Skip to main content

How ONTAP uses local users and groups

When configuring and using local users and groups, you must understand what they are and how they are used. For example, you can use local users and groups to provide share and file-access security to data residing on the storage virtual machine (SVM). You can also assign user management rights to users through the use of local users and groups.

  • Local users and groups concepts
    You should know what local users and groups are, and some basic information about them, before determining whether to configure and use local users and groups in your environment.
  • Reasons for creating local users and local groups
    There are several reasons for creating local users and local groups on your storage virtual machine (SVM). For example, you can access an SMB server by using a local user account if the domain controllers (DCs) are unavailable, you might want to use local groups to assign privileges, or your SMB server is in a workgroup.
  • How local user authentication works
    Before a local user can access data on a CIFS server, the user must create an authenticated session.
  • How user access tokens are constructed
    When a user maps a share, an authenticated SMB session is established and a user access token is constructed that contains information about the user, the user's group membership and cumulative privileges, and the mapped Linux user.
  • Guidelines for using SnapMirror on SVMs that contain local groups
    You should be aware of the guidelines when you configure SnapMirror on volumes owned by SVMs that contain local groups.
  • What happens to local users and groups when deleting CIFS servers
    The default set of local users and groups is created when a CIFS server is created, and they are associated with the storage virtual machine (SVM) hosting the CIFS server. SVM administrators can create local users and groups at any time. You need to be aware of what happens to local users and groups when you delete the CIFS server.
  • How you can use Microsoft Management Console with local users and groups
    You can view information about local users and groups from the Microsoft Management Console. With this release of ONTAP, you cannot perform other management tasks for local users and groups from the Microsoft Management Console.
  • Guidelines for reverting
    If you plan to revert the cluster to an ONTAP release that does not support local users and groups and local users and groups are being used to manage file access or user rights, you must be aware of certain considerations.