Selecting domain controllers and LDAP servers

About setting domain controllers

Upon startup and as listed below, your storage system searches for a Windows domain controller. This section describes how and when the storage system finds and selects domain controllers.

The storage system searches for domain controllers where any of the following is true:

The storage system has been started or rebooted.
A CIFS resetdc command has been issued.
Four hours have elapsed since the last search.
Note
Active Directory LDAP servers are searched for under the same conditions.

Understanding the domain controller discovery process

The following table describes the domain controller discovery process and priority groups. The storage system only progresses to a lower priority group when it has failed to contact all domain controllers in the priority group above it.

Note
For Active Directory environments, site membership is one of the criteria by which the storage system selects domain controllers (when no preferred domain controllers are available). Therefore, it is important to have the Sites and Services configured properly (with the storage system's subnet information included in the same site as the storage system).

Domain controller category	Priority groups: Order in which domain controllers are selected
Preferred Controllers in the `prefdc` list	Group 1 Preferred domain controllers are selected by the order in which the controllers appear in the prefdc list.
Favored Controllers that share the same Active Directory site membership with the storage system (This category is empty for storage systems in Windows NT environments.)	Group 2 Domain controllers from which a response was received within one second of being pinged, in the order of fastest response time
Group 3 Domain controllers that did not respond within one second, but share the same subnet as the storage system
Group 4 All non-local domain controllers that did not respond within one second of being pinged
Other Controllers that do not share site membership	Group 5 Domain controllers from which a response was received within one second of being pinged, in the order of fastest response time
Group 6 Domain controllers that did not respond within one second, but share the same subnet as the storage system
Group 7 All non-local domain controllers that did not respond within one second of being pinged

Domain controller category

Priority groups: Order in which domain controllers are selected

Preferred
Controllers in the prefdc list

Group 1

Preferred domain controllers are selected by the order in which the controllers appear in the prefdc list.

Favored
Controllers that share the same Active Directory site membership with the storage system

(This category is empty for storage systems in Windows NT environments.)

Group 2

Domain controllers from which a response was received within one second of being pinged, in the order of fastest response time

Group 3

Domain controllers that did not respond within one second, but share the same subnet as the storage system

Group 4

All non-local domain controllers that did not respond within one second of being pinged

Other
Controllers that do not share site membership

Group 5

Domain controllers from which a response was received within one second of being pinged, in the order of fastest response time

Group 6

Domain controllers that did not respond within one second, but share the same subnet as the storage system

Group 7

All non-local domain controllers that did not respond within one second of being pinged

Note
Because site membership is specific to Active Directory domains, there is no "favored" category for Windows NT4 domains, nor for mixed-mode domains in which your storage system is configured as an NT4 server. In these environments, all domain controllers found through discovery are assigned the category "other."

Specifying a list of preferred domain controllers and LDAP servers

To specify a list of preferred domain controllers and LDAP servers, complete the following step.

Step	Action
1	Enter the following command: *cifs prefdc add domain* address [address ...]** domain is the domain for which you want to specify domain controllers or LDAP servers. address is the IP address of the domain controller or LDAP server. Example The following example specifies two preferred domain controllers for the lab domain: cifs prefdc add lab 10.10.10.10 10.10.10.11 Note To force the storage system to use a revised list of preferred domain controllers, or LDAP servers, use the `cifs resetdc` command.

Step

Action

Enter the following command:

cifs prefdc add domain address [address ...]

domain is the domain for which you want to specify domain controllers or LDAP servers.

address is the IP address of the domain controller or LDAP server.

Example

The following example specifies two preferred domain controllers for the lab domain:

cifs prefdc add lab 10.10.10.10 10.10.10.11

Note
To force the storage system to use a revised list of preferred domain controllers, or LDAP servers, use the cifs resetdc command.

Deleting servers from the prefdc list

After you delete a domain from the prefdc list, you should always perform a cifs resetdc command to update the storage system's available domain controller information, as described in step 2 of the following procedure. The storage system does not update the domain controller discovery information from network services when the prefdc list is updated. Failure to reset the domain controller information can cause a connection failure, if the storage system tries to establish a connection with an unavailable domain controller (or LDAP server).

Note
NetApp storage systems do not automatically perform domain controller discovery operations upon restart; restarting the storage system does not update the available domain controller and LDAP server list.

To delete preferred domain controllers and LDAP servers, complete the following steps.

Step	Action
1	Enter the following command: cifs prefdc delete domain domain is the domain where the preferred domain controller or LDAP server resides. Example The following example deletes the preferred domain controllers for the lab domain: cifs prefdc delete lab
2	Enter the following command: *cifs resetdc [domain]* domain is the domain you specified in step one. The storage system disconnects and searches for a domain controller in the order specified in the revised `prefdc` list.

Step

Action

Enter the following command:

cifs prefdc delete domain

domain is the domain where the preferred domain controller or LDAP server resides.

Example

The following example deletes the preferred domain controllers for the lab domain:

cifs prefdc delete lab

Enter the following command:

cifs resetdc [domain]

domain is the domain you specified in step one.

The storage system disconnects and searches for a domain controller in the order specified in the revised prefdc list.

Troubleshooting domain controller connection

To troubleshoot and observe storage system domain to controller traffic, enable the cifs.trace_dc_connection storage system option. For usage information about this option, see the options(1) man page.

Displaying a list of preferred domain controllers

To display a list of preferred domain controllers, complete the following step.

Note
This procedure also displays LDAP connections.

Step	Action
1	Enter the following command: *cifs prefdc print [domain]* domain is the domain for which you want to display domain controllers. When a domain is not specified, this command displays preferred domain controllers for all domains. Example The following example displays the preferred domain controllers for the lab domain: cifs prefdc print lab

Step

Action

Enter the following command:

cifs prefdc print [domain]

domain is the domain for which you want to display domain controllers. When a domain is not specified, this command displays preferred domain controllers for all domains.

Example

The following example displays the preferred domain controllers for the lab domain:

cifs prefdc print lab

Reestablishing the storage system connection with a domain

To disconnect your storage system from the current domain controller and establish a connection between the storage system and a preferred domain controller, or to force domain controller discovery to update the list of available domain controllers, complete the following step.

Note
This procedure also reestablishes LDAP connections, and performs LDAP server discovery.

Step	Action
1	Enter the following command: cifs resetdc domain domain is the domain from which the storage system disconnects. If it is omitted, the storage system disconnects from the domain in which the storage system is installed. The storage system reestablishes a connection using the methodology described in Understanding the domain controller discovery process. Example The following example disconnects the storage system from the domain controllers for the lab domain: cifs resetdc lab

Step

Action

Enter the following command:

cifs resetdc domain

domain is the domain from which the storage system disconnects. If it is omitted, the storage system disconnects from the domain in which the storage system is installed.

The storage system reestablishes a connection using the methodology described in Understanding the domain controller discovery process.

Example

The following example disconnects the storage system from the domain controllers for the lab domain:

cifs resetdc lab