shares on our filers, and everything has been working great, except allowing our Helpdesk and Network Admins to admins to close open files. I don't want to give rights to fully administor shares on the filers, just be able to view and close open files on the existing shares. I also have multiple AD Groups I need to give rights to, so I'd like to link AD Groups to a local group on the filer with proper rights. Whatever works though.

Thanks

Re: Delegating CIFS Rights

chriskranz — Thu, 12 Aug 2010 21:13:12 GMT

Not sure I can offer you a full solution.

You can link AD groups to the filer for administration once it is joined to the domain, however for these users to be able to authenticate, they need to exist on the filers local user database (although all authentication is done against AD). I believe you can assign additional user groups that can administer the filer when you run a CIFS setup, but I've never actually had to do this myself as domain admins have always been enough. You may be able to give additional groups admin rights so that they can use Computer Manager to manage the filer, but not logon to it.

As for allowing certain users access to close open files, I'm not sure you can be that granular. You can certainly limit users to specific commands (role based access control), and you can have admin users that don't have command line access to the system at all. But if they administer the filer through Computer Manager, I'm not sure you can restrict them enough. They may still have access to create / delete CIFS shares and change permissions, which you probably wouldn't want.

I think you could achieve fairly close to what you want, but I don't think it would be a fully granular solution. You'd need to put it through some tests and trials.

Sorry, not a perfect answer for you, but hopefully puts you on the right direction.

Re: Delegating CIFS Rights

aborzenkov — Fri, 13 Aug 2010 05:21:21 GMT

I don't want to give rights to fully administor shares on the filers, just be able to view and close open files on the existing shares.

Could you explain or give reference to how to do it on Windows? It may give hints how to implement the same on filer. At this point I am not aware of any way to it on Windows either.

Re: Delegating CIFS Rights

aborzenkov — Fri, 13 Aug 2010 05:23:29 GMT

No, that's not correct. You can add domain group to local group and any user belonging to domain group will have whatever rights local group has. There is no need to create local accounts for it.

Re: Delegating CIFS Rights

chriskranz — Fri, 13 Aug 2010 08:34:23 GMT

Sorry, I meant for CLI admin access.

Re: Delegating CIFS Rights

bsmitty23 — Fri, 13 Aug 2010 11:52:44 GMT

In Windows, it would be done through Computer Management --> Shared Folders --> Open Files. This is the only access they need, nothing on the filer in regards to creating the shares. Ideally, I could create a group on the filer, assign it the proper rights, and add my domain groups into this local group on the filer.

Thanks for the replies guys, hopefully can get this sorted out.

Re: Delegating CIFS Rights

chriskranz — Fri, 13 Aug 2010 11:54:43 GMT

And you can do exactly the same technique with the NetApp.

But in Windows, how would you limit those users from doing other admin tasks on that system (such as editing shares) through the same interface?

Re: Delegating CIFS Rights

bsmitty23 — Fri, 13 Aug 2010 12:39:27 GMT

We gave them Power User access on the server, which was still alright as far as what they were allowed to do. The problem is that on the Filer, it appears the Power User group will have access to create shares and potentially link to volumes that we don't want for CIFS. I'm very comfortable how the CIFS Shares work, I just need to basically assign them rights that the Power Users have, minus a few options. I'm not sure how to accomplish this.

Re: Delegating CIFS Rights

markryanwillis — Fri, 28 Oct 2011 02:48:31 GMT

I was looking into this answer myself and seems this is not resolved on this thread. I have basically allowed only rsh login on a role I assigned to a local group that has the Domain Users for which I want to close open files. Seems to be working...

Re: Delegating CIFS Rights

chens — Wed, 30 Jan 2013 08:43:41 GMT

Hi,

i'm looking for the same thing , i want to give the helpdesk the option to close open files on a netapp cifs share. i'm looking for a group role/RBAC to create on the netapp storage, since they need permissions on the NetApp storage side.

Thanks

Chen