{"resourceId":"uc-berkeley-eecs-netapp-cifs-outage-ad-migration-20260814","versions":[{"version":"external-352c4832605f0f8870305c84b01eb3ec771bbdc9faa29727d60dc2a2e3d2a3fc","resource":{"id":"uc-berkeley-eecs-netapp-cifs-outage-ad-migration-20260814","title":"UC Berkeley EECS: NetApp CIFS home and project shares unavailable for about seven weeks during migration to Campus Active Directory","organization":"UC Berkeley EECS Instructional & Research Information Systems (IRIS)","sector":"Higher education: departmental research and instructional IT","geography":"Berkeley, California, USA","publishedAt":"Incident posted August 14, 2026; updates October 2 and October 7, 2026; resolved 2026-10-07","publicationDate":"2026-08-14","eventDate":"2026-10-07","sourceName":"UC Berkeley EECS IRIS","sourceLabel":"CIFS shares from Project/Home unavailable","sourceUrl":"https://iris.eecs.berkeley.edu/news/resolved-incidents/cifs-shares-from-project-home-unavailable/","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["infrastructure","data-security","operating-model"],"finding":"While migrating its NetApp fileservers from the sunsetting EECS Active Directory to the Campus Active Directory, EECS hit \"unexpected issues\" and CIFS (Windows/macOS) home and project shares were unavailable from the August 14 posting until CIFS was restored around October 1; NFS shares were unaffected. Users whose EECS and CalNet usernames differed needed further work, Windows groups had to be re-created in the Campus domain, and folder-level group permissions had to be reset. The incident was marked resolved on 2026-10-07.","sledRelevance":"Directly relevant to universities, state agencies and districts consolidating identity directories: storage access depends on identity mappings, and SMB access can fail for weeks. Any AI data-readiness or catalogue project relying on ACLs inherits this dependency.","evidence":"Operator-published incident log with dated updates; no root-cause detail, user counts or vendor attribution of fault.","architectureImplications":"Multiprotocol NAS: NFS and SMB depend on different identity paths; directory migration touched SMB only. Username mismatches between directories require mapping configuration.","governanceImplications":"Identity consolidation projects should treat file-share ACL migration as a first-class workstream with rollback criteria.","securityPrivacyImplications":"Re-creating Windows groups and resetting ownership risks over- or under-permissioning research and student data during transition.","caveats":"Single departmental incident; cause not specified and not attributed to NetApp product defects.","streamIds":["netapp","research"],"roles":{"sales":"Sales framing: this is a cautionary reference for any campus or agency planning directory consolidation. The lesson is that storage access depends on identity mapping, and an SMB outage lasted about seven weeks in a well-staffed department. A bounded migration-readiness review of ACLs, group mappings and username mismatches is a credible offer. Avoid blaming the platform; the incident log does not attribute the fault to NetApp, and no root cause is published.","engineering":"Engineering framing: before moving ONTAP CIFS servers between Active Directory domains, inventory SMB shares, ACLs that reference domain groups, and users whose names differ between directories. Plan name-mapping rules and group re-creation, and test in a non-production SVM. Note that NFS was unaffected, so multiprotocol estates need protocol-specific test plans. Capture permission snapshots so access can be restored or audited after migration.","delivery":"Delivery framing: treat directory migration as a staged cutover with user communication, a rollback point and a defined maximum outage. Assign ownership jointly to storage and identity teams, with a support path for users whose usernames do not match. Plan time for re-creating groups and resetting folder permissions, which EECS handled on an ongoing basis after service restoration. Acceptance should include access tests for representative home and project shares."},"roleDetails":{"sales":{"customerProblem":"Directory consolidation can break file-share access for weeks.","stakeholders":["Campus identity team","Departmental IT","Storage administrators","Research faculty and students"],"discoveryQuestions":["Are you consolidating AD domains in the next year?","How many SMB ACLs reference domain-specific groups?","Do usernames match across directories?"],"valueHypothesis":"A pre-migration ACL and identity mapping review may reduce outage duration risk.","potentialEngagement":"Migration-readiness assessment for ONTAP SMB shares.","unsupportedClaims":["That NetApp caused the outage","Any fixed outage-duration guarantee","AI relevance beyond ACL dependency"]},"engineering":{"fit":"Multiprotocol ONTAP estates undergoing AD changes.","architectureIntegration":"ONTAP CIFS servers joined to campus AD; NFS unaffected; name mapping for mismatched usernames.","prerequisites":["Share and ACL inventory","Group mapping plan","Test SVM"],"constraints":["Username mismatches","Folder-level group permissions","Campus-wide identity policies"],"security":"Avoid over-permissioning during group re-creation; snapshot ACLs before change.","proofOfValue":["Pilot migration on test shares","Verify access for mismatched usernames","Compare ACLs before and after"]},"delivery":{"work":"Staged AD migration of NAS SMB services.","dependencies":["Campus identity team","Departmental IT","User communications"],"ownership":"Departmental IT with campus identity team.","skillsAdoption":"Admins skilled in ONTAP CIFS and AD name mapping.","governanceCheckpoints":["Pre-migration readiness sign-off","Cutover go/no-go","Post-migration ACL audit"],"acceptanceCriteria":["Proposed: SMB outage below agreed maximum","Proposed: sampled shares accessible to correct groups","Proposed: all mismatched usernames mapped"],"risks":["Prolonged outage","Permission drift","User support load"]}},"retrievedAt":"2026-10-30T03:08:39Z","enrichedAt":"2026-10-30T03:12:55Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Interpretation: staff skills in storage, identity and security operations are the main workforce dependency; no accessibility findings in the source.","procurementImplications":"Interpretation: buy against documented, testable requirements and acceptance tests rather than vendor maxima.","operatingModelImplications":"Interpretation: ongoing operations sit with central or departmental IT storage teams; no change in operating model is reported by the source.","sourceVerification":{"openedUrl":"https://iris.eecs.berkeley.edu/news/resolved-incidents/cifs-shares-from-project-home-unavailable/","referenceExcerpt":"In that process, we’ve run into some unexpected issues, and are working with campus IT staff to resolve them.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}