Guidelines for applying file-directory policies that use local users or groups on the SVM disaster recovery destination

Guidelines for identity discarded configurations​

In an identity discarded configuration, for an SVM source that contains local user, group, and privilege configurations, the name of the local domain (local CIFS server name) must be changed to match the CIFS server name on the SVM destination. For example, if the source SVM name is vs1 and CIFS server name is CIFS1, and the destination SVM name is vs1_dst and the CIFS server name is CIFS1_DST, then the local domain name for a local user named CIFS1\user1 is automatically changed to CIFS1_DST\user1 on the destination SVM:

cluster1::> vserver cifs users-and-groups local-user show -vserver vs1_dst
  
Vserver      User Name                Full Name      Description
------------ ------------------------ -------------- -------------
vs1          CIFS1\Administrator                     Built-in administrator account
vs1          CIFS1\user1              -              -

cluster1dst::> vserver cifs users-and-groups local-user show -vserver vs1_dst
  
Vserver      User Name                Full Name      Description
------------ ------------------------ -------------- -------------
vs1_dst      CIFS1_DST\Administrator                 Built-in administrator account
vs1_dst      CIFS1_DST\user1          -              -

Even though local user and group names are automatically changed in the local user and group databases, local users or group names are not automatically changed in file-directory policy configurations (policies configured on the CLI using the vserver security file-directory command family).

For example, for vs1, if you have configured a DACL entry where the -account parameter is set to CIFS1\user1, the setting is not automatically changed on the destination SVM to reflect the destination's CIFS server name.

cluster1::> vserver security file-directory ntfs dacl show -vserver vs1
  
Vserver: vs1
  NTFS Security Descriptor Name: sd1

    Account Name     Access   Access             Apply To
                     Type     Rights
    --------------   -------  -------            -----------
    CIFS1\user1      allow    full-control      this-folder

cluster1::> vserver security file-directory ntfs dacl show -vserver vs1_dst
  
Vserver: vs1_dst
  NTFS Security Descriptor Name: sd1

    Account Name     Access   Access             Apply To
                     Type     Rights
    --------------   -------  -------            -----------
    CIFS1\user1          allow    full-control      this-folder

You must use the vserver security file-directory modify commands to manually change the CIFS server name to the destination CIFS server name.

File-directory policy configuration components that contain account parameters​

There are three file-directory policy configuration components that can use parameter settings that can contain local users or groups:

• Security descriptor

  You can optionally specify the owner of the security descriptor and the primary group of the owner of the security descriptor. If the security descriptor uses a local user or group for the owner and primary group entries, you must modify the security descriptor to use the destination SVM in the account name. You can use the vserver security file-directory ntfs modify command to make any necessary changes to the account names.

• DACL entries

  Each DACL entry must be associated with an account. You must modify any DACLs that use local user or group accounts to use the destination SVM name. Because you cannot modify the account name for existing DACL entries, you must remove any DACL entries with local users or groups from the security descriptors, create new DACL entries with the corrected destination account names, and associate these new DACL entries with the appropriate security descriptors.

• SACL entries

  Each SACL entry must be associated with an account. You must modify any SACLs that use local user or group accounts to use the destination SVM name. Because you cannot modify the account name for existing SACL entries, you must remove any SACL entries with local users or groups from the security descriptors, create new SACL entries with the corrected destination account names, and associate these new SACL entries with the appropriate security descriptors.

You must make any necessary changes to local users or groups used in the file-directory policy configuration before applying the policy; otherwise, the apply job fails.