Skip to main content

Removing privileges from local or domain users or groups

You can manage user rights for local or domain users or groups by removing privileges. This provides enhanced security by allowing you to customize the maximum privileges that users and groups have.

Before you begin

The local or domain user or group from which privileges will be removed must already exist.

About this task

You must keep the following in mind when removing privileges from local or domain users or groups:

  • You can remove one or more privileges.

  • When removing privileges from a domain user or group, ONTAP might validate the domain user or group by contacting the domain controller.

    The command might fail if ONTAP is unable to contact the domain controller.

  1. Remove one or more privileges from a local or domain user or group: vserver cifs users-and-groups privilege remove-privilege -vserver vserver_name -user-or-group-name name -privileges privilege[,...]
  2. Verify that the desired privileges have been removed from the object: vserver cifs users-and-groups privilege show -vserver vserver_name ‑user-or-group-name name

Example​

The following example removes the privileges SeTcbPrivilege and SeTakeOwnershipPrivilege from the user CIFS_SERVER\sue on storage virtual machine (SVM, formerly known as Vserver) vs1:

cluster1::> vserver cifs users-and-groups privilege show -vserver vs1
Vserver   User or Group Name    Privileges
--------- --------------------- ---------------
vs1       CIFS_SERVER\sue       SeTcbPrivilege
                                SeTakeOwnershipPrivilege

cluster1::> vserver cifs users-and-groups privilege remove-privilege -vserver vs1 
-user-or-group-name CIFS_SERVER\sue -privileges SeTcbPrivilege,SeTakeOwnershipPrivilege

cluster1::> vserver cifs users-and-groups privilege show -vserver vs1
Vserver   User or Group Name    Privileges
--------- --------------------- -------------------
vs1       CIFS_SERVER\sue       -