Retrieve unapplied group policy objects for an SVM

08/30/2024 Contributors

PDFs

GET /protocols/cifs/group-policies/{svm.uuid}

Introduced In: 9.12

Retrieves group policy objects that are yet to be applied for specified SVM.

vserver cifs group-policy show-defined

Parameters

Name	Type	In	Required	Description
svm.uuid	string	path	True	UUID of the SVM to which this object belongs.
fields	array[string]	query	False	Specify the fields to return.

Name

Type

Required

Description

svm.uuid

string

path

True

UUID of the SVM to which this object belongs.

fields

array[string]

query

False

Specify the fields to return.

Response

Status: 200, Ok

Name	Type	Description
svm	svm	SVM, applies only to SVM-scoped objects.
to_be_applied	to_be_applied

Name

Type

Description

svm

SVM, applies only to SVM-scoped objects.

to_be_applied

Example response

{
  "svm": {
    "_links": {
      "self": {
        "href": "/api/resourcelink"
      }
    },
    "name": "svm1",
    "uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
  },
  "to_be_applied": {
    "access_policies": [
      {
        "create_time": "2018-01-01 16:00:00 +0000",
        "description": "policy #1",
        "member_rules": [
          "r1",
          "r2"
        ],
        "name": "p1",
        "sid": "S-1-5-21-256008430-3394229847-3930036330-1001",
        "svm": {
          "_links": {
            "self": {
              "href": "/api/resourcelink"
            }
          },
          "name": "svm1",
          "uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
        },
        "update_time": "2018-01-01 16:00:00 +0000"
      }
    ],
    "access_rules": [
      {
        "create_time": "2018-01-01 16:00:00 +0000",
        "current_permission": "O:SYG:SYD:AR(A;;FA;;;WD)",
        "description": "rule #1",
        "name": "p1",
        "proposed_permission": "O:SYG:SYD:(A;;FA;;;OW)(A;;FA;;;BA)(A;;FA;;;SY)",
        "resource_criteria": "department",
        "svm": {
          "_links": {
            "self": {
              "href": "/api/resourcelink"
            }
          },
          "name": "svm1",
          "uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
        },
        "update_time": "2018-01-01 16:00:00 +0000"
      }
    ],
    "objects": [
      {
        "central_access_policy_settings": [
          "p1",
          "p2"
        ],
        "central_access_policy_staging_audit_type": "none",
        "extensions": [
          "audit",
          "security"
        ],
        "file_system_path": "\\test.com\\SysVol\\test.com\\policies\\{42474212-3f9d-4489-ae01-6fcf4f805d4c}",
        "index": 1,
        "ldap_path": "cn={42474212-3f9d-4489-ae01-6fcf4f805d4c},cn=policies,cn=system,DC=TEST,DC=COM",
        "link": "domain",
        "name": "test_policy",
        "registry_settings": {
          "branchcache": {
            "hash_publication_mode": "disabled",
            "supported_hash_version": "version1"
          },
          "refresh_time_interval": "P15M",
          "refresh_time_random_offset": "P1D"
        },
        "security_settings": {
          "event_audit_settings": {
            "logon_type": "failure",
            "object_access_type": "failure"
          },
          "event_log_settings": {
            "max_size": 2048,
            "retention_method": "do_not_overwrite"
          },
          "files_or_folders": [
            "/vol1/home",
            "/vol1/dir1"
          ],
          "kerberos": {
            "max_clock_skew": "P15M",
            "max_renew_age": "P2D",
            "max_ticket_age": "P24H"
          },
          "privilege_rights": {
            "change_notify_users": [
              "usr1",
              "usr2"
            ],
            "security_privilege_users": [
              "usr1",
              "usr2"
            ],
            "take_ownership_users": [
              "usr1",
              "usr2"
            ]
          },
          "restrict_anonymous": {
            "combined_restriction_for_anonymous_user": "no_access"
          },
          "restricted_groups": [
            "test_grp1",
            "test_grp2"
          ]
        },
        "svm": {
          "_links": {
            "self": {
              "href": "/api/resourcelink"
            }
          },
          "name": "svm1",
          "uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
        },
        "uuid": "42474212-3f9d-4489-ae01-6fcf4f805d4c",
        "version": 7
      }
    ],
    "restricted_groups": [
      {
        "group_name": "test_group",
        "link": "domain",
        "members": [
          "DOMAIN/test_user",
          "DOMAIN/user2"
        ],
        "memberships": [
          "DOMAIN/AdministratorGrp",
          "DOMAIN/deptMark"
        ],
        "policy_name": "test_policy",
        "svm": {
          "_links": {
            "self": {
              "href": "/api/resourcelink"
            }
          },
          "name": "svm1",
          "uuid": "02c9e252-41be-11e9-81d5-00a0986138f7"
        },
        "version": 7
      }
    ]
  }
}

Error

Status: Default, Error

Name	Type	Description
error	returned_error

Name

Type

Description

error

returned_error

Example error

{
  "error": {
    "arguments": [
      {
        "code": "string",
        "message": "string"
      }
    ],
    "code": "4",
    "message": "entry doesn't exist",
    "target": "uuid"
  }
}

Definitions

See Definitions

href

Name	Type	Description
href	string

Name

Type

Description

href

string

_links

Name	Type	Description
self	href

Name

Type

Description

self

href

svm

SVM, applies only to SVM-scoped objects.

Name	Type	Description
_links	_links
name	string	The name of the SVM. This field cannot be specified in a PATCH method.
uuid	string	The unique identifier of the SVM. This field cannot be specified in a PATCH method.

Name

Type

Description

_links

name

string

The name of the SVM. This field cannot be specified in a PATCH method.

uuid

string

The unique identifier of the SVM. This field cannot be specified in a PATCH method.

svm

Will not be populated for objects that are yet to be applied.

Name	Type	Description
_links	_links
name	string	The name of the SVM. This field cannot be specified in a PATCH method.
uuid	string	The unique identifier of the SVM. This field cannot be specified in a PATCH method.

Name

Type

Description

_links

name

string

The name of the SVM. This field cannot be specified in a PATCH method.

uuid

string

The unique identifier of the SVM. This field cannot be specified in a PATCH method.

group_policy_object_central_access_policy

Name	Type	Description
create_time	string	Policy creation timestamp.
description	string	Description about the policy.
member_rules	array[string]	Names of all central access rules applied to members.
name	string
sid	string	Security ID, unique identifier of the central policy.
svm	svm	Will not be populated for objects that are yet to be applied.
update_time	string	Last policy modification timestamp.

Name

Type

Description

create_time

string

Policy creation timestamp.

description

string

Description about the policy.

member_rules

array[string]

Names of all central access rules applied to members.

name

string

sid

string

Security ID, unique identifier of the central policy.

svm

Will not be populated for objects that are yet to be applied.

update_time

string

Last policy modification timestamp.

group_policy_object_central_access_rule

Name	Type	Description
create_time	string	Policy creation timestamp.
current_permission	string	Effective security policy in security descriptor definition language format.
description	string	Description about the policy.
name	string
proposed_permission	string	Proposed security policy in security descriptor definition language format.
resource_criteria	string	Criteria to scope resources for which access rules apply.
svm	svm	Will not be populated for objects that are yet to be applied.
update_time	string	Last policy modification timestamp.

Name

Type

Description

create_time

string

Policy creation timestamp.

current_permission

string

Effective security policy in security descriptor definition language format.

description

string

Description about the policy.

name

string

proposed_permission

string

Proposed security policy in security descriptor definition language format.

resource_criteria

string

Criteria to scope resources for which access rules apply.

svm

Will not be populated for objects that are yet to be applied.

update_time

string

Last policy modification timestamp.

group_policy_object_branchcache

Name	Type	Description
hash_publication_mode	string	Hash publication mode.
supported_hash_version	string	Hash version.

Name

Type

Description

hash_publication_mode

string

Hash publication mode.

supported_hash_version

string

Hash version.

group_policy_object_registry_setting

Name	Type	Description
branchcache	group_policy_object_branchcache
refresh_time_interval	string	Refresh time interval in ISO-8601 format.
refresh_time_random_offset	string	Random offset in ISO-8601 format.

Name

Type

Description

branchcache

group_policy_object_branchcache

refresh_time_interval

string

Refresh time interval in ISO-8601 format.

refresh_time_random_offset

string

Random offset in ISO-8601 format.

group_policy_object_event_audit

Name	Type	Description
logon_type	string	Type of logon event to be audited.
object_access_type	string	Type of object access to be audited.

Name

Type

Description

logon_type

string

Type of logon event to be audited.

object_access_type

string

Type of object access to be audited.

group_policy_object_event_log

Name	Type	Description
max_size	integer	Maximum size of security log, in kilobytes.
retention_method	string	Audit log retention method.

Name

Type

Description

max_size

integer

Maximum size of security log, in kilobytes.

retention_method

string

Audit log retention method.

group_policy_object_kerberos

Name	Type	Description
max_clock_skew	string	Kerberos clock skew in ISO-8601 format.
max_renew_age	string	Kerberos max renew age in ISO-8601 format.
max_ticket_age	string	Kerberos max ticket age in ISO-8601 format.

Name

Type

Description

max_clock_skew

string

Kerberos clock skew in ISO-8601 format.

max_renew_age

string

Kerberos max renew age in ISO-8601 format.

max_ticket_age

string

Kerberos max ticket age in ISO-8601 format.

group_policy_object_privilege_right

Name	Type	Description
change_notify_users	array[string]	Users with traversing bypass privileges.
security_privilege_users	array[string]	Users with security privileges.
take_ownership_users	array[string]	Users who can take ownership of securable objects.

Name

Type

Description

change_notify_users

array[string]

Users with traversing bypass privileges.

security_privilege_users

array[string]

Users with security privileges.

take_ownership_users

array[string]

Users who can take ownership of securable objects.

group_policy_object_registry_value

Name	Type	Description
signing_required	boolean	SMB signing required.

Name

Type

Description

signing_required

boolean

SMB signing required.

group_policy_object_restrict_anonymous

Name	Type	Description
anonymous_access_to_shares_and_named_pipes_restricted	boolean	Restrict anonymous access to shares and named pipes.
combined_restriction_for_anonymous_user	string	Combined restriction for anonymous user.
no_enumeration_of_sam_accounts	boolean	No enumeration of SAM accounts.
no_enumeration_of_sam_accounts_and_shares	boolean	No enumeration of SAM accounts and shares.

Name

Type

Description

anonymous_access_to_shares_and_named_pipes_restricted

boolean

Restrict anonymous access to shares and named pipes.

combined_restriction_for_anonymous_user

string

Combined restriction for anonymous user.

no_enumeration_of_sam_accounts

boolean

No enumeration of SAM accounts.

no_enumeration_of_sam_accounts_and_shares

boolean

No enumeration of SAM accounts and shares.

group_policy_object_security_setting

Name	Type	Description
event_audit_settings	group_policy_object_event_audit
event_log_settings	group_policy_object_event_log
files_or_folders	array[string]	Files/Directories for file security.
kerberos	group_policy_object_kerberos
privilege_rights	group_policy_object_privilege_right
registry_values	group_policy_object_registry_value
restrict_anonymous	group_policy_object_restrict_anonymous
restricted_groups	array[string]	List of restricted groups.

Name

Type

Description

event_audit_settings

group_policy_object_event_audit

event_log_settings

group_policy_object_event_log

files_or_folders

array[string]

Files/Directories for file security.

kerberos

group_policy_object_kerberos

privilege_rights

group_policy_object_privilege_right

registry_values

group_policy_object_registry_value

restrict_anonymous

group_policy_object_restrict_anonymous

restricted_groups

array[string]

List of restricted groups.

group_policy_object

Name	Type	Description
central_access_policy_settings	array[string]	List of central access policies.
central_access_policy_staging_audit_type	string	Types of events to be audited.
enabled	boolean	Specifies whether group policies are enabled for the SVM.
extensions	array[string]	List of extensions.
file_system_path	string	File system path.
index	integer	Group policy object index.
ldap_path	string	LDAP path to the GPO.
link	string	Link info.
name	string
registry_settings	group_policy_object_registry_setting
security_settings	group_policy_object_security_setting
svm	svm	Will not be populated for objects that are yet to be applied.
uuid	string	Policy UUID.
version	integer	Group policy object version.

Name

Type

Description

central_access_policy_settings

array[string]

List of central access policies.

central_access_policy_staging_audit_type

string

Types of events to be audited.

enabled

boolean

Specifies whether group policies are enabled for the SVM.

extensions

array[string]

List of extensions.

file_system_path

string

File system path.

index

integer

Group policy object index.

ldap_path

string

LDAP path to the GPO.

link

string

Link info.

name

string

registry_settings

group_policy_object_registry_setting

security_settings

group_policy_object_security_setting

svm

Will not be populated for objects that are yet to be applied.

uuid

string

Policy UUID.

version

integer

Group policy object version.

group_policy_object_restricted_group

Name	Type	Description
group_name	string
link	string	Link info.
members	array[string]	Members of the group.
memberships	array[string]	Group is member of Group/OU.
policy_name	string
svm	svm	Will not be populated for objects that are yet to be applied.
version	integer	Group policy object version.

Name

Type

Description

group_name

string

link

string

Link info.

members

array[string]

Members of the group.

memberships

array[string]

Group is member of Group/OU.

policy_name

string

svm

Will not be populated for objects that are yet to be applied.

version

integer

Group policy object version.

to_be_applied

Name	Type	Description
access_policies	array[group_policy_object_central_access_policy]
access_rules	array[group_policy_object_central_access_rule]
objects	array[group_policy_object]
restricted_groups	array[group_policy_object_restricted_group]

Name

Type

Description

access_policies

array[group_policy_object_central_access_policy]

access_rules

array[group_policy_object_central_access_rule]

objects

array[group_policy_object]

restricted_groups

array[group_policy_object_restricted_group]

error_arguments

Name	Type	Description
code	string	Argument code
message	string	Message argument

Name

Type

Description

code

string

Argument code

message

string

Message argument

returned_error

Name	Type	Description
arguments	array[error_arguments]	Message arguments
code	string	Error code
message	string	Error message
target	string	The target parameter that caused the error.

Name

Type

Description

arguments

array[error_arguments]

Message arguments

code

string

Error code

message

string

Error message

target

string

The target parameter that caused the error.

Retrieve unapplied group policy objects for an SVM

Creating your file...

Related ONTAP commands

Parameters

Response

Error

Definitions