SMB pool binding

Pool binding (Active Directory) stores the Active Directory identity of a pool (its computer account, Kerberos keys and NetBIOS name) on the pool itself. SMB clients then use Kerberos when connecting to the pool name (for example \\POOL-NAME or \\pool-name.domain) and keep that access after a failover or a pool move between cluster nodes, without re-joining the domain.

The section is located in Storage Settings → NAS settings, directly below SMB access. It has its own Apply button.

Requirements

• Active Directory authentication must be enabled and working. See the Active Directory authentication settings first.
• The pool should have a virtual IP address. A DNS record for the pool name pointing to the virtual IP address is registered automatically.

Usage

• Pool Binding

Select the pool to bind to Active Directory.

(None - Legacy Mode) means no binding. SMB then uses the identity of the node itself (the previous behaviour).

To bind a pool:

1. Navigate to Storage Settings → NAS settings and find the Pool binding (Active Directory) section.
2. Select the pool in the Pool Binding list.
3. Click Apply.

The pool joins Active Directory as its own computer account, named after the pool (upper case, maximum 15 characters). Applying the binding does not restart the SMB service.

To remove the binding, select (None - Legacy Mode) and click Apply. SMB returns to the identity of the node after the next restart of the SMB service, failover or reboot.

Connecting from clients

• Connect by the pool name so that Kerberos is used, for example \\POOL-NAME.
• By default, no service principal names (SPNs) are registered for IP addresses (this is the Windows behaviour). Connecting by IP address therefore uses NTLM.
• Optional: if your clients are configured with TryIPSPN, you can enable IP-address SPNs in the local console of the storage server: Console tools → Add-ons → Samba - special features → Register IP-address SPNs for pool <pool> VIP. The option can be used only on the node that currently holds the bound pool; on the other node it shows a notice instead. Switching it off (the default) offers to remove the existing IP-address SPNs of the pool from Active Directory.

Notes and limitations

• Only one pool can be bound.
• The binding does not separate the shares of other pools. Each node runs one SMB server for all pools mounted on it. On the node that holds the bound pool, shares of other pools on that node are also reachable under the name of the bound pool, but they do not move with it. On the other node, shares are served under the name of the node itself.
• NTLM logons to the pool name can be rejected by domain controllers that verify the NTLM target name (seen with Windows Server 2022). Use Kerberos by connecting by the pool name.