Hi,
We are attempting to make alterations to our file and directory ACLs using the microsoft utility Subinacl.exe. All attempts to use this utility under an account which has anything less than Administrative status on the Filer fail. For example running the following command subinacl /subdirectories \sharesfiler\adm$ file://sharesfiler/adm$ /display - with an account which has Power User & Backup Operator group membership on the Filer returns an error message - CreateFile Error : 1314 A required privilege is not held by the client.
The account the command is being run under has both Full Control on the share and the ACL. If we use other MS utilities to perform the same function such as cacls, xcalcs or the windows GUI we can view and alter all ACLs without the need to grant the account Administative status. This implies that the access permissions are sufficient and therefore there is something subinacl is doing that is different to other tools designed for the same purpose. Upgrading the account priveleges to Administrator overcomes this problem but this is not an option except in our test environment. This behaviour is consistant on Ontap 6.5.7, 7.0.5, 7.0.6 and 7.2.2 implying that its not a release bug.
Has anyone else come across this behaviour before or have any idea what subinacl is doing that the other tools do not?
Your assistance will be appreciated.
rgds,
Oisin