Considerations when using Dynamic Access Control and central access policies with CIFS servers
Suggest changes
PDFs
There are certain considerations you must keep in mind when using Dynamic Access Control (DAC) and central access policies to secure files and folders on CIFS servers.
NFS access can be denied to root if policy rule applies to domain\administrator user
Under certain circumstances, NFS access to root might be denied when central access policy security is applied to the data that the root user is attempting to access. The issue occurs when the central access policy contains a rule that is applied to the domain\administrator and the root account is mapped to the domain\administrator account.
Instead of applying a rule to the domain\administrator user, you should apply the rule to a group with administrative privileges, such as the domain\administrators group. In this way, you can map root to the domain\administrator account without root being impacted by this issue.
CIFS server's BUILTIN\Administrators group has access to resources when the applied central access policy is not found in Active Directory
It is possible that resources contained within the CIFS server have central access policies applied to them, but when the CIFS server uses the central access policy's SID to attempt to retrieve information from Active Directory, the SID does not match any existing central access policy SIDs in Active Directory. Under these circumstances, the CIFS server applies the local default recovery policy for that resource.
The local default recovery policy allows the CIFS server's BUILTIN\Administrators group access to that resource.