Sep 192020
 

 I recently converted from VMware to AHV, and I wanted to show how I did Nutanix Files 3.7 with FSlogix. While I haven’t moved everything over yet, but I have tested this very hard, and it’s solid as iron. I still use VMware for my datacenter servers, but we wanted our Citrix Environment on all Nutanix because it’s a solid product, and it’s simplified so that we can focus in other areas. This is how I did it, and I have learned a lot so far in the process. I am by far no expert and this is for beginners like myself. I had a lot of help from the Nutanix Slack EUC channel, and especially Jarian Gibson.  This is a single site, which is 3 FSVM only. 

In regard to setting up Nutanix Files, this video is very useful.

Nutanix Files – Shares are not accessible from clients that are on the same subnet with Nutanix Files storage network

https://portal.nutanix.com/page/documents/kbs/details?targetId=kA00e000000LLtGCAW

*****Client access network must not be on the Storage network. ****

Does not work:

File Client 10.50.175.0/21

Files Access Network 10.50.105.0/24

Files Storage Network 10.50.175.0/21

Works:

File Client 10.50.175.0/21

Files Access Network 10.50.175.0/21

Files Storage Network 10.50.105.0/24

Make sure that either the client is on a subnet different from the Storage Network or that all three the client, Files access Network, and Files storage network IP addresses belong to the same subnet.

The screenshot on deploying Files is very high level. The video will help you understand more.

For me, all I wanted was SMB. Then insert a username and password so it can join AD

I left this blank

For the DNS and Naming, at first, I did this (automatic)

But I had some bad reverse PRT issues. So, I fixed them, then went and manually added it.

I mad them Static Records. 

Then I clicked on verify, and it was good.

Here is a Pic I found from Christainn Binkhoff site that gave a logical understanding of the layout.

Machine generated alternative text:
Outlook OST, 
Windows Search DB, 
OneDrive Cache, S4B 
GAL 
SMB & NFS 
SMB

I read a lot of material on 3.6 and one of the things I found was this

https://portal.nutanix.com/page/documents/details/?targetId=Files-v3_6:Files-v3_6

Ensure that the client and storage networks use a tagged VLAN. The client and storage networks must have separate subnets if the networks are not the same. If the same network is used for both clients and storage, then IP addresses must be unique. Clients on the same subnet as the storage network will not be able to access the shares or exports.

I am not 100% if this applies to 3.7, But I followed it anyway to make sure I had no issues.

Overview of the bigger picture.

The CVM and FSVM layer

Nutanix Files VMs have access to two networks:

  • External network – it is used by clients and external services communication
  • Storage or internal network – it is used for communication between Files VM and the Nutanix cluster.

The FSVM layer and communication

I used Prism element to configure this

Create the Nutanix Files – File Share

open the file server menu in Prism Element and click on Create a Share/Export in the top right-hand corner

You need to open the file server menu in Prism and click on Create a Share/Export to get in the list 

The name of the share will be the share name within the UNC path to the share of the Files

An example of my File Share is “FSLogix_Office_Containers”

After putting in the information above, you have the option to configure Access Based Enumeration to hide other FSLogix Office 365 folders/User Profiles from other users.

ABE can be compared with the Access Based Enumeration setting within Windows File Services as well

 *Note*

The CLI run afs smb.set_conf “restrict nonamdin access” “no” section=global” isn’t needed for Files 3.7. I reached out to Jarian Gibson to confirm this as well. Thanks, Jarian!

 As I learned you will want to use distributed for Profiles. The explanation is below, and it is explained well.

Machine generated alternative text:
Basics 
Create a share/export 
Settings 
o 
o 
use "Distributed" share/export type instead of "Standard" 
aest suited for home directories. user profiles and application folderx This 
option distributes top-level directories across Fileserver VMS and allovvs for 
increased capacity and user connectionx 
Note that only folders can be created at the root and these top-level folders must 
be managed using Nutanix Files MMC plugin and can be downloaded from 
ated. a distributed share/export cannot be downgraded to standarff 
Enable Self Service Restore 
Enable File System Compression 
Enable Access Based Enumeration (ABE) 
Blocked File Types 
You can also block file types on the file serveNaII shares) from file server update 
Encrypt SMB3 Messages 
Cancel
Machine generated alternative text:
Create a share/export 
Summary 
Basics 
File Server 
Share/export Name 
Share/export Path 
Protocol 
Max Size 
Share/export Type 
File System Compression 
Encrypt SMB3 Messages 
Citrix Profiles 
'Citrix Profiles 
SMB 
Distributed 
Not Enabled
Machine generated alternative text:
Protocol Settings 
PROPERTH 
Authentication 
Client Access 
ABE 
Self Service 
Restore 
SMS PROTOCOL 
Kerberos {AD) 
Read-write 
NFS PROTOCOL 
Cancel 
Create

Shares

Machine generated alternative text:
Ck access 
sktop 
lbvn/oads 
Disk C:) 
:uments

Now Download MMC from Nutanix to manage permissions. I found out that I still could manage permission for what I was trying to achieve. Once again I reached out to slack around this and it for TLD permission as René Bigler explained it to me. Thank you again

https://portal.nutanix.com/page/documents/details?targetId=Files-MMC-Plugin-v3:Files-MMC-Plugin-v3

Share permission you can’t change. You will need to control it with NTFS. I was updated by Jarian that you can modify shares.  But you need to open MMC and add the Share Snapin. 

“if you want to change share permissions from the default of Everyone full control you have to use Shared Folders MMC snap-in. If you don’t change default share permissions, then NTFS permissions will take precedence.”

Typically, on a windows file share, I removed everyone, and lock it down with a group instead. It’s just something I have always done, and it just me. However, it’s not needed if the NTFS permission is set up correctly. 

Screenshot from an example that was shown to me.

As you can see now, You can do this.

Set the NTFS Permissions on the Nutanix Files share

Make sure that the following best practices NTFS rights are set on the Nutanix Files – file share location. The procedure is the same as for a normal Windows File Server but now on the Nutanix Files namespace folder share

Open the File Share and open the Security properties

 NTFS permission Table

Machine generated alternative text:
User Account 
CREATOR OWNER 
SYSTEM 
Administrator 
users 
users 
users 
Users 
Folder 
Subfolders and Files Only 
This Folder, Subfolders and Files 
This Folder, Subfolders and Files 
This Folder Only 
This Folder Only 
This Folder Only 
This Folder On 
Permissions 
Full Control 
Full Control 
Full Control 
Create Folder/write Data 
List Folder/Read Data 
Read Attributes 
Traverse Folder/Execute File

This is how did it below

Machine generated alternative text:
Name: 
Ouuner: 
Advanced Security Settings for 
D... 
Administrators 
dministrators) Change 
Permissions 
For additional information, 
Permission entries: 
Auditing 
Effective Access 
double-click a permission entry. To modify a permission entry, select the entry and click Edit (if available). 
Type 
Allow 
Allow 
Allow 
Allow 
Allow 
Allow 
Princi 
Administrators 
CREATOR OWNER 
Domain Admins 
SYSTEM 
IT Service Desk Maint 
Authenticated Users 
Access 
Full control 
Full control 
Full control 
Full control 
Modify 
Read, write & execute 
Inherited from 
None 
None 
None 
None 
Applies to 
This folder, subfolders and files 
Subfolders and files only 
This folder, subfolders and files 
This folder, subfolders and files 
This folder, subfolders and files 
This folder only 
Enable inheritance 
Replace all child object permission entries wuith inheritable permission entries from this object

Here is my GPO for around Fslogix (Again this is for RDSH 2016 and windows 10 1607/1809. Remember Server 2019 will be different. So please don’t enable Search in the GPO for Server 2019. 

C:\Users\LOCAL_~4\Temp\5\msohtmlclip1\02\clip_image011.png
Machine generated alternative text:
nclude Outkok geronalizatbn data in container 
nclude Outbok personalization data in container 
nclude Sharecoint data in container 
nclude Sharepoint data in container 
nclude Skype data in container 
nclude Skype data in container 
NW-tier of ger&ssBn VH DS to persist 
Nunter of ger&ssion VH DS to persist 
Store earch databaæ in Of-fee 365 container 
sync OST to VFD 
VH D kcatBn 
VH D bcation 
Virtual disk type 
Offwe 365 and Directory Naning 
Swap dirætory n.ane 
Swap directory nanz convonents 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Enabled 
Sing I equser sea n: h 
Move OST to VHO
Machine generated alternative text:
Profik &ntainers 
Albw concurrent uær essBns 
Alknv conculEnt uær sessions 
Déte kcal profik when FSLcgix Profik shouh appt}' 
Déte kcal profik when FSLcgix Profik should appt} 
VH D-pq alkcatBn 
Dynaröc VH DOq allocation 
Profik type 
VH D kcatBn 
VH D bcation 
Profik &ntainersl &ntainer and Naning 
Swap dirætory n.ane 
Swap directory nanz convonents 
Virtual disk type 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled 
T for pmfile and fallback to readonly 
Setting 
Enabled 
Setting 
Enabled 
Setting 
Enabled

Profile I logged in and my profile was created.

Machine generated alternative text:
Home 
Quick access 
Desktop 
Douunloads 
OSDisk 
Documents 
FSLogix_Llser 
Containers 
Name 
davism 
Date modified 
9/17/202011:10AM 
File folder

ODFC (Didn’t set the flipflop here-missed by mistake) 

Machine generated alternative text:
Home 
FSLogix_Office Containers 
Nehmork 
FSLogix_Office 
Containers 
Name 
Quick access 
Desktop 
Douunloads 
OSDisk 
Documents 
davism 
Date modified 
9/1 7/2020 10:32 AM 
File folder

Lets Test Access base enumeration

Machine generated alternative text:
Name 
Test Citrix 
Test Citrix Properties 
Security 
Environment 
Sessions 
COM+ 
Remote control 
DigitalPersona 
Remote Desktop Services Profile 
General Address Account 
Member Of 
Published Certificates 
T elephones 
Organization 
Password Replication Dial-in Obiect 
Member of: 
Name 
Domain users 
Active Directory Domain Services Folder 
users
Machine generated alternative text:
HOME 
oo 
oo 
Excel 2016 
exspend 
O 
FADB 
o 
First Data 
Fiserv SCO 
Test Citrix 
Account Settings 
About 
Log off 
Harland

I can’t see davism from my test citrix account.

Machine generated alternative text:
FSLogix_Llser 
Organize • 
Nehmork 
New folder 
Name 
Containers 
O 
Date 
Quick access 
Desktop 
Douunloads 
Documents 
Microsoft. Word 
This pc 
File name: 
modified 
No items match your search. 
All Word Documents 
Tools

Test NTFS permission on davism. I forced it so I could test the NTFS.

Machine generated alternative text:
Home 
o 
Nehmork 
FSLogix_Office_Containers 
Name 
ODFC davism.VHDX 
Destination Folder Access Denied 
You need ermission to 
Date modified 
9/17/202011:10AM 
efform this actio 
Type: File folder 
davism 
Hard Disk Image 
Search 
200, 704 KB 
Date modified: 9/1 7/2020 10:32 AM 
Cancel

I must admit, it a very good feature Nutanix has, and I look forward to learning more around continuous availability (tech preview) and expanding this out to a DR site so the data can all replicate. I don’t know how to do this yet. But I will learn it soon.

Sources

Slack: Jarian Gibson and Nutainx-euc

https://www.christiaanbrinkhoff.com/2018/10/18/configure-fslogix-office-365-containers-with-nutanix-files-afs-better-together/

https://portal.nutanix.com/page/documents/details?targetId=Field-Installation-Guide-v4-5:set-network-reqs-c.html%23concept_1mm_xwq_nh

https://portal.nutanix.com/page/documents/details?targetId=Files-v3_7:fil-file-server-manage-c.html

  2 Responses to “How I did Nutanix Files 3.7 with FSlogix profiles/ODFC”

  1. Since it isn’t using REFS how goes the compaction of profiles on the afs?

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)

This site uses Akismet to reduce spam. Learn how your comment data is processed.