SMB permissions after AD migration and shared S3 credentials
A law firm runs Nutanix Files for 900 users across 12 departments. The file server is integrated with Active Directory and uses a single service account. Share permissions on every department share are set to Everyone: Full Control; NTFS permissions do the real control. After an AD migration, users report access denied on their own department shares, while some users can open other departments' folders. The firm also has a Nutanix Objects bucket for eDiscovery exports. Three analysts share one static S3 access key because the eDiscovery tool supports only one credential. Compliance requires an audit trail of file deletions and proof that only authorized analysts can read exports. The security team wants access-based enumeration and least privilege without a big-bang migration that breaks logon scripts. What should you recommend?
1. Why did the AD migration break access, and how should it be fixed without broad access?
Read the worked answer
The AD migration almost certainly changed the security identifiers that the NTFS ACLs reference. Users who were migrated with SID history may still resolve; users without it get access denied on their own folders. Cross-department access is a separate problem: Everyone: Full Control on the share means the share layer is not restricting anything, so any overly broad or stale NTFS ACE grants access. Do not fix this by adding Everyone or Domain Users to NTFS. First inventory ACLs on a sample of department folders and map old SIDs to new accounts. Where SID history exists, verify it; where it does not, rewrite ACLs with icacls or a controlled migration tool, using department AD groups. Pilot one department, confirm access and denial cases, then roll out. Keep share permissions at Authenticated Users: Change or more restrictive, and let NTFS do granular control.
2. What share-versus-NTFS model and ABE approach should be used?
Read the worked answer
Use share permissions as a coarse gate and NTFS for least privilege. Replace Everyone: Full Control with Authenticated Users: Change only where needed, and use department groups on NTFS with modify for members and read for auditors. Enable ABE on department shares after ACLs are correct, because ABE hides folders but does not secure them. Remove stale SIDs and direct user ACEs in favor of groups. For logon scripts, keep the existing DFS path and pilot group membership changes so scripts do not break. File Analytics can show access and deletion activity, but it does not replace ACL review. Document a recurring access review for the 12 departments.
3. How should the shared S3 access key and export auditing be handled?
Read the worked answer
One static key shared by three analysts fails least privilege and auditability. Create individual access keys per analyst and scope each to the export prefix with GetObject and ListBucket only; deny delete and deny access to other buckets. If the eDiscovery tool truly accepts only one credential, put a controlled gateway or proxy in front of Objects that authenticates each analyst and uses a restricted service credential, or split exports into per-analyst buckets and update the tool. Enable server access logging on the bucket, send logs to a separate protected bucket, and alert on GetObject by unexpected identities. Rotate the shared key immediately, disable it after the new path is proven, and document who approved each export.