#Not able to create the CIFS server in FAS2820

1 messages · Page 1 of 1 (latest)

wraith fern
#

Hi,

I have FAS2820 and i am deploying it. While creating the cifs server i am getting below error.

Enter the user name: sagar.mandlik

Enter the password:

Error: Machine account creation procedure failed
[ 49] Loaded the preliminary configuration.
[ 54] Successfully connected to ip 172.24.1.29, port 88 using
TCP
[ 87] Successfully connected to ip 172.24.1.29, port 389 using
TCP
**[ 10101] FAILURE: Could not create account
** 'cn=NYKSTR,CN=Computers,dc=NYKAA,dc=LOCAL': Timed out

Error: command failed: Failed to create the Active Directory machine account
"NYKSTR". Reason: LDAP Error: The search was timed out.

Can anybody please help me here

timid cosmos
#

do you have the correct security settings configured? like signing/Sealing, TLS, ... as required per your domain?

#

(vserver cifs security modify ...)

lunar nimbus
#

Also does the account you’re using to try to join have domain admin rights or rights that would let it join a computer to the domain?

wraith fern
wraith fern
rancid sable
#

Try the default OU. I suspect something else is wrong though due to the error. Wondering if your AD is large enough where ONTAP can’t get everything it needs and ultimately times out?

wraith fern
timid cosmos
#

well, "timed out" indicates a network problem somewhere. Either the port is closed, or there's a firewall in the way, or a routing or DNS issue, ....

loud pebble
#

please check which NTP has the ontap storage, also verify between the domains and the storage there's no more than 5 minutes, I recommend 3 maximum

rancid sable
#

Time issues definitely give a different error message. It will indicate Kerberos issues and usually indicate time is actually too far off
I have seen cases where ONTAP is trying to get the ad information and there is just too much to process and times out.
If that’s the case sometimes you can use a sub domain (forest?) instead of the higher level domain

summer marsh
wraith fern
wraith fern
tacit summit
#

I am thinking about certificates. If the AD LDAP is enforcing encryption and is using a certificate from a private PKI, the PKI root certificate must be imported into the SVM.

rancid sable
#

You’re going to need to do a network trace. Pretty sure all these other ideas of issues I’ve seen before and they all have their own signature error messages. I don’t recall any of them being “timed out” as indicated in the original post.

main plume
#

something simple like not having the DNS configuration setup can cause this as well. The filer can't find the domain controllers with the service lookup

rancid sable