Storage Admin HubConfiguration · Protection · Recovery
All guides/NAS
NAS · ONTAP 9

Configure SMB and Active Directory

DNS, domain join, share, ACLs, and client validation.

Scenario

Example: SVM svm_files, SMB server FILES01, share \FILES01\Projects. Use your own domain, OU, service account and naming convention.

Before you change production

Commands and screens can differ by release and platform. Replace example names and documentation IP addresses. Check prerequisites, impact, current health and rollback with your change owner.

1. Prove AD prerequisites

  1. Configure SVM DNS to resolve AD domain controllers and SRV records. Verify network routes, required ports, time synchronization, and a permitted domain-join identity.
  2. Choose the SVM security style and identity mapping strategy. Decide who can administer SMB shares and file ACLs.
Read-only checks 
vserver services name-service dns show
network interface show
vserver cifs show

2. Create server and share

  1. In System Manager, enable SMB on the SVM, provide the SMB server name and AD domain, and join the approved OU using authorized credentials. Verify domain join before exposing a share.
  2. Create a volume with the intended security style and junction path. Create a share that targets that path. Set share permissions and file-system ACLs separately; effective access is constrained by both.
  3. Test from a domain-joined client using the UNC path. Confirm DNS points to the intended data LIF and a named test user can read/write only as intended.
Read-only validation 
vserver cifs show
vserver cifs share show
volume show -fields junction-path,security-style

3. Diagnose access denied

  1. Check name resolution and SMB connection first. Then review domain trust, account/group membership, share ACL, NTFS ACL or UNIX mapping, and any access-based enumeration.
  2. Compare an allowed and denied user on the same client and path. Record the exact error and time, then inspect ONTAP and AD events rather than widening the share to Everyone.
Verify

Authorized user reaches the share and performs the required operation; denied user remains denied.

If validation fails

  1. A name-resolution error should be isolated before ACL work. Compare the client DNS answer with the SVM data LIF and confirm the SMB server name.
  2. A domain-join or authentication error requires checking SVM DNS, time, domain controller reachability and account status. Capture the exact event instead of retrying with a privileged account.
  3. If only one folder fails, compare share ACL with NTFS ACL and inheritance at the target path. Test with the actual user token and group memberships.
Verify

Re-run the original validation and record the observed result, exact error, time, and corrective action.

NetApp references