Understanding local user accounts

Reasons for creating local users on the filer

There are several reasons for creating local user accounts on the filer:

You must create local user accounts if, during setup, you configured the filer to be a member of a Windows workgroup. In this case, the filer must use the information in local user accounts to authenticate users.
If your filer is a member of a domain:
- Local user accounts enable the filer to authenticate users who try to connect to the filer from an untrusted domain.
- Local users can access the filer when the domain controller is down or when network problems prevent your filer from contacting the domain controller. For example, you can define a BUILTIN\Administrator account so that you can use the account to access the filer even when the filer fails to contact the domain controller.

When you should not create local users

If, during setup, you configured the filer to use UNIX mode for authenticating users, you should not create local user accounts. In UNIX mode, the filer always authenticates users using the UNIX password database.

Command for displaying the authentication method

The cifs sessions command displays the current user authentication method that the filer is configured to use.

Where local users can be used

Local users can be used in every case where you use user and group lists. For example, you can specify local users in file-level ACLs and share-level ACLs. You can also add local users to local groups.

Limitations of local user accounts

There are several limitations with local user accounts:

You cannot use User Manager to manage local user accounts on the filer.
You can use User Manager in Windows NT 4.0 only to view local user accounts. If you use User Manager in Windows 2000, however, you cannot use the Users menu to view local users. You must use the Groups menu to display local users.
You can create a maximum of 96 local user accounts.

Command for managing local users

The useradmin command creates, displays, and deletes local user accounts. You use the useradmin command as you do for creating, displaying, and deleting administrative users on the filer. For information about how to use the useradmin command, see the section about managing local user accounts in the introduction to filer administration in the Storage Management Guide.

Note
Data ONTAP keeps a single list of user accounts created by the useradmin command. The same types of information exist for local user accounts and administrative user accounts. That is, CIFS users who have local user accounts on the filer also have access to the filer console as administrative users.