This topic describes how to use an Active Directory (AD) user to mount an Apsara File Storage NAS Server Message Block (SMB) file system on Windows. It also describes how to use an AD user to access an SMB file system. You can view and modify the access control lists (ACLs) of files or directories that reside in the SMB file system.

Prerequisites

An SMB client is connected to AD. For more information, see Connect an SMB client to an Active Directory domain.

Background information

Before you connect an SMB client to AD, you must allow a user from the Everyone group to mount SMB file systems on the client. You can also use the user to manage the SMB file system. After you enable AD-based authentication for an SMB file system, you can set whether to allow anonymous access to the SMB file system.

  • If you enable anonymous access for an SMB file system, you can use an AD user to manage the SMB file system based on Kerberos authentication. You can also use a user from the Everyone group to manage the SMB file system based on NT LAN Manager (NTLM) authentication.
  • If you disable anonymous access for an SMB file system, you must use an AD user to mount the SMB file system based on Kerberos authentication.
Note The SMB ACL feature is available only for SMB file systems in the following regions: China (Zhangjiakou-Beijing Winter Olympics), China (Beijing), China (Hohhot), China (Hangzhou), China (Shanghai), China (Chengdu), China (Hong Kong), Australia (Sydney), Indonesia (Jakarta), US (Silicon Valley), US (Virginia), Germany (Frankfurt), UK (London), and India (Mumbai). If the region where your file system resides does not support the SMB ACL feature, submit a ticket.

Run the following commands in the Windows command prompt.

1. Use the net use command to mount an SMB file system

The syntax of the command is as follows.

net use <the target drive> <the mount target of an SMB file system >

Examples

  • Use the following command to mount an SMB file system on a client that has joined to AD.

    net use z: \\nas-mount-target.nas.aliyuncs.com\myshare
  • Use the following command to mount an SMB file system on a client that has not joined to AD.

    net use z: \\nas-mount-target.nas.aliyuncs.com\myshare /user:MYDOMAIN.com\USERNAME PASSWORD

NAS allows you to use the net use command to mount file systems. If you use the net use command to mount a file system, you can access the file system and view rather than modify the ACLs of files and directories.

Use the mklink command to manage an SMB file system

You can use the mklink command to create a symbolic link for the mount target of an SMB file system. The symbolic link points to a Windows directory.

Note The mklink command is not available for PowerShell. You must use the command in the command prompt.

The syntax of the command is as follows.

mklink /D <the full path of a local directory> <the mount target of an SMB file system>

Example:

mklink /D c:\myshare \\nas-mount-target.nas.aliyuncs.com\myshare

By default, you must use Windows administrator users to create symbolic links. If you want to use a standard user to create symbolic links, you must grant the required permissions to the standard user.

  1. Use the administrator permissions to search for and run secpol.msc.secpol
  2. Grant the Create symbolic links permission to the specified user.Mount an SMB file system on a client that is joined to ADsecpol_03
  3. Log on to the system again to enable the permission.

To access an SMB file system in the same way that you access a local directory in Windows, create a symbolic link for the SMB file system. In this case, you can access the SMB file system, as well as view and modify the ACLs of the files and directories.

Use Windows File Explorer to view and modify ACLs

After you create a symbolic link for the mount target of an SMB file system, use Windows File Explorer to view and modify ACLs to view and modify the ACLs of files and directories.

The following figures show how to use File Explorer to view the ACLs of an SMB file system. Note: After you mount the SMB file system on Windows, a symbolic link named C:\myshare is created .

set_sec_02set_sec_03set_sec_04set_sec_05
You can use File Explorer to access SMB file systems. If you want to return to the last page or move up a level, click Back as Remark 1 shows or Up as Remark 2 shows. However, do not click one section of a path in the Address bar to return as Remark 3 shows. The following figure includes the preceding remarks.Use File Explorer to access an SMB file system

If you use File Explorer to access an SMB file system and manage the ACLs of files and directories, If you use a UNC path such as \\nas-mount-point.nas.aliyuncs.com\myshare rather than a file path such as C:\myshare to access an SMB file system, an error showing "The RPC server is unavailable" may occur as a result of DNS resolution failure. The following figures show error messages.

SMB_ACL_Error message_1SMB_ACL_Error message_2