CIFS 创建失败，出现 LDAP 错误用户没有足够的访问权限

最后更新
另存为PDF

Views:: 39

Visibility:: Public

Votes:: 4

Category:: ontap-9

Specialty:: nas

Last Updated:

适用于

ONTAP 9
CIFS

问题描述

CIFS 创建失败，出现以下错误

::*> cifs server create -vserver svm1 -cifs-server cifs1 -domain domain.com -ou CN=Computers

In order to create an Active Directory machine account for the CIFS server, you must supply the name and password of a Windows account with sufficient privileges to add computers to the "CN=Computers" container within the "domain.com" domain.

Enter the user name: user

Enter the password:

Error: Machine account creation procedure failed

[ 16507] Loaded the preliminary configuration.

[ 16849] Created a machine account in the domain

[ 16850] SID to name translations of Domain Users and Admins completed successfully

[ 16872] Successfully connected to ip 10.x.x.x, port 88 using TCP

[ 16917] Successfully connected to ip 10.x.x.x, port 464 using TCP

[ 16961] Kerberos password set for 'cifs$@domain' succeeded

[ 16961] Set initial account password

**[ 17017] FAILURE: Unable to set machine account attribute**'msDS-SupportedEncryptionTypes': Insufficient access

[ 17059] Deleted existing account 'CN=cifs,CN=Computers,DC=domain,DC=com'

Error: command failed: Failed to create the Active Directory machine account "cifs". Reason: LDAP Error: The user has insufficient access rights.

收集到的数据包跟踪显示，在创建 CIFS 后，DC 在修改“msDS-SupportedEncryptionTypes”时响应 insufficientAccessRights。

No Source Destination Proto Info

1 10.x.x.x 10.y.y.y LDAP modifyRequest(9) "CN=cifs,CN=Computers,DC=domain,DC=com"

protocolOp: modifyRequest (6)
    modifyRequest
      object: CN=cifs,CN=Computers,DC=domain,DC=com
      modification: 1 item
        modification item
          operation: replace (2)
          modification msDS-SupportedEncryptionTypes
            type: msDS-SupportedEncryptionTypes
            vals: 1 item
              AttributeValue: 30

2 10.y.y.y 10.x.x.x LDAP modifyResponse(9) insufficientAccessRights (00002098: SecErr: DSID-031514B3, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0\n)