使用AD组的名称时、"无法解析名为的帐户的安全标识符(SID)"
适用场景
- ONTAP 9
- SMB/CIFS
- Active Directory
问题描述
- 尝试将名为
USofA的Active Directory组添加到CIFS共享ACL时、ONTAP无法解析AD组的SID::*> cifs share access-control create -share cifstest -user-or-group USofA -user-group-type windows -permission Full_Control Error: command failed: Failed to resolve the security identifier (SID) for the account named "USofA". Reason: Object name either does not exist or could not be resolved using the available servers. Check the event log for additional information.
- SECD日志显示域控制器找不到名为的组
USofAFailure Summary: Error: Lookup of CIFS account name procedure failed [ 9 ms] Successfully connected to ip x.x.x.x, port 445 using TCP [ 32] Successfully authenticated with DC hostname.domainname.local [ 50] Encountered NT error (NT_STATUS_PIPE_NOT_AVAILABLE) for SMB command Create [ 136] Successfully retried Smb2NtCreateAndXFile for pipe \lsarpc 9 times within 95201 usecs to overcome STATUS_PIPE_NOT_AVAILABLE error from DC hostname.domainname.local [ 191] Could not find Windows name 'USofA' **[ 50] FAILURE: Unexpected state: Error 6763 at file:src/Commands/Commands.cpp func:CheckSmbStatusWrapper line:1129 **[ 191] FAILURE: Error case not correctly journaled
- 对ONTAP和域控制器之间的流量进行的数据包跟踪显示，DC的LSARPC应答为
lsa_LookupNames2 response, STATUS_NONE_MAPPED, Error: STATUS_NONE_MAPPED