Dell PowerStore Service Scripts Guide

PDF

Manage Dynamic Access Control (svc_nas nas_svc_dac)

This script enables you to manage Microsoft Dynamic Access Control (DAC), which allows you to establish access rules.

Usage

Function	System Operations
Mode	Service
Usage	Service
Requires service user password?	Yes
Requires root privileges?	No
May cause data unavailability?	Yes
May cause data loss?	No
Scope	Node
Prerequisites	None

Format

svc_nas nas_svc_dac [-h] [-e {ALL}] [-d {ALL}] [-s {ALL}] [--cap-staging-enable <value>] [cap-staging-disable <value>] [-v <value>] [-i --dn value {--dn <distinguished policy name>}] [-p <compname> --dn <value>] [-v <value>] [--delete <value>] [--add-recovery-rule <value> --rule-name <value> {--resource-condition <value>} {--effective-security <value>}] [--delete-recovery-rule <value> --rule-name <value> {--resource-condition <value>} {--effective-security <value>}]

Optional arguments

Table 1. Optional argumentsOptional arguments, their related descriptions, and any applicable variable usage.
Qualifier	Description
-h, --help	Show the help message and exit.
-e, --enable	Enable DAC on the system VDM. You must specify ALL.
-d, --disable	Disable DAC on the system VDM. You must specify ALL.
-s, --state	Show the current state of DAC on the system VDM. You must specify ALL.
--cap-staging-enable	Enable evaluation of proposed permissions for the system VDM.
--cap-staging-disable	Disable evaluation of proposed permissions for the system VDM. This setting is the default.
-v, --verbosity	Set the level for log messages associated with the system VDM. Specifying a dbg2 or dbg3 level reduces system performance.
-i, --info	Show details of all policies in the policy manager. svc_nas nas_svc_dac [-i \| --info <value>> You can specify a policy by adding the following: The distinguished name The policy ID
-p, --preload	Load the policy with the specified distinguished name into the policy manager associated with the Active Directory system name.
-r, --refresh	Refresh all policies in the policy manager associated with the Active Directory system name. Policies that no longer exist in the Active Directory are deleted.
-d, --delete	Delete the policy with the specified policy ID from the policy manager associated with the Active Directory system name.
--add-recovery-rule	Add a recovery rule with the specified distinguished name to the policy manager associated with the Active Directory system name. You can specify the following with this command: The rule name is the name of the new rule. --resource_condition is an expression that is used to determine the resources the new recovery rule applies to. Omitting this option (or specifying the empty string) means that the new rule is applicable to all resources. --effective security is an SDDL ACL that specifies the effective security for the new recovery rule.
--delete-recovery-rule	Delete a recovery rule with the specified distinguished name to the policy manager associated with the Active Directory system name.

Positional arguments

Qualifier	Description
--dn	Specify the distinguished name in the policy manager that is associated with the Active Directory computer name: svc_nas nas_svc_dac --info `<value>` --dn `<value>`
--id	Specify the policy in the policy manager associated with the Active Directory computer name: svc_nas nas_svc_dac --info `<value>` --id `<value>`
--rule-name	Add the name of the new rule: svc_nas nas_svc_dac --add-recovery-rule `<value>` --rule-name `<value>`
--resource-condition	Specify the resources to which the new recovery rule applies: svc_nas nas_svc_dac --resource-condition `<value>`
--effective-security	This SDDL ACL specifies the effective security for the new recovery rule: svc_nas nas_svc_dac effective-security `<value>`