Dell Unity: SMB/CIFS Share Access Fails with Kerberos Tokens Over 16 KB

Summary: In Unity OE 5.2.0.0.5.173, users with Kerberos tokens larger than 16 KB may be unable to access SMB/CIFS shares hosted on a Unity NAS Server. The issue occurs when SMB authentication uses Kerberos and is caused by a defect in the SMB Session Setup process that incorrectly returns a STATUS_INVALID_PARAMETER error for large Kerberos tokens. The issue is resolved in Unity OE 5.2.1.0.5.013 (5.2 SP1). Until an upgrade can be performed, affected users may reduce their Kerberos token size, use NTLM authentication, or fail over to a Unity OE 5.1.x array if available. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

After upgrading the Unity system to OE 5.2.0.0.5.173, users with Kerberos authentication tokens larger than 16 KB may be unable to access SMB/CIFS shares hosted on a Unity NAS Server. When attempting to connect to the share, users may receive a Windows error indicating that the network path cannot be accessed, even though the NAS server and share are available.

Example error:

Windows cannot access \\nasservername\share

Check the spelling of the name. Otherwise, there might be a problem with your network.
To try to identify and resolve network problems, click Diagnose.

Cause

This issue occurs only when all of the following conditions are met:

  1. The Unity array is running Unity OE 5.2.0.0.5.173.
  2. SMB file access is configured to use Kerberos authentication.
  3. The affected user has a Kerberos token larger than 16 KB.


The problem is caused by a code change introduced in Unity OE 5.2.0.0.5.173 that impacts SMB Session Setup processing. During authentication, if the Kerberos token exceeds 16 KB, Unity incorrectly returns a STATUS_INVALID_PARAMETER error.


An additional validation check added in this release performs the parameter validation before determining whether the Kerberos token should be processed across multiple Session Setup requests. As a result, oversized Kerberos tokens are rejected prematurely, causing SMB authentication to fail and preventing access to the share.

Resolution

Fix

This issue is resolved in Unity OE 5.2.1.0.5.013. Upgrading to this release or a later version permanently addresses the problem.

 

Workarounds

If an immediate upgrade is not possible, consider one of the following workarounds:

  1. Reduce the Kerberos token size by removing unnecessary Active Directory group memberships and cleaning up unused SIDHistory entries.
  2. Use NTLM authentication for SMB access, for example by connecting to the SMB server using its IP address.
  3. Fail over to a disaster recovery (DR) array running Unity OE 5.1.x, if such an environment is available.


These workarounds can help restore SMB share access until the array can be upgraded to the fixed Unity OE release.

Affected Products

Dell EMC Unity, Dell EMC Unity Family |Dell EMC Unity All Flash, Dell EMC Unity Hybrid
Article Properties
Article Number: 000200086
Article Type: Solution
Last Modified: 22 يوليو 2026
Version:  16
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.