Understanding local user accounts

Reasons for creating local users on the storage system

There are several reasons for creating local user accounts on your storage system:

You must create local user accounts if, during setup, you configured the storage system to be a member of a Windows workgroup. In this case, the storage system must use the information in local user accounts to authenticate users.
If your storage system is a member of a domain:
- Local user accounts enable the storage system to authenticate users who try to connect to the storage system from an untrusted domain.
- Local users can access the storage system when the domain controller is down or when network problems prevent your storage system from contacting the domain controller. For example, you can define a BUILTIN\Administrator account that you can use to access the storage system even when the storage system fails to contact the domain controller.

When you should not create local users

If, during setup, you configured your storage system to use UNIX mode for authenticating users, you should not create local user accounts. In UNIX mode, the storage system always authenticates users using the UNIX password database.

Command for displaying the authentication method

The cifs sessions command displays the current user authentication method that the storage system is configured to use.

Where local users can be used

Local users can be used in every case where you use user and group lists. For example, you can specify local users in file-level ACLs and share-level ACLs. You can also add local users to local groups.

Limitations of local user accounts

There are several limitations with local user accounts:

You cannot use User Manager to manage local user accounts on your storage system.
You can use User Manager in Windows NT 4.0 only to view local user accounts. If you use User Manager in Windows 2000, however, you cannot use the Users menu to view local users. You must use the Groups menu to display local users.
You can create a maximum of 96 local user accounts.

Command for managing local users

The useradmin command creates, displays, and deletes local user accounts. (You can also use this command to manage non-local users through the domainuser subcommand.) You use the useradmin command for creating, displaying, and deleting administrative users on the storage system. For information about how to use the useradmin command, see the section about managing local user accounts in the introduction to storage system administration in the System Administration Guide.

Note
Data ONTAP keeps a single list of user accounts created by the useradmin command. The same types of information exist for local user accounts and administrative user accounts. CIFS users who have local user accounts with the appropriate Admin Roles can use Windows RPC calls to log in to the storage system. For more information, see the chapter on managing Administrator access in the System Administration Guide.