ARM DFS

Question

Hi we Are Using DFS with a Cetral Share and the ABE of these Share dont work corectly, we have ARM configured correctly. In the first level i must build a read group to the share that the users are see the share, in second level the List rigths from ARM are corectly. We would like that users only see the folders that they have the access rigths for. Have you any ideas for us to configure DFS and ARM to work correctly with the List rigths of the DFS. 
 Thanks

8paul · Accepted Answer

Hi Boehma, if you want it to start on level 0 there is a config switch to change that behaviour

dorie10555 · Answer

Hi Boehma, 
 Unfortunately, I did not fully understand the problem you raised. Do you expect that the ABE functionality is automatically taken into account in ARM? Please give me a little more context. 
 
 Regards 
 Norbert

allmecht · Answer

ABE has nothing to do with ARM. That's Windows. To configure DFS with ARM is fairly easy. Just setup a Windows Share put the correct share permissions on it, set the NTFS permissions to a user/group so ARM can set permissions. ABE has to be enable on share level. Of course you have to add the share to the DFS.

Boehma · Answer

On the DFS is ABE enabled, the users should only see the folders on which they have permissions under Zentral. ARM correctly creates the list rights under Zentral\Folder\....., the users only see the folders to which they are authorized. But at the Zentrall\..... level it does not work despite the correct configuration of ARM and DFS.

Boehma · Answer

Thanks for the answer, I am aware that ARM and DFS are two worlds. I was also more concerned with how to correctly configure DFS and ARM in order to be able to correctly map the list rights on the share. I configured the DFS according to Microsoft Best Practice and also configured the ARM according to the instructions, everything works very well so far. But unfortunately the users still see folders on the first level that they shouldn't see, I'm just looking for a way to prevent the users from seeing these folders with the ARM automatisms.

allmecht · Answer

You have to enable ABE at the Zentral level as well.

dorie10555 · Answer

There is no automatic ABE adaption in ARM available. You could control the visibility of folders by a manual configuration of data owner resources. Then it should fit in your requirements. To be honest - it sounds interesting, yet it opens a complete new door. 
 Norbert

allmecht · Answer

Hi Norbert, I don't think he is into dataowners with his "problem". Imho it's just a misconfiguration on the windows side or a bug within Windows. But has nothing to do with ARM itself.

Boehma · Answer

Hello Allmecht ABE is activated at the central level.

Boehma · Answer

Hello Allmecht, maybe it's because of the ARM it only starts at level 1 with list rights, but I don't know exactly because nobody from Solarwinds has been able to make a correct statement about it. I hoped that someone would use a similar setting and maybe tell me what else would have to be set so that it works the way I want.

allmecht · Answer

Hello Andreas, my fault. It has to be activated on the target share and in the DFS config

Boehma · Answer

Hello 8paul where can I set this switch

allmecht · Answer

Have you set ABE on the DFS target?

Boehma · Answer

Yes

allmecht · Answer

Have you changed the default permissions on the DFSroot folder for the Zentral share? It's essential that the permissions on the target are nterrupted. But without any additional information it's not worth to do furher. We would need the exact permission set on the DFSroot, the view permissions on the DFS folder, the share permissions and the NTFS permissions.

Boehma · Answer

Hello, I received the answer from support. DFS list rights to level 0 are not possible, Currently.

dorie10555 · Answer

Hi msizec, 
 this switch enables ARM to manage the list rights (with dedicated group) also for the share level. 
 Why don't we switch it on by default? 
 To ensure a correct functionality the FS ARM service account needs also file write access to the share level. This is in most cases inacceptable or not considered by customer. To reduce the trouble we decided to switch it off by default. 
 How does it affect DFS? 
 For a DFS this switch is not applicable and would produce weird errors during GroupWizard execution. In any case the DFS list group management should start with the DFS folders with target (the share!) or better one level below. ARM does not automatically tread the DFS namespace hierarchy other than a directory hierarchy and would potentially run in trouble during list rights creation. 
 Regards 
 Norbert

msizec · Answer

for a minute I thought it would be the answer to my previous question : https://thwack.solarwinds.com/product-forums/access-rights-manager-arm/f/forum/91253/avoid-group-list-creation 
 We use DFS, and recently added a new subfolder to an existing dfs name in Arm, the new subfolder isn't available in configuration > changes > fileserver, so I can't tell arm not to create list group.

ARM DFS

Top Replies