Verifying Service Account is in Proper Groups

The following steps will require an elevated or Domain Admin account to proceed.

1. On a Server or Desktop that can connect to both Active Directory and the Azure Netapp Files appliance Right-click the start menu and select Computer Management.
2. Right-click Computer Management Local and select Connect to another computer.                     
3. On the Next Screen select browse, and enter the hostname of your ANF instance.
4. Computer manager should now have loaded showing your ANF hostname at the top.
5. Click System Tools > Local Users and Groups > Groups
6. Select the administrator Group and verify that your service account was added from the Azure portal. DO NOT ADD YOUR SERVICE ACCOUNT TO THE GROUP HERE IT WILL BE LOST/ OVERWRITTEN.

Verifying / Adding Service Accounts to ANF Security Groups

The following steps will require an elevated or Domain Admin account to proceed.

1. On a Server or Desktop that can connect to both Active Directory and the Azure Netapp Files appliance Right-click the start menu and select Computer Management.
2. Right-click Computer Management Local and select Connect to another computer.                     
3. On the Next Screen select browse, and enter the hostname of your ANF instance. Select ok and ok.
4. Computer manager should now have loaded showing your ANF hostname at the top.
5. Click System Tools > Shares
6. The list of shares on the ANF appliance the shares should reflect your volumes.
7. Right-click on the share that is causing errors and select properties.
8. Navigate to the Share Permissions Tab and validate that the group added will allow Resilio to traverse the share. The account could be Everyone, Domain Users, or Authenticated Users.
9. Navigate to the Security Tab and validate that the security tab has your administrative group added or the Resilio Service account added to this section. If your service account or group is missing Follow the instructions below.
10. Click Advanced on the Security window.
11. On the Advanced Security Window Click Add
12. Click Select a principal at the top. On the screen that pops up add your Securit group or User.
13. Click Full Control then select Show advanced permissions on the right to see the screen below and validate that the security windows match the picture below.
14. Click OK > Apply > OK
15. You can close all open windows.
16. Restart your Resilio Agents and verify ACLs are syncing properly. 

Correcting ACL Inheritance

Sometimes it may be necessary to break File and Folder Inheritance Follow these instructions to make sure proper groups are maintained.

1. On the Advanced Security Settings Screen Click Disable Inheritance
2. Select Convert Inherited Permissions.
3. If there are permissions that need to be removed now it is safe to remove only the Groups or accounts that do not need access.