Managing GPOs on the storage system

About the /etc/ad directory

When GPO support is enabled on the storage system for the first time using the cifs.gpo.enable option, an /etc/ad directory is created. This directory is used as a repository for

GPO startup and shutdown scripts retrieved from the domain controller.
Output for the cifs gpresult -d command.

Displaying current GPOs and their effects

To display GPOs currently in effect for the storage system and the results of those GPOs, use the cifs gpresult command. It simulates the output of the Windows 2000/XP gpresult.exe /force command.

The cifs gpresult command takes the following options.

Option	Output
none	Displays information about the GPOs currently applicable to the storage system, including name, version and location.
`-r`	Displays the results of applying current GPOs to the storage system.
-`v`	Generates a verbose display, including information about applicable GPOs and the results of applying them.
`-d`	Dumps the output from `cifs gpresult -v` to the file /etc/ad/gpresult_timestamp file.

Note
Output to the cifs gpresult command displays only those group policy settings that are relevant to your storage system and the current Data ONTAP release.

Updating Group Policy settings

Group Policy settings on the storage system can be updated in three ways:

All GPOs are verified every 90 minutes.
By default, Data ONTAP queries Active Directory for changes to GPOs. If the GPO version numbers recorded in Active Directory are higher than those on the storage system, Data ONTAP retrieves and applies the new GPOs. If the version numbers are the same, GPOs on the storage system are not updated.
Security Settings GPOs are refreshed every 16 hours.
Data ONTAP retrieves and applies Security Settings GPOs every 16 hours, whether or not these GPOs have changed.

Note
The 16 hour default value cannot be changed in the current Data ONTAP version. It is a Windows client default setting.
All GPOs can be updated on demand with a Data ONTAP command.
To update GPOs on the storage system with the most current Group Policy settings available in an Active Directory domain, use the cifs gpupdate command. It simulates the Windows 2000/XP gpupdate.exe /force command.

Troubleshooting GPO update problems

When updated Policy Settings have been applied on storage system GPOs, messages similar to one or both of the following appear on the storage system console:

CIFS GPO System: GPO processing is successfully completed.

CIFS GPO System: GPO Security processing is completed.

If you have not seen such messages when expected--for example, after issuing the cifs gpupdate command--you might want to check diagnostic information about storage system GPO connections using the cifs.gpo.trace.enable option.

To trace GPO connections using the cifs.gpo.trace.enable option, complete the following steps.

Step	Action
1	Enter the following command at the storage system command line: `options cifs.gpo.trace.enable on`
2	Check console messages when GPO updates are expected, or after entering the `cifs gpupdate` command. Result You see messages similar to the following that include Active Directory information about GPOs: CIFS GPO Trace: Site DN: cn=Default-First-Site-Name, cn=sites,CN=Configuration,DC=cifs,DC=lab,DC=company, DC=com. CIFS GPO Trace: Domain DN: dc=CIFS,dc=LAB,dc=COMPANY, dc=COM. CIFS GPO Trace: Filer DN: cn=user1,ou=gpo_ou,dc=cifs, dc=lab,dc=company,dc=com. CIFS GPO Trace: Processing GPO[0]: T_sub. CIFS: Warning for server \\LAB-A0: Connection terminated. GPO trace messages are written to the console and message logs until GPO tracing is turned off.
3	Turn off GPO tracing by entering the following command: `options cifs.gpo.trace.enable off`

Step

Action

Enter the following command at the storage system command line:

options cifs.gpo.trace.enable on

Check console messages when GPO updates are expected, or after entering the cifs gpupdate command.

Result

You see messages similar to the following that include Active Directory information about GPOs:

CIFS GPO Trace: Site DN: cn=Default-First-Site-Name,

cn=sites,CN=Configuration,DC=cifs,DC=lab,DC=company,

DC=com.

CIFS GPO Trace: Domain DN: dc=CIFS,dc=LAB,dc=COMPANY,

dc=COM.

CIFS GPO Trace: Filer DN: cn=user1,ou=gpo_ou,dc=cifs,

dc=lab,dc=company,dc=com.

CIFS GPO Trace: Processing GPO[0]: T_sub.

CIFS: Warning for server \\LAB-A0: Connection terminated.

GPO trace messages are written to the console and message logs until GPO tracing is turned off.

Turn off GPO tracing by entering the following command:

options cifs.gpo.trace.enable off

Applying startup and shutdown scripts on a storage system

When GPOs have been enabled on a storage system and specified in the Active Directory domain, startup and shutdown scripts can applied to a group of systems in the following way:

When CIFS starts on a storage system, it retrieves GPOs from the domain controller--including startup and shutdown scripts--and runs the retrieved startup scripts.
The storage system accesses the scripts from the Domain Controller's sysvol directory and saves these files locally in the /etc/ad directory.
During a CIFS shutdown, CIFS executes the last retrieved shutdown script.
Note
Although the storage system periodically retrieves updates to the startup and shutdown scripts, startup scripts are not applied until the next time CIFS restarts.