How do I fix CIFS on VNX after I messed up permisisons rather badly?

share permissions or folder permissions ?

If we're talking file level permissions you may want to consider using a robocopy /secfix option between a checkpoint and the source.. Something like this:

robocopy /secfix /xo /xn /xc

That should copy the security permissions without copying the data..  The only downside is you may lose any changes to security information which changed from checkpoint to live..

Dynamox:

I think I need to fix both.

Can we start with share permissions?  How do I fix those?

THANKS!

-Chris

you can use Windows MMC to connect to the CIFS server and modify share permissions there, for ACLs you use Mark's method or manually modify them.

Hi Dynamox:

For the "User" share, I was able to add users and give them full control under "Share Permissions" but no under "Security"

To see if this was a VNX wide issue I created a test share; on the test share I was able to add users and give them full control

I was able to connect to my VNX with MMC and was able to change share and security for a test share I created....

What should I do?

what do you see in security tab for User share or can you not even see anything ? Might have to take ownership and reset permissions.

Hi Dynamox,

I was worried that taking ownership under Windows would change ownership under NFS -- would it? -- so I didn't try.

Instead, I had EMC 2nd-level support reset the ACLs using:

.server_config server_2 "cifs update /HOME_01 resetacl"

.server_config server_2 "acl reset=/HOME_01"

.server_config server_2 "acl reset=/HOME_01/Users"

After that, share permissions were the same but at the top level (and perhaps below) directory, the trouble-some ACL had been removed and it was now set to Everyone = Full Access.

Thanks!

-Chris

Mark,

A perl script to fix ACLs would be awesome!

Any suggestions on how I should set the share permissions, ACLs on the share, and ACLs on the user home directories?

THANKS!

-Chris

Dynamox:

Access based enumeration sounds awesome -- how do I activate it for the share?

Thanks!

-Chris

Not sure this will help you,  but I have a perl quick which takes two files as arguments.  The first is a "source".  It when clones ACLs from source to target using ls -led and chmod...  Not sure if this could be adapted to fit your needs or not..

use AD groups as much as possible, also take a look at access based enumeration as it can simplify your share structure. It depends on your requirements/environment.

taking ownership would allow you to modify ACLs that you could not otherwise. Can you look at sub directories of Users, did it reset ACLs there as well ?

if you search support.emc.com you will find the utility (emcabe.exe) and the corresponding readme file that explains how to us it.