Storage checklist for scanners supporting NetApp filers in 7-Mode
Technical Articles ID:
KB81982
Last Modified: 2023-04-12 08:52:44 Etc/GMT
Environment
Endpoint Security Storage Protection (ENSSP) 2.x
Summary
This article provides the ENSSP requirements for supporting NetApp filers in 7-Mode.
CAUTION: This article contains information about opening or modifying the registry.
- The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
- Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
- Do not run a REG file that is not confirmed to be a genuine registry import file.
NOTES:
- 7-Mode is the legacy operating mode for NetApp filers.
- NetApp ONTAP 8.2.1 and later filers can be configured to use the Clustered ONTAP Mode called C-Mode.
- ENSSP support on Windows:
- ENSSP on Windows 6.x can simultaneously handle different NetApp filers that are configured in either 7-Mode or C-Mode.
- ENSSP on Windows 5.x supports only 7-Mode.
- NetApp ONTAP 8.2.1 and later filers can still be configured to use 7-Mode.
Required customer information
This information is used in the subsequent checklist to verify that your environment is properly configured.
- Provide the user account that is being used for the ENSSP service:
- Active Directory Domain Administrator
- Domain User
- Local account
IMPORTANT: If you’re scanning non-domain NetApp filers with ENSSP, you need to set the server name to the ENSSP domain configuration field.
Check the following to identify the account:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\McAfee Endpoint Security Storage Protection
REG_SZ, ObjectName (ENSSP)
- Active Directory
- The Administrative Tool Computer Management | Local Users and Groups
- Identify whether the protocol File and Printer Sharing for Microsoft Networks is enabled on the network adapters used for communication with the filers. Check the settings via the properties of the appropriate network adapters.
- Identify whether the protocol NetBIOS over TCP/IP is enabled on the network adapters used for communication with the filers. Check the settings via the properties of the appropriate network adapters.
- Identify whether teamed Network Interface Cards (NICs) are enabled on the scanner by checking the properties of the appropriate network adapters.
- Determine the number of discrete filer IP addresses that send scan requests directly to this scanner.
Customer/Agent checklist to make sure that your environment is correctly configured:
- Verify whether teamed NICs are enabled on the scanner by viewing the properties of the appropriate network adapters in the Windows graphical user interface.
|
- Verify that the Maximum scan time (seconds) is set to 55 seconds.
Requirement source: Microsoft, NetApp, Trellix
The default is 60 seconds; change it to 55.
From the ePO console:
- View the properties of the Network Appliance Filer AV Scanner.
- Select the Performance tab.
- Select Scan Time, and then Maximum scan time (seconds). This setting prevents the Common Internet File System (CIFS) protocol on the originating user's end node from timing out before the scan request result.
NOTE: The Microsoft Windows default CIFS timeout in currently supported Windows versions is 60 seconds.
Related documents:
|
- Verify that the Number of scan threads is greater than or equal to 50 (number of connecting NetApp IP addresses).
Requirement Source: NetApp
- A typical NetApp OnTap filer can issue 50 simultaneous scan requests per IP address, although this ability might change depending on the device (see the NetApp OnTap documentation).
- Determine the aggregate maximum potential number of outgoing scan requests for all NetApp OnTap filers that register with a particular scanner.
- Make sure that the number of scan threads configured in that particular scanner's ENSSP NetApp settings matches the aggregate maximum potential number.
- ENSSP can be configured with a maximum of 800 threads. So, a single scanner can be configured to handle scan requests from a maximum of 16 NetApp OnTap filers.
Related document:
NetApp article: Recommended value for vscan options timeout
|
- Review the following File and Printer Sharing for Microsoft Networks protocol requirements:
Requirement source: Trellix
The protocol File and Printer Sharing for Microsoft Networks must be enabled on the network adapters used for communication with the storage appliances. Confirm this using either of the following steps:
- In the Windows graphical user interface, view the properties of the appropriate network adapters.
- Use regedit.exe, a combination of regedit.exe and wmic.exe, or a Minimum Escalation Requirements (MER).
wmic.exe:
- Open a command prompt with Administrator escalation.
- Type the following and press Enter:
wmic nicconfig get Description,IPAddress,SettingID
The combination of the displayed information is usually sufficient to determine the GUID of the intended network adapter.
regedit.exe:
- Open regedit.exe and navigate to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards
One or more of the randomly named subkeys have a Description value matching the hardware description of the intended network adapter.
If there’s only one Description value matching the intended network adapter, the data in the ServiceName value is the GUID of the intended network adapter.
If there are multiple network adapters with the same Description as the intended network adapter, further discrimination is required. Continue to the next step.
- Pick the first key with a Description that matches the intended network adapter.
- Record the ServiceName value and use it as the GUID value in the remaining steps below.
- Navigate to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network
- There are one or more subkeys named for random GUIDs. Expand each one in turn until a subkey with the name GUID is found.
- Navigate to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{Random GUID}\Connection
If the Name value matches the intended network adapter, the GUID determined above is the GUID of the intended network adapter.
If the Name value doesn't match the intended network adapter, the GUID determined above isn’t the GUID of the intended network adapter.
- Repeat the previous steps, considering the second key with a Description that matches the intended network adapter. Wait until the GUID of the intended network adapter is determined.
- Determine whether the protocol File and Printer Sharing for Microsoft Networks is bound to a network adapter. In regedit.exe, navigate to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage
If the Bind value contains the GUID of the network adapter, the protocol is bound to the network adapter.
For deployment of McAfee Agent / Trellix Agent (MA / TA) to a scanner, enable the File and Printer Sharing for Microsoft Networks protocol unless the scanners are wholly unmanaged by ePO or an MA / TA installation is performed manually. For more information, see KB56386 - Push Agent Installation Program to 'computer_name' Fail!
After deployment of MA / TA has concluded, this protocol remains necessary for NetApp OnTap RPC functionality.
Requirement source: NetApp
NOTES:
- These NetApp articles are ambiguous if enabling this protocol is only:
- A legacy break-fix
- For Windows Server 5.x and down-level OnTap versions noted in the NetApp articles
- NetApp confirms that this protocol is still necessary on all Windows versions.
- NetApp confirms that the articles regarding this topic aren’t updated.
|
- The NetBIOS over TCP/IP protocol must be enabled on the network adapters used for communication with the storage appliances.
Confirm this using either of the following options:
- Option 1: In the Windows graphical user interface, view the properties of the appropriate network adapters.
- Option 2: Determine the NetBIOS over TCP/IP configuration of the network adapter:
- Determine the GUID of the network adapter (per the File and Printer Sharing for Microsoft networks section above).
- In regedit.exe, navigate to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_GUID
The Netbios Options value indicates the configuration:
0 = Specifies that the Dynamic Host Configuration Protocol (DHCP) NetBIOS over TCP/IP setting is used if available.
1 = Specifies that NetBIOS over TCP/IP is enabled. This value is the default if DHCP isn’t available.
2 = Specifies that NetBIOS over TCP/IP is disabled.
Requirement Source: NetApp
NOTES:
- This NetApp article is ambiguous if enabling this protocol is only:
- A legacy break-fix
- For Windows Server 5.x and down-level OnTap versions noted in the NetApp KB
- NetApp isn't able to confirm if this protocol is still needed on any Windows versions.
- NetApp isn't able to confirm if this protocol is still needed on any Windows versions that NetApp recommends to enable the protocol.
- NetApp confirms that the articles regarding this topic aren’t updated.
|
- Prevent SMB2 traffic between Windows 6.x scanners and NetApp OnTap 8.1.2 or down-level filers.
Requirement source: NetApp and Trellix
If a Windows Server 6.x scanner services any down-level filers, SMB2 traffic must be prevented between Windows Server 6.x scanners and down-level filers:
- NetApp OnTap 8.1.2 or down-level filers are down-level filers.
- NetApp OnTap 8.1.3 or up-level filers are up-level filers.
IMPORTANT: We and NetApp both recommend disabling SMB2 on all scanners because SMB2+ brings no value to scanning operations, but can disrupt them.
Choose one of the following options:
Option 1 — Environment contains Windows Server 6.x scanners, and down-level and up-level filers:
- Disable SMB2 on any down-level filers on any network interfaces that communicate with Windows 6.x scanners.
- SMB2 can be enabled on any Windows 6.x scanners that service down-level filers, but also simultaneously service up-level filers.
This option allows SMB2 traffic generated from up-level filers while making sure that no down-level filers ever connect with Windows Server 6.x scanners using SMB2.
Option 2 — Environment contains Windows Server 6.x scanners, and down-level and up-level filers:
- SMB2 can be enabled on any down-level filers on the network interface that communicates with Windows 6.x scanners.
- Disable SMB2 on any Windows 6.x scanners that service any down-level filers.
This option prevents NetApp OnTap filers of any version from ever connecting using SMB2 with a Windows Server 6.x scanner that services both up-level and down-level filers. It also allows any Windows Server 6.x scanner that services only up-level filers to connect using SMB2.
Option 3 — Environment contains Windows Server 6.x scanners and down-level filers only:
- Disable SMB2 on any Windows 6.x scanners. This action prevents SMB2 traffic.
Requirement source: NetApp
- NetApp OnTap uses the SMB protocols to communicate with third-party scanners.
- The NetApp OnTap SMB2 implementation on down-level filers isn’t fully Microsoft-compliant.
- NetApp recommends that SMB2 is always disabled.
- SMB2 use provides no benefit in this use scenario.
- Disabling SMB2 makes sure that no legacy issues are encountered.
Related documents:
- NetApp Bug ID 470972
- NetApp Bug ID 474548
- If SMB2 needs to be disabled on a Windows Server 6.x scanner, the following registry value must be added:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters
- SMB2
- REG_DWORD '0'
Related document:
Microsoft article: How to disable SMB2
IMPORTANT: The scanner must be restarted for this configuration change to take effect.
|
- The named pipe NTAPVSRQ must be accessible anonymously:
Requirement source: NetApp
- NetApp confirms that the named pipe NTAPVSRQ must always be accessible anonymously on all Windows versions.
- Without this anonymously accessible named pipe, Kerberos and NTLM operations are negatively affected.
NOTES:
- The NetApp article is ambiguous if this setting is a legacy condition only for Windows Server 5.x scanners and down-level OnTap versions noted in the NetApp article.
- NetApp confirms that the articles regarding this topic aren’t updated.
Requirement source: Trellix
- Our previous documentation is invalidated by the NetApp confirmation above.
- Our document previously stated the following:
The named pipe NTAPVSRQ must be accessible anonymously if the filer and scanners are members of different Active Directory domains.
The named pipe NTAPVSRQ must be accessible anonymously on Windows Server 6.x scanners.
NOTE: The Product Guide is ambiguous if this setting is a legacy condition only for Windows Server 6.0 scanners noted in the Product Guide.
You must choose one of the following group policy options (Active Directory or Local), which establishes anonymous access for the named pipe NTAPVSRQ:
Option 1 — Active Directory Group Policy Objects (GPO):
- Click Start, type cmd in the Search bar, and click OK.
- At the command prompt, type rsop.msc and press Enter:
- In the left pane, expand Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies, Security Options.
- In the right pane, locate the policy option: Network Access: Named Pipes that can be accessed anonymously:
- Right-click the policy option and select Properties.
- On the Security Policy Setting tab, under the Define this policy setting in the template section, add NTAPVSRQ.
Option 2 — Local GPO:
- Click Start, type cmd in the Search bar, and click OK.
- At the command prompt, type rsop.msc and press Enter.
- In the left pane, expand Computer Configuration, Windows Settings, Windows Settings, Security Settings, Local Policies, Security Options.
- In the right pane, locate the policy option: Network Access: Named Pipes that can be accessed anonymously
- Right-click the policy option and select Properties.
- On the Security Policy Setting tab, under the Define this policy setting in the template section, add NTAPVSRQ.
Regardless of the method you choose, on group policy enforcement, or if you use gpupdate.exe /force, GPO sets the following to any pre-existing content in this registry value:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters
- NullSessionPipes
- REG_MULTI_SZ 'NTAPVSRQ'
If you make the setting via Active Directory or Local group policy, the scanner doesn't need to be restarted for this configuration change to take effect.
|
- Verify that the Everyone group token is added to the Anonymous user's access tokens on Windows 6.x scanners.
Requirement source: NetApp
The RPC protocol that NetApp OnTap uses to communicate with Windows 6.x scanners requires this token setting.
Related document: NetApp Bug ID 512535
NOTES: The NetApp Bug Report is ambiguous if this setting is only for Windows Server 6.0, as noted in the NetApp article.
- NetApp confirms that the Bug Report regarding this issue isn’t updated.
- NetApp states that this setting is needed on all Windows versions.
- NetApp reports null session pipe and Kerberos problems if the tokens aren’t set.
Contrary to NetApp, we believe that:
- This setting is needed on Windows 6.x scanners.
- The setting is related to Integrity levels implemented in Windows 6.x.
- This setting is unnecessary on Windows 5.x scanners. The setting is related to Integrity levels and Integrity levels aren’t implemented in Windows 5.x.
Related document:
Microsoft article: Integrity mechanism reference
You must choose one of the following options establishing the token on Windows 6.x scanners:
Option 1 — Active Directory GPO:
- Click Start, type cmd in the Search bar, and click OK.
- At the command prompt, type rsop.msc and press Enter.
- In the left pane, expand Computer Configuration, Policies, Windows Settings, Security Settings, Local Policies, Security Options.
- In the right pane, locate the policy option: Network Access: Let Everyone permissions apply to anonymous users:
- Right-click the policy option and select Properties.
- On the Security Policy Setting tab, under the section Define this policy setting, select Enabled.
Option 2 — Local GPO
IMPORTANT: Make sure that Active Directory GPOs don't overwrite the local GPO.
- Click Start, type cmd in the Search bar, and click OK.
- At the command prompt, type rsop.msc and press Enter.
- In the left pane, expand Computer Configuration, Windows Settings, Windows Settings, Security Settings, Local Policies, Security Options.
- In the right pane, locate the policy option: Network Access: Let Everyone permissions apply to anonymous users:
- Right-click the policy option and select Properties.
- On the Security Policy Setting tab, under the Define this policy setting section, select Enabled.
Regardless of the method chosen, on group policy enforcement, or if you use gpupdate.exe /force, GPO sets the following in this registry value:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
- everyoneincludesanonymous
- REG_DWORD '1'
Related Document:
Microsoft article: Let Everyone permissions apply to anonymous users
If you make the setting via Active Directory or Local group policy, the scanner doesn't need to be restarted for this configuration change to take effect.
|
- Check whether teamed NICs are enabled on the scanner while the fastpath option is enabled on the filer.
Requirement source: NetApp
- Fastpath can result in disconnections with scanners that implement teamed NICs.
- The error codes vary randomly depending on what operation is in progress during disconnection.
- NetApp reports that some third-party NIC driver bugs also manifest when you use teamed NICs.
Under these conditions, you must choose one or both of the following options for troubleshooting:
Option 1 — At the filer:
At the filer's console, execute the following: options ip.fastpath.enable off
NOTE: If the problem is resolved, this setting can be permanent if other fastpath benefits aren’t required (contact NetApp Technical Support).
Option 2 — At the scanner:
Disable teamed NICs on the scanner.
NOTE: If the problem is resolved, this setting can be permanent if other teamed NIC benefits aren’t needed.
Related documents:
|
- Confirm whether the ENSSP Scan Server is configured to use Server SPN target name validation level. If it is, disable this option.
Option 1 — Active Directory GPO:
- Open the Group Policy Management Console (gpmc.msc).
- Click Computer Configuration, Windows Settings, Local Policies, Security Options.
- Select Microsoft Network Server: Server SPN target name validation level.
- For the GPO object that applies to the ENSSP Scan Server, set the option to either:
Disabled
Or
Not Defined
Option 2 — Edit Local Security Policy on the ENSSP Scan Server:
- Click Start, type secpol.msc in the Search bar, then press Enter.
- Under Security Settings expand Local Policies, Security Options.
- Scroll down and locate Microsoft Network Server: Server SPN target name validation level.
- Set this option to either:
Disabled
Or
Not Defined
- Click Apply, OK.
- Close the Local Security Policy window.
Option 3 — Or, change the registry setting SmbServerNameHardeningLevel to 0:
CAUTION: This article contains information about opening or modifying the registry.
- The following information is intended for System Administrators. Registry modifications are irreversible and could cause system failure if done incorrectly.
- Before proceeding, Technical Support strongly recommends that you back up your registry and understand the restore process. For more information, see the Microsoft Windows registry information for advanced users article.
- Do not run a REG file that is not confirmed to be a genuine registry import file.
- Click Start, type regedit in the Search bar, and then press Enter.
- Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\
- Right-click SmbServerNameHardeningLevel and select Modify.
- Set the value to 0, then click OK.
- Close the registry editor.
|
|
