Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  3. NetBackup™ Deduplication Guide
  5. Configuring and managing universal shares
  7. Prerequisites to configure universal shares
  9. Configuring universal share user authentication
  11. Kerberos-based authentication
  13. Creating Active Directory users for Kerberos authentication
NetBackup™ Deduplication Guide

Creating Active Directory users for Kerberos authentication

After storage servers are added to the Active Directory domain, perform the following tasks before you configure Kerberos-based authentication for universal shares on the NetBackup web UI.

  • On Windows Active Directory domain server, create Active Directory users for Kerberos authentication.

  • Register Kerberos principals to KDC (Key Distribution Center) database.

    See Registering the Kerberos principals to the KDC database.

To create Active Directory users for Kerberos authentication.

  1. Log in to the Windows Active Directory domain server.
  2. Navigate to Start > Administrative Tools > Active Directory Users and Computers.
  3. In the left pane, select the correct domain name and then select Users.
  4. Right-click Users and select New > User.
  5. Enter the domain user information. User logon name is used for Active Directory domain login and authentication.

    For storage servers, the logon name must be nfs/<storage server FQDN>. Where the nfs is an NFS service principal and storage server is the host where your universal shares are created. For example, nfs/storage-server.mydomain.com.

    For a universal share server, create one more user host/<storage server FQDN>.

    For a universal share server, you must create two Active Directory users, nfs/<storage server FQDN> and host/<storage server FQDN>. For a universal share client, create only one user, host/<universal share client FQDN>.

  6. Set password for the new user.
  7. Click Finish to finish the user creation.
  8. Double-click the user you have created to open the property window.
  9. In Account options list, select AES 128 and AES 256 encryption items.

Feedback

Was this page helpful?
Previous

Kerberos-based authentication

Next

Registering the Kerberos principals to the KDC database

Feedback

Was this page helpful?