AFF/FAS FlexVol · domain-joined SMB · NTFS-security volume
Illustrative lab: svm_files has a reachable SMB data LIF, FILES01 will join ad.example.com, and Projects will expose /projects. EXAMPLE\ProjectEditors may change files, while EXAMPLE\ProjectReaders may only read them. Use groups from the actual domain rather than literal example names.
About the command and output examples
Names, addresses and results are illustrative. Commands have not been executed against a live storage system or SAN switch for this publication. Confirm syntax and compatibility for your release, then rehearse in an approved lab. Existing-data recovery and destructive changes need an environment-specific plan. Read the editorial standards.
01Prove DNS, time and the join identity
Joining an SVM to AD creates a server identity in the directory. A client ping to the data LIF is insufficient: the SVM must resolve and contact appropriate domain controllers, and Kerberos depends on time and naming. Keep the join account separate from the account that later administers files.
| Dependency | Evidence to collect |
|---|---|
| DNS | SVM DNS server list and domain/DC resolution result |
| Time | Synchronized cluster time and reachable NTP servers |
| AD rights | Approved OU and delegated join identity |
| Client naming | FILES01 record resolves to the intended SMB data LIF |
- Choose AD DNS servers and confirm that the domain and its service records resolve through them. Verify routes and the AD network ports required by your documented domain design.
- Check cluster time synchronization. Arrange an account delegated to create the computer object in the selected OU; do not substitute a domain administrator account as the default solution to a failed join.
- Record the server name, FQDN, OU, domain NetBIOS name, data LIF and expected DNS record. Keep credentials out of the change record.
vserver services name-service dns show -vserver svm_files
cluster time-service ntp server show
network interface show -vserver svm_files
vserver cifs show -vserver svm_files02Join the SMB server and verify its state
- Create the SMB server using the fully qualified AD domain name. The command prompts for authorized credentials; enter them interactively or use a separately approved keytab workflow. Do not include a password in a script.
- Wait for the join to finish. Verify the domain, server name and administrative status. Have the AD owner verify the computer object and DNS record. If the join fails, preserve the exact error and inspect the failing prerequisite before retrying.
vserver cifs create -vserver svm_files -cifs-server FILES01 -domain ad.example.com
vserver cifs show -vserver svm_filesFILES01 is joined to the intended domain and the client resolves its intended data address.
03Create the volume and control the share boundary
Use NTFS security for this Windows-focused example. Share access is an outer permission boundary; the filesystem ACL remains necessary for each folder and file. Enabling access-based enumeration can hide a folder from a user, but hiding is not an authorization control.
| Group | Share goal | NTFS goal | Expected test |
|---|---|---|---|
| ProjectEditors | Change | Modify on approved project folder | Create, edit and delete a test file |
| ProjectReaders | Read | Read and execute | Read succeeds; file creation is denied |
| File administrators | Approved administration rights | Manage ACL and recovery as authorized | ACL review and ownership procedures work |
- Create a dedicated online volume at /projects. Verify aggregate physical headroom before assigning a lab size.
- Create the share pointing to that junction. Inspect the resulting share ACL immediately. Remove a broad default entry only after adding and validating the intended administration and application groups, so you retain authorized administration access.
- Use an approved administrative identity to set the NTFS ACL on the share root. For this example, ProjectEditors receives Modify, ProjectReaders receives Read, and the approved file-administration group retains administration rights. Review inheritance and any explicit Deny entries.
volume create -vserver svm_files -volume vol_projects -aggregate aggr_data -size 100GB -security-style ntfs -junction-path /projects
vserver cifs share create -vserver svm_files -share-name Projects -path /projects
vserver cifs share access-control show -vserver svm_files -share Projects
volume show -vserver svm_files -volume vol_projects -fields junction-path,security-style04Validate from Windows as both allowed and denied users
- Resolve the server name and test TCP 445. Prefer the planned DNS/UNC name for authentication testing; an IP-based UNC can take a different authentication path.
- Open the UNC using a reader account and then an editor account in separate authorized sessions. Reconnecting may be required after group membership changes because an existing session can carry an earlier token.
- Inspect filesystem permissions for the exact directory. Test a small disposable file; do not use an administrator account as proof that normal users are authorized.
Resolve-DnsName FILES01.ad.example.com
Test-NetConnection FILES01.ad.example.com -Port 445
Get-SmbConnection
# Run from an authorized Windows session with the actual UNC
Get-Acl '\\FILES01\Projects' | Format-ListReader can read and cannot write. Editor can create, change and delete the test file. A user outside both groups is denied.
05Diagnose an access failure at the correct layer
Worked diagnosis: ProjectEditors has Change on the share, but the target folder inherited an NTFS Read-only permission set. Authentication and the share are functioning. A targeted NTFS ACL correction on the intended folder resolves the create operation; a broad Everyone share grant would leave the original filesystem restriction and introduce unnecessary exposure.
| Observed failure | Compare | Narrow response |
|---|---|---|
| Server name does not resolve | Client DNS result vs planned LIF | Correct the approved DNS record or resolver. |
| TCP 445 fails | Route/firewall and LIF state | Fix the network path before changing ACLs. |
| All users fail authentication | AD status, time, DC availability and trust | Repair the failing dependency; retain logs. |
| One user cannot open one folder | User token, nested groups and effective NTFS ACL | Correct that folder or group assignment as approved. |
| Browsing works but creating a file fails | Share Change/Read and NTFS Modify/Read | Identify the permission boundary denying writes. |
| Files open slowly after scanning rollout | Vscan/FPolicy servers and matching scope | Correlate server delay rather than widening file ACLs. |
06Rehearse recovery and document the published service
- Record the share path, SVM, volume, groups, root ACL and DNS entry. Link the service to its Snapshot and off-cluster recovery procedures.
- For a failed pilot, remove or disable only the pilot share after clients disconnect, then restore the prior ACL and DNS state as recorded. Do not delete a joined production SMB server to fix a share-specific incident.
- Re-test user operations and application file opens after a restore drill or maintenance window; server state alone is not an application acceptance test.
Handover includes a validated access matrix, recovery owner and exact original/rollback configuration.
Use the section links to revisit a step, or follow a related guide below.
Official references and further reading
Choose the matching release in the vendor documentation before using a command or design. References open on the publisher’s website; linked material remains with its publisher.