Symptoms

The NAS server is showing degraded in the user interface due to error "LDAP client settings on NAS server xxx are not valid within domain xxx.com", this happens when following criteria are met: 1. LDAP service is enabled as UNIX directory service (UDS) on NAS server. 2. LDAP server that configured in LDAP service is a Windows Active Directory domain controller. 3. The LDAP authentication method is set to Anonymous.

Cause

From DC logs, the LDAP configuration of the NAS server can be retrieved from: spx\cmd_outputs\nas\VDM_x\_server_config_SVDM_B_-v_-map_nas_volume_vdmmap_x_ns_ldap_info_verbose_txt 1649047347: LDAP: 6: LDAP domain: XYZ.lab 1649047347: LDAP: 6: State: Configured - Connected 1649047347: LDAP: 6: Schema: Active Directory <<<<<<<<<<< LDAP schema is Active Directory 1649047347: LDAP: 6: Base dn: DC=XYZ.DC=lab 1649047347: LDAP: 6: Bind dn: <<<<<<<<<<<<< bind user is anonymous 1649047347: LDAP: 6: Auto-Discovery: disabled - TTL: 1200 s - Next refresh in 242 s 1649047347: LDAP: 6: Configuration: File: ldap.conf - TTL: 1200 s - Next refresh in 242 s See Microsoft KB article, anonymous LDAP operation to Active Directory is not allowed on Domain controllers since Windows Server 2003. LDAP to Active Directory is disabled - Windows Server | Microsoft Docs.

Resolution

Change the LDAP authentication method to Simple or Kerberos to address the issue.

Support Cases