Data Domain: Troubleshooting CIFS Permission Issues

• Users receive "Access Denied" errors when connecting to CIFS shares.
• Backup jobs fail due to CIFS access issues.
• CIFS shares appear inaccessible from Windows clients.

CIFS permission issues can occur due to:

• Authentication failures (Kerberos or NTLM)
• Incorrect share-level permissions or client access restrictions
• Missing or misconfigured NTFS file permissions
• Replication targets enforcing read-only access

Troubleshooting CIFS permissions follows the same principles as Windows Server. Access behavior depends on the interaction between share permissions and file system permissions. If NTFS permissions are incorrect, adjust them using Windows Explorer. A Windows Domain Admin or an authorized user may be required to make these changes.

Follow these steps to troubleshoot CIFS permission issues:

1. Verify CIFS Authentication

   • Test connectivity without specifying a share:

     Start → Run → \\<ddr-hostname|or|IP
     

     • 
   • If the hostname works, Kerberos authentication is successful
   • If the IP address works, NTLM authentication is successful
     • If both work, add the share name to attempt access
   • If both fail, resolve authentication before proceeding

2. Check CIFS Share Permissions

   • On the DD-CLI, display share details:

     # cifs share show <share-name>
     For example:

     ## cifs share show sql
     Shares information for: sql
     --------------- share sql ---------------
     permissions: 1 ACE(s) have been set by MMC
     clients: *
     enabled: yes
     groups: techsupp\sales
     users: techsupp\abc
     maxconn: 0
     writeable: yes
     path: /data/col1/data/sql
     ##

   • Confirm:
     • Users/Groups have access
     • Clients list includes the correct hostnames/IPs
     • Path exists and is writable
   • Adjust permissions using Windows MMC:

     Computer Management → Shared Folders → Shares → Properties → Share Permissions
     

   • Only Domain Admins can modify share security settings.

3. Validate NTFS File Permissions

   • On Windows client:

     Right-click file/folder → Properties → Security tab
     Ensure required users/groups have appropriate access.

   • Check Replication Status

     • If the path is a replication target, it is read-only:

       # replication show config
       

     • To make writable, break replication:

       # replication break rctx://<context-number>
       

     • Perform this on both source and destination systems.

Important Notes:

• Do not mix CIFS and NFS data in the same folder.
• Do not share exports between CIFS and NFS.
  • Reference: Data Domain: Sharing exports between NFS and CIFS
• If the CIFS client is multihomed (has more than one IP address) make one or more of the following configuration changes:
  • Add both interfaces to the share access list
  • Add both DNS names to the share access list
  • Make routing changes on the client
  • Make hostname resolution changes

NTFS Permissions Overview

File Permissions:

• Full Control - Read, write, modify, execute, change attributes/permissions, and take ownership.
• Modify - Read, write, modify, execute, and change attributes.
• Read & Execute - View file data, attributes, owner, permissions, and run executable files.
• Read - Open and view file data, attributes, owner, and permissions.
• Write - Write or append data and change attributes.

Folder Permissions:

• Full Control - Read, write, modify, execute files, change attributes/permissions, and take ownership.
• Modify - Read, write, modify, execute files, and change attributes.
• Read & Execute - View folder contents, file data, attributes, owner, permissions, and run files.
• List Folder Contents - Display folder contents and file details.
• Read - View file data, attributes, owner, and permissions.
• Write - Write or append data and change attributes.

Ownership Management

Taking Ownership:

1. Right-click file/folder → Properties → Security → Advanced.
2. Go to Owner tab → Edit.
3. Select new owner; optionally apply to subfolders/files.
4. Click OK twice.

Assigning Ownership:

1. Open Properties → Security → Advanced → Owner tab → Edit.
2. Click Other Users or Groups, enter name, and Check Names.
3. Select new owner; optionally apply to subfolders/files.
4. Click OK twice.