Isilon: SMB: Failed to enumerate open sessions or open files

Summary: Getting various errors while executing isi smb sessions or isi smb openfiles commands via OneFS command line

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

"root" user/account is created on the AD side and possibly disabled or locked.

Some isi smb commands could fail if "root" user/account exists on the AD side and "Assume Default Domain" is being used or a mapping rule that join/replace the local users with domain users.
  • Examples:
# isi smb openfiles list
Failed to enumerate open files: ERROR_GEN_FAILURE
Or 
Failed to enumerate open files: Access is denied
Or
Failed to enumerate open files: ERROR_ACCOUNT_DISABLED

# isi smb sessions list
Failed to enumerate open sessions: Access is denied
Or 
Failed to enumerate open sessions: ERROR_GEN_FAILURE
Or
Failed to enumerate open sessions: ERROR_ACCOUNT_DISABLED
 
  • Verification Steps:
    1. Search for "root" user in the AD:
# isi auth users view <AD>\\root
Ex: # isi auth users view isilon\\root
                    Name: ISILON\root
                      DN: CN=root,CN=Users,DC=isilon,DC=local
              DNS Domain: isilon.local
                  Domain: ISILON
                Provider: lsa-activedirectory-provider:ISILON.LOCAL
        Sam Account Name: root
                     UID: 0
                     SID: S-x-x-x-x-x-x-x
                 Enabled: No <<< Account is disabled
                 Expired: No
                  Expiry: -
                  Locked: No
                     UPN: root@ISILON.LOCAL
 
         2. Check the AD settings: 
# isi auth ads list -v  | grep -i "Assume Default Domain"
    Assume Default Domain: Yes
 
         3. Check the existing mapping rules: 
 # isi zone zones view system
                       Name: System
                       Path: /ifs
                   Groupnet: groupnet0
              Map Untrusted: 
             Auth Providers: lsa-local-provider:System, lsa-file-provider:System, lsa-activedirectory-provider:ISILON.LOCAL
               NetBIOS Name: 
         User Mapping Rules: isilon\* &= * [], * => isilon\* []

Cause

The "root" account is disabled or locked on the AD side. 
Errors logged in lsassd.log:
# tail /var/log/lsassd.log 
  lsass[39553]: [lsass] Failed to find group memberships of SID=S-1-5-21-x-x-x. [error code:40056] [Symbol: LW_ERROR_ACCOUNT_DISABLED]
  lsass[39553]: [lsass] Failed to find memberships for 'ISILON\root' (error = 40056)

Resolution

Workarounds: 
  1. Prevent isilon from searching for "root" user in the AD then flush the cache (preferable): 
# isi auth ads modify <AD> --restrict-findable=yes --add-unfindable-users=<AD>\\root
Ex: # isi auth ads modify isilon.local --restrict-findable=yes --add-unfindable-users=isilon\\root
# isi auth cache flush --all ; isi auth mapping flush --all   

        2. Delete or Enable user "root" account on the AD side.

Affected Products

Isilon, PowerScale OneFS
Article Properties
Article Number: 000081169
Article Type: Solution
Last Modified: 18 أبريل 2026
Version:  6
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.