Simple question -
We've just started to utilise some space on a second SAN head and for the life of me I can't remember what I needed to do on the SAN to allow our SnapDrive domain account to connect and create luns on the SAN. I've had a look 'useradmin user list' and 'useradmin domain list' but can't find anything obvious to match our domain 'sduser' account to a SAN account.
When I use SnapDrive I get this in the event log -
Error code : Access is denied. Verify that you have entered the correct domain and user name during SnapDrive installation and that this account has sufficient privileges to perform this operation.
And this as a popup -
SnapDrive error Error Description: User sduser does not have the capability to invoke API system-get-version
I figure theres something really simple I'm missing or have taken for granted on our other SAN heads in terms of initial setup to use with SnapDrive.
Cheers, Raj.
Put that account into the local "Adminstrators" group on the filer. You can do this through the CLI (on modern ONTAP revs) or you can use the MMC on a Windows box as a user who is already in the Administrators group on the filer as you would a Windows server.
-- Adam Fox adamfox@netapp.com
-----Original Message----- From: Raj Patel [mailto:phigmov@gmail.com] Sent: Thursday, November 01, 2007 7:11 PM To: toasters@mathworks.com Subject: Windows SnapDrive Query
Simple question -
We've just started to utilise some space on a second SAN head and for the life of me I can't remember what I needed to do on the SAN to allow our SnapDrive domain account to connect and create luns on the SAN. I've had a look 'useradmin user list' and 'useradmin domain list' but can't find anything obvious to match our domain 'sduser' account to a SAN account.
When I use SnapDrive I get this in the event log -
Error code : Access is denied. Verify that you have entered the correct domain and user name during SnapDrive installation and that this account has sufficient privileges to perform this operation.
And this as a popup -
SnapDrive error Error Description: User sduser does not have the capability to invoke API system-get-version
I figure theres something really simple I'm missing or have taken for granted on our other SAN heads in terms of initial setup to use with SnapDrive.
Cheers, Raj.
Hey Raj,
On 11/2/07, Raj Patel phigmov@gmail.com wrote:
Error code : Access is denied. Verify that you have entered the correct domain and user name during SnapDrive installation and that this account has sufficient privileges to perform this operation.
And this as a popup -
SnapDrive error Error Description: User sduser does not have the capability to invoke API system-get-version
The simplest way: Add the sduser domain account to the local admins group of your filer, using the compmgmt.msc MMC plugin.
HTH!
Nils
Raj,
The domain account needs to be in the BULTIN\Administrators group on the filer and the server if the filer is a member of the domain. If the filer isn't a member of the domain you can use pass-through authentication by creating a local user on both the filer and the server with the same username and password.
Thanks
Oliver Bassett Team Leader Storage Solutions
Infinity Solutions Ltd (a Fujitsu company) P O Box 3323, Auckland Ph: +64 9 921 8123, Mob: +64 21 574 994 Fax: +64 9 309 4142 www.infinitysolutions.co.nz
-----Original Message----- From: owner-toasters@mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Raj Patel Sent: Friday, 2 November 2007 12:11 p.m. To: toasters@mathworks.com Subject: Windows SnapDrive Query
Simple question -
We've just started to utilise some space on a second SAN head and for the life of me I can't remember what I needed to do on the SAN to allow our SnapDrive domain account to connect and create luns on the SAN. I've had a look 'useradmin user list' and 'useradmin domain list' but can't find anything obvious to match our domain 'sduser' account to a SAN account.
When I use SnapDrive I get this in the event log -
Error code : Access is denied. Verify that you have entered the correct domain and user name during SnapDrive installation and that this account has sufficient privileges to perform this operation.
And this as a popup -
SnapDrive error Error Description: User sduser does not have the capability to invoke API system-get-version
I figure theres something really simple I'm missing or have taken for granted on our other SAN heads in terms of initial setup to use with SnapDrive.
Cheers, Raj. The information contained in this email is privileged and confidential and intended for the addressee only. If you are not the intended recipient, you are asked to respect that confidentiality and not disclose, copy or make use of its contents. If received in error you are asked to destroy this email and contact the sender immediately. Your assistance is appreciated.
The simplest way: Add the sduser domain account to the local admins
group of your filer,
using the compmgmt.msc MMC plugin.
Bingo - new it was something simple.
Do the command line tools on the filer itself show this ? Whats the command ?
I'll have to update our documentation . . .
Cheers all, Raj.
Wcc -s username will tell you group membership (look for 'builtin\administrators')
You can also add it via cli (useradmin domainuser add <username> -g <groupname>)
-----Original Message----- From: owner-toasters@mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Raj Patel Sent: Thursday, November 01, 2007 8:29 PM To: toasters@mathworks.com Subject: Re: Windows SnapDrive Query
The simplest way: Add the sduser domain account to the local admins
group of your filer,
using the compmgmt.msc MMC plugin.
Bingo - new it was something simple.
Do the command line tools on the filer itself show this ? Whats the command ?
I'll have to update our documentation . . .
Cheers all, Raj.
Raj,
They do show up from the commandline, however as SID's which makes it a little difficult to do a direct translation:
useradmin domainuser list -g "Administrators"
Will list out the SID's. Then you can use cifs lookup SID to lookup what account it actually is.
Adding can be done with:
useradmin domainuser add DOMAIN\UserName -g "Administrators"
The Computer Management makes this far easier to do.
Thanks
Oliver Bassett Team Leader Storage Solutions
Infinity Solutions Ltd (a Fujitsu company) P O Box 3323, Auckland Ph: +64 9 921 8123, Mob: +64 21 574 994 Fax: +64 9 309 4142 www.infinitysolutions.co.nz
-----Original Message----- From: owner-toasters@mathworks.com [mailto:owner-toasters@mathworks.com] On Behalf Of Raj Patel Sent: Friday, 2 November 2007 1:29 p.m. To: toasters@mathworks.com Subject: Re: Windows SnapDrive Query
The simplest way: Add the sduser domain account to the local admins
group of your filer,
using the compmgmt.msc MMC plugin.
Bingo - new it was something simple.
Do the command line tools on the filer itself show this ? Whats the command ?
I'll have to update our documentation . . .
Cheers all, Raj. The information contained in this email is privileged and confidential and intended for the addressee only. If you are not the intended recipient, you are asked to respect that confidentiality and not disclose, copy or make use of its contents. If received in error you are asked to destroy this email and contact the sender immediately. Your assistance is appreciated.
On the CLI you can use 'useradmin domainuser list -g Adminstrators' to see who's in the group. There's an 'add' and 'delete' subcommand to add and delete Windows uers from the specified group. Or the MMC works too.
I think you have to be running at least ONTAP 7.0 for this CLI interface to work, BTW.
-- Adam Fox adamfox@netapp.com
-----Original Message----- From: Raj Patel [mailto:phigmov@gmail.com] Sent: Thursday, November 01, 2007 8:29 PM To: toasters@mathworks.com Subject: Re: Windows SnapDrive Query
The simplest way: Add the sduser domain account to the local admins
group of your filer,
using the compmgmt.msc MMC plugin.
Bingo - new it was something simple.
Do the command line tools on the filer itself show this ? Whats the command ?
I'll have to update our documentation . . .
Cheers all, Raj.
The snapdrive service account must be an administrator on both the filer and the server. You can use the Computer Manager in Windows to connect to the filer and add the account or you can use 'useradmin domainuser add domain\user -g Administrators'
----- Original Message ----- From: "Raj Patel" phigmov@gmail.com To: toasters@mathworks.com Sent: Thursday, November 01, 2007 7:11 PM Subject: Windows SnapDrive Query
Simple question -
We've just started to utilise some space on a second SAN head and for the life of me I can't remember what I needed to do on the SAN to allow our SnapDrive domain account to connect and create luns on the SAN. I've had a look 'useradmin user list' and 'useradmin domain list' but can't find anything obvious to match our domain 'sduser' account to a SAN account.
When I use SnapDrive I get this in the event log -
Error code : Access is denied. Verify that you have entered the correct domain and user name during SnapDrive installation and that this account has sufficient privileges to perform this operation.
And this as a popup -
SnapDrive error Error Description: User sduser does not have the capability to invoke API system-get-version
I figure theres something really simple I'm missing or have taken for granted on our other SAN heads in terms of initial setup to use with SnapDrive.
Cheers, Raj.
-
Bill Holland -
Fox, Adam -
Glenn Walker -
Nils Vogels -
Oliver Bassett -
Raj Patel