Hi,
We are attempting to make alterations to our file and directory ACLs using
the microsoft utility Subinacl.exe. All attempts to use this utility under
an account which has anything less than Administrative status on the Filer
fail. For example running the following command subinacl /subdirectories
\\sharesfiler\adm$ <file://sharesfiler/adm$> /display - with an account
which has Power User & Backup Operator group membership on the Filer returns
an error message - CreateFile Error : 1314 A required privilege is not held
by the client.
The account the command is being run under has both Full Control on the
share and the ACL. If we use other MS utilities to perform the same function
such as cacls, xcalcs or the windows GUI we can view and alter all ACLs
without the need to grant the account Administative status. This implies
that the access permissions are sufficient and therefore there is something
subinacl is doing that is different to other tools designed for the same
purpose. Upgrading the account priveleges to Administrator overcomes this
problem but this is not an option except in our test environment. This
behaviour is consistant on Ontap 6.5.7, 7.0.5, 7.0.6 and 7.2.2 implying that
its not a release bug.
Has anyone else come across this behaviour before or have any idea what
subinacl is doing that the other tools do not?
Your assistance will be appreciated.
rgds,
Oisin