Snaplock Privilegd delete.

[asdfly3054]

Hi All,

     I am trying the Snaplock feature in Netapp simulator storage. 

     I get the process to create Enterprise WORM folder, Audit Log and privileged delete account.

     But I have a question about the system administrator and vsadmin-snaplock.

     1. In order the prevent system administrator has too much power to delete the WORM file in Enterprise mode. So, we have to create another account has privileged delete the WORM file. Is it the major purpose to separate the system administrator and vsadmin-snaplock acccount?

     2. If yes, there is no any method can prevent system administrator to create a vsadmin-snaplock account or modify the password of vsadmin-snaplock account. It means that administrator can do the privileged delete when he wanted. Is it right?

      I know the audit log will save all the process. But the log is just for record, it can not prevent the wrong happen.

      Do you know if there is any manner can prevent administrator to create or modify vsadmin-snaplock account in anytime?

Thanks,

Billy

[Sahana · Accepted solution]

Hi,

1-Yes, 2-Administrator has the ability to assign rights. Refer http://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.pow-arch-con%2FGUID-6226EB59-EF12-4D3D-A7B9-6B6407DE77C7.html

Administrator is a pre defined role, not sure if it allows to restrict modifying a user account.

[thokelly]

Billy,

how did you manage to create the Audit log on an SL Enterprise volume? Is ist SLE at all?

I am failing here, I cannot create the Audit log on an SLE volume, it wants me to create it on an SL Compliance volume...

/

Tom

See my post here:

https://community.netapp.com/t5/Data-ONTAP-Discussions/Create-audit-log-on-Snaplock-Enterprise-volume-fails/m-p/138600/highlight/false#M30579