PowerScale

How to Create a CIFS Share in PowerScale: Step-by-Step

Manoj Patel
Dell PowerScale OneFS CIFS SMB share creation and management interface illustration.

Deploying file services across enterprise environments requires robust multi-tenancy, granular security controls, and seamless Active Directory integration. Dell PowerScale (formerly Isilon) handles Windows file sharing through Server Message Block (SMB) and Common Internet File System (CIFS) protocols. Whether you are migrating data or provisioning new storage pools, knowing how to create a CIFS share in PowerScale properly ensures optimal data accessibility and security.

PowerScale OneFS provides two primary management interfaces for administrator operations: the Web Administration Interface (WebUI) and the Command Line Interface (CLI). In this comprehensive guide, we will cover the foundational architecture of PowerScale SMB shares, walk step-by-step through WebUI and CLI creation methods, and configure advanced security features like Access Based Enumeration (ABE) and NTFS ACLs.

Proper Access Zone routing and ACL mapping are critical to avoiding authentication lockouts and file access errors in multi-tenant environments.

Understanding CIFS/SMB Shares in Dell PowerScale

In Dell PowerScale OneFS, SMB/CIFS shares do not exist as isolated system folders. Instead, every SMB share is intrinsically bound to a specific Access Zone. Access Zones provide multi-tenancy by partitioning cluster resources, authentication providers, and network interfaces into isolated virtual instances.

When client workstations request access to an SMB share, OneFS evaluates the incoming connection based on the SmartConnect zone or IP address associated with that specific Access Zone. This architecture allows organizations to host multiple Active Directory domains, local user databases, or isolated departmental shares on a single physical cluster without cross-tenant visibility.

Furthermore, PowerScale separates file sharing into two logical security layers: share-level permissions (SMB ACLs) and filesystem-level permissions (NTFS ACLs or POSIX bits). Understanding this distinction is vital before creating network shares for production users. If you also manage UNIX/Linux file export workflows on the same cluster, refer to our guide on Creating NFS Shares in Dell EMC Isilon OneFS to see how NFS exports interact with multiprotocol permission models.

Prerequisites and Setup Requirements

Before creating SMB shares in OneFS, verify that your cluster environment satisfies the following operational prerequisites:

  • Windows Active Directory Integration PowerScale: Ensure the target Access Zone is joined to your Active Directory domain via Kerberos/NTLM authentication. Navigate to Access > Authentication Providers to confirm active domain status.
  • Storage Pool Provisioning: The target directory path (e.g., /ifs/data/finance) must already exist or be created during the setup workflow.
  • Administrative Privileges: Your OneFS user account must hold the ISI_PRIV_SMB and ISI_PRIV_AUTH privileges, typically granted via the ZoneAdmin or SystemAdmin roles.
  • Network Connectivity: Ensure client subnets can reach the cluster’s SmartConnect SIP and node IP addresses on TCP port 445 (SMB) and standard AD authentication ports.

Step 1: Configure Access Zones and Directory Paths

All SMB share definitions require a valid path under the OneFS file system hierarchy (always starting under /ifs) and a designated Access Zone. By default, OneFS routes unassigned traffic to the System zone, but enterprise deployments typically utilize custom Access Zones (e.g., Zone_Corporate or Zone_Finance).

To verify existing Access Zones and prepare your directory structure, execute the following workflow:

  1. Log into the OneFS management interface or SSH session.
  2. Verify the target directory exists on /ifs. If creating a new directory path, use the shell command: mkdir -p /ifs/data/marketing.
  3. Confirm the correct Access Zone scope. Working within the wrong Access Zone will prevent AD users from authenticating or discovering the share over DNS.

For large-scale disaster recovery or multi-site cluster replication, ensure that your underlying directory paths align with your replication jobs. Learn more about configuring replication policies in our tutorial on How to Create SyncIQ Policies in PowerScale.

Step 2: Create the CIFS Share via OneFS WebUI

The Dell PowerScale OneFS WebUI offers an intuitive graphical interface for share creation, permission assignment, and parameter adjustments.

Defining Share Name, Path, and Description

Follow these steps to build a new SMB share through the WebUI interface:

  1. Open your web browser and navigate to the OneFS WebUI URL (e.g., https://powerscale-cluster.domain.com:8080).
  2. From the top navigation menu, select Protocols > SMB Shares.
  3. In the upper-right corner, select the desired Access Zone from the drop-down selector (e.g., System or custom zone).
  4. Click the button labeled Create an SMB Share.
  5. In the Share Name field, enter a clear, descriptive name (e.g., MarketingData). This is the UNC share path name Windows clients will type (e.g., \\cluster\MarketingData).
  6. In the Directory Path field, enter or browse to the exact path on the cluster (e.g., /ifs/data/marketing).
  7. Optionally, add a Description to document the share owner, department, or ticket identifier.

Configuring Basic Share Permissions and ACLs

After defining the path, scroll down to the Permissions section to set PowerScale SMB permissions (share-level ACLs):

  1. By default, OneFS assigns Full Control to Everyone at the share layer. For production environments, remove the Everyone group or reduce its scope to Read.
  2. Click Add a user or group to add Active Directory security groups (e.g., DOMAIN\Marketing-Users).
  3. Assign appropriate permission levels: Read, Change, or Full Control.
  4. Review your settings and click Save Share to create the SMB share immediately.

Step 3: Create the CIFS Share via OneFS CLI

For administrators who prefer automation, script execution, or headless deployment, the OneFS Command Line Interface (CLI) provides fast and repeatable share provisioning.

Connect to any cluster node via SSH using an administrative account. The core utility for SMB management is isi sharing smb shares.

Command Line For Creating CIFS Share

To create an SMB share using the OneFS CLI tool, use the isi sharing smb shares create command. Here is the syntax and standard execution command:

isi sharing smb shares create --name=MarketingData \
  --path=/ifs/data/marketing \
  --zone=System \
  --description="Marketing Department CIFS Share" \
  --create-path

To grant specific SMB ACL management permissions directly during creation or via subcommands, execute:

isi sharing smb shares permission modify MarketingData \
  --permission-type=allow \
  --permission=full \
  --group="DOMAIN\Marketing-Admins" \
  --zone=System

To view the configuration parameters of your newly created SMB share, run:

isi sharing smb shares view MarketingData --zone=System

Using CLI automation allows storage engineers to quickly roll out dozens of standardized shares across enterprise storage platforms. If you are comparing scale-out NAS architecture against block-level arrays, consult our technical deep-dive on Dell PowerStore Architecture.

Step 4: Configure Advanced SMB Share Settings

Once the base SMB share is functional, configuring advanced settings improves data security and simplifies directory browsing for end-users.

Enabling Access Based Enumeration (ABE)

Access Based Enumeration OneFS hides files and folders from users who do not have read permissions for those objects. Without ABE, users can see all directory names inside a share even if double-clicking them results in an “Access Denied” error.

To enable ABE in the WebUI:

  • Navigate to Protocols > SMB Shares.
  • Locate your share, click View/Edit, and expand Advanced Settings.
  • Check the box for Access Based Enumeration (ABE).
  • Click Save Changes.

To enable ABE via the OneFS CLI, run:

isi sharing smb shares modify MarketingData --access-based-enumeration=true --zone=System

Managing File-Level Permissions and NTFS Security

Remember that share-level permissions act only as the outer boundary filter. Final permission evaluation in Windows environments relies on filesystem NTFS security (ACLs).

To manage NTFS ACLs for a PowerScale CIFS share:

  1. Map the share on a Windows admin host: net use Z: \\cluster-name\MarketingData.
  2. Right-click the mapped drive or folder, select Properties, and go to the Security tab.
  3. Add Active Directory groups and assign granular NTFS permissions (e.g., Read & Execute, Modify, Full Control).
  4. OneFS translates these Windows ACLs natively into its underlying file system security engine.

Always enforce the principle of least privilege by locking down file-level NTFS ACLs rather than relying solely on share-level permissions.

Troubleshooting Common PowerScale CIFS Creation Issues

When learning how to create a CIFS share in PowerScale, you may run into authentication or mapping errors. Here are the most frequent failure modes and how to resolve them:

  • Access Zone Mismatch: If clients receive “Network Path Not Found”, verify that the client IP connects through a SmartConnect zone assigned to the exact Access Zone where the share was created.
  • Unmapped Active Directory Domain Users: If users are prompted for credentials repeatedly, check domain join status using isi auth ads view. Ensure DNS servers on PowerScale can resolve domain controllers.
  • Missing Directory Path: Creating a share pointing to a non-existent path will throw an error unless --create-path is supplied in CLI or created manually prior to WebUI setup.
  • Permission Denied on Connection: Ensure both SMB share ACLs and filesystem NTFS permissions permit the user’s AD group. The effective permission is always the most restrictive combination of Share ACL + NTFS ACL.

For official technical documentation and release specifications, consult the Dell PowerScale OneFS Documentation.

Next Steps: Testing Access and Auditing SMB Shares

After creating and securing your CIFS share, perform validation tests prior to handing the share over to end-users:

  1. Test UNC Access: From a client machine logged in as a domain user, test access via File Explorer using \\<smartconnect-name>\<share-name>.
  2. Test Permission Limits: Attempt to create, rename, and delete a test text file to confirm write permissions function as designed.
  3. Audit SMB Sessions: On the PowerScale cluster, view active client connections using the CLI command: isi smb sessions list.

Frequently Asked Questions (FAQs)

What is the difference between SMB share permissions and NTFS permissions in PowerScale?

SMB share permissions (share ACLs) control initial network access at the entry point of the share. NTFS permissions (filesystem ACLs) control access to individual files and subfolders within the directory structure. PowerScale evaluates both layers and applies the most restrictive result.

Why are users getting “Access Denied” when connecting to a newly created CIFS share?

This usually occurs due to an Access Zone mismatch, unmapped Active Directory credentials, or restrictive filesystem permissions on the underlying directory path under /ifs. Ensure the client IP routes to the correct Access Zone and that the user’s AD group is granted access in both SMB share permissions and NTFS security settings.

How do I enable Access Based Enumeration (ABE) on an existing PowerScale SMB share?

In the OneFS WebUI, go to Protocols > SMB Shares, edit the target share, expand Advanced Settings, and check Access Based Enumeration (ABE). In the CLI, run isi sharing smb shares modify <share-name> --access-based-enumeration=true --zone=<zone-name>.

Can I map multiple Active Directory domains to different CIFS shares on the same PowerScale cluster?

Yes. PowerScale uses Access Zones to support multi-tenancy. You can create separate Access Zones, join each zone to a different Active Directory domain, and bind specific SMB shares to their corresponding Access Zones.

Key Takeaways

  • PowerScale SMB/CIFS shares must always be assigned to a specific Access Zone for correct AD authentication and tenant isolation.
  • You can create shares using either the OneFS WebUI (Protocols > SMB Shares) or the CLI (isi sharing smb shares create).
  • Share permissions (SMB ACLs) and filesystem permissions (NTFS ACLs) work together; effective access is always the most restrictive intersection.
  • Enabling Access Based Enumeration (ABE) prevents users from seeing folders they lack rights to open.
  • Use isi smb sessions list to verify active SMB connections and troubleshoot authentication issues.

Conclusion

Creating and managing CIFS shares in Dell PowerScale OneFS is a fundamental administration skill for enterprise storage engineers. By properly configuring Access Zones, combining share ACLs with NTFS file-level security, and enabling Access Based Enumeration, you ensure high performance, security, and multi-tenant isolation across your storage infrastructure. Follow the step-by-step procedures outlined in this guide to provision secure, high-performing SMB shares for your organization.

Related Posts