Skip to main content
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.

PowerScale: How to provide permissions to SMB shares when gMSA is not listed

Summary: Looking to provide SMB shares permission for group-managed services account (gMSA) on PowerScale. Not able to list gMSA to provide permissions to SMB shares in WebUI or CLI.

This article may have been automatically translated. If you have any feedback regarding its quality, please let us know using the form at the bottom of this page.

Article Content


Instructions

Have options to list normal users and group but no particular options for gMSA.

What is gMSA on Windows (in short)

A standalone Managed Service Account (sMSA) is a managed domain account that provides automatic password management, simplified service principal name (SPN) management, and the ability to delegate the management to other administrators. This type of managed service account (MSA) was introduced in Windows Server 2008 R2 and Windows 7.

The Group managed service accounts provides the same functionality within the domain but also extends that functionality over multiple servers. When connecting to a service hosted on a server farm, such as Network Load Balanced solution, the authentication protocols supporting mutual authentication require that all instances of the services use the same principal. When a gMSA is used as service principals, the Windows operating system manages the password for the account instead of relying on the administrator to manage the password.

For more information on Group managed service accounts refer to Group Managed Service Accounts Overview.

Workaround

Group managed service accounts are not similar to normal users. Get the Group managed service accounts usernames, they end with $ for example 'abc\user$'

To see the details of the Group managed service accounts use the below command:

#isi auth users view <Group managed service accounts user name>


To provide access to the group managed services account, use the below command:

#isi smb shares permission create sharename <Group managed service accounts user name> --permission-type=allow --permission=full --zone=<access zone names>
 

For example:- For Group managed service accounts user (abc\user$) for share xyz

#isi smb shares permission create xyz abc\user$ --permission-type=allow --permission=full --zone=<access zone names>


For NTFS level access (ACLs) use the usual 'chmod +a' command with the Group managed service accounts username fetched from the customer accordingly.

#chmod +a user abc\user$ allow dir_gen_all /ifs/data/test

Article Properties


Affected Product

PowerScale OneFS

Last Published Date

27 Jun 2023

Version

3

Article Type

How To