Hello, I've just deployed BlueXP with Classification only to find out that I have to manually add the BlueXP service account with R/W permissions to each and every share. I've tried to add the service account to Backup Operators group on the SVM just to find out that the CIFS mount does not use the "BACKUP INTENT" to access files on the shares. Is it something that can be somehow adjusted? Anyone faced this permission problem and applied a workaround of any kind?
#BlueXP Classification SMB shares
hollow hawk
slender gull
You can give BlueXP AD credentials to scan SMB volumes. You don't need to add it to the SVM, think of it as a user
hollow hawk
Th AD account has to be given permissions on the NTFS filesystem level. In our case this means I have to add this user to 100s of AD groups which have R/W access to the data, since each of the shares has it's own R/W access group.
The other (better) solution would be to add that service account to 'Backup Operators' SVM group. Members of 'Backup Operators' can override ACL permissions, but only if the SMB is accessing the data using 'BACKUP INTENT' flag.
wet grove
just add SeTcbPrivilege to that account, that should suffice
https://kb.netapp.com/on-prem%2Fontap%2Fda%2FNAS%2FNAS-KBs%2FHow_to_create_CIFS_Superuser_or_provide_SeTcbPrivilege
hollow hawk
@wet grove Yes!!! This is exactly what I needed. Thank you sooo much!