Network File System (SMB)
On This Page
Overview
The Network File System (SMB) connector lets you connect to your on-premises network file shares over the SMB protocol. It uses the SMBLibrary client, a fully managed .NET SMB2/SMB3 implementation that runs on both Windows and Linux hosts (including environments where the native Samba/libsmbclient stack isn't available).
The connector supports both reading and writing, so it can be used for content scans, as a source connection, and as a destination connection for migrations.
Because it connects over SMB, support depends on the SMB dialects negotiated by the client; any version limitations are listed below.
All current SMB2/SMB3 protocols are supported, including 2.0.2, 2.1.0, 3.0.0, 3.0.2, 3.1.0, 3.1.1.
This connector communicates over the SMB protocol only. The Unix NFS protocols (NFSv2, NFSv3, NFSv4) are not supported.
SMB Azure File Share Protocol Settings
When using the SMB file system protocol in Azure Files, the default profile is Maximum compatibility. DryvIQ recommends leaving the default profile when using the DryvIQ NFS (SMB) connector. The DryvIQ NFS (SMB) connector does not support some custom SMB protocol settings.
Creating a Connection
The first step is to create the connection by providing the connection information required for DryvIQ to connect to the file share.
Expand the Manage section in the left navigation menu.
Click Connections.
Click Add connection.
Select Network File System (SMB) as the platform on the Add connection modal. (The SMB connection only displays in the Connections list on Linux environments. It will not be available on machines running Microsoft Windows. However, it can access both Linux and Windows file shares.)
Enter the connection information. All red fields are required for this connection.
Test the connection to ensure DryvIQ can connect using the information entered.
Click Done.
Add Connection Modal for NFS (SMB)
Field | Description | Required |
|---|---|---|
Display as | Enter the display name for the connection. If you will be creating multiple connections, ensure the name readily identifies the connection. The name displays in the application, and you can use it to search for the connection and filter lists.
If you do not add a display name, the connection will automatically be assigned a default name. | Optional |
UNC Path | Enter the UNC path for the connector. The UNC path must begin with a leading double backslash and should point to a share/folder on the server, for example | Required |
User Name | Enter the user name for the administrator account. The account must have the authority to access the content you will process. | Required |
Password | Enter the password for the administrator account. | Required |
Preserve Last Access Time | This setting controls whether DryvIQ maintains the Last Access Time property on items during scans and transfers. It is enabled by default to help retain important file-access metadata. Disable this setting only if your environment restricts updating the Last Access Time property. This is most common when:
| Optional |
The following fields are available on non-Windows hosts. | ||
Use Kerberos Authentication | The default is disabled (No). Enable (Yes) this to authenticate to the SMB server using Kerberos instead of NTLM. Choose this when your environment requires Kerberos (for example, connecting to Azure File shares or domains that disallow NTLM). Leave it off for basic username/password (NTLM) authentication. | Optional |
Kerberos Realm | The Kerberos realm (typically your uppercase domain, such as Microsoft – AI, Cloud, Productivity, Computing, Gaming & Apps ). Set it only if auto-discovery from the user principal name doesn't pick the correct realm. | Optional |
Kerberos KDC | The Key Distribution Center (usually a domain controller) to request tickets from. Set this when DNS SRV auto-discovery can't reach or resolve a KDC, or you need to pin a specific one. | Optional |
Kerberos Service Principal (SPN) | The service principal name of the target SMB service (for example, cifs/server.contoso.com). Provide it only if the SPN derived from the connection isn't correct for your server. | Optional |
Resolve Identity Names (LDAP or Microsoft Graph) | The default is disabled (No). Enable (Yes) this to translate the security identifiers (SIDs) in file permissions into readable account names on servers that don't support lsarpc (for example, Azure Files). When enabled, the resolution backend is chosen automatically from the credentials you supply below. If Microsoft Graph credentials are set, Graph is used; otherwise, LDAP is used. Leave it off if you don't need SID-to-name resolution. | Optional |
LDAP directory options are used to resolve names via a reachable domain controller. All LDAP fields are optional; unset values fall back to nfs:* host defaults, and remaining LDAP parameters further default from the connection (host from the KDC, base DN from the realm, bind from the SMB credentials). | ||
Directory (LDAP) URL | The LDAP endpoint of your directory (for example, ldap://dc.contoso.com). Set it to point resolution at a specific directory server; otherwise, it's derived from the KDC. | Optional |
Directory Base DN | The base distinguished name to search under (for example, DC=contoso,DC=com). Defaults from the Kerberos realm if left blank. | Optional |
Directory Bind DN or UPN | The account used to bind to LDAP, as a DN or user principal name. Defaults to the SMB credentials if left blank. | Optional |
Directory Bind Password | The password for the bind account above. | Optional |
Microsoft Graph credentials are an alternative to LDAP that resolve Entra-synced identities over HTTPS, without requiring domain-controller reachability. When these are set, the Graph backend is used instead of LDAP. All fields are optional. | ||
Microsoft Graph Tenant ID | Your Entra (Azure AD) tenant ID. Provide this (along with client ID and secret) to resolve names via Graph rather than LDAP (the best choice when no domain controller is reachable from the DryvIQ host). | Optional |
Microsoft Graph Application (Client) ID | The application (client) ID of the Entra app registration used to call Graph. | Optional |
Microsoft Graph Client Secret | The client secret for that app registration. | Optional |
Microsoft Graph Cloud | Selects which Microsoft national cloud endpoints Graph resolution targets. Choose based on where your Entra tenant lives:
| Optional |
Features and Limitations
Platforms all have unique features and limitations. DryvIQ’s transfer engine manages these differences between platforms and allows you to configure actions based on migration job policies and behaviors. The information below is platform-specific. Use the Platform Comparison tool to see how your platforms may interact regarding features and limitations.
Supported Features | Unsupported Features | Other Features/Limitations |
|---|---|---|
File size maximum: No maximum | ||
Timestamp preservation | Path length maximum: 32,767 | |
Account map | Restricted types: none | |
Group map | Segment path length: No maximum | |
Permission preservation | Invalid characters: " < > | : * ? \ / | |
|
|
File System Availability During Migration
You do not need to restrict access to your file shares during migration. The connector does not support file-level locking or native change detection. Incremental runs use crawl-based change detection. Conflict resolution policies handle any files modified by users while a job is running.
Last Accessed Date
When NFS (SMB) is used as the destination platform for migrations, DryvIQ preserves the Last Accessed date for files.
During processing, DryvIQ must read the file, which temporarily updates the Last Accessed timestamp. DryvIQ restores the original Last Accessed date after the file is processed, so the timestamp remains unchanged. This behavior applies to both content scans and migrations.
If the NFS account used for the source connection has read-only permissions, DryvIQ cannot restore the original Last Accessed date. In this case, the Last Accessed timestamp will reflect the time the file was processed.
Owner Preservation
DryvIQ supports ownership preservation when NFS (SMB) is configured as the destination connector. When enabled in a transfer job, DryvIQ uses the source item’s CreatedBy value and applies it as the Owner on the destination SMB share.
Because NFS does not support directory-based user lookup, user identities may need to be explicitly mapped to ensure ownership is applied correctly. In scenarios where automatic resolution is not possible (for example, NFS-to-NFS transfers), a user mapping file is required. Usernames must be defined in the source_id and destination_id fields using <domain>\<user> format.
<domain>\<user>In the example mapping below, SOURCE-DOMAIN\source_user is mapped to DEST-DOMAIN\destination_user, allowing DryvIQ to correctly apply ownership on the destination NFS (SMB) share.
source_id,source_username,source_name,source_caption,destination_id,destination_username,destination_name,destination_caption
SOURCE-DOMAIN\source_user,,,,DEST-DOMAIN\destination_user,,,
Support applies when migrating to NFS (SMB). If NFS is used as the source, ownership preservation depends on the destination connector’s ability to resolve and apply permissions.
"This Folder Only" Permissions
Network File System supports assigning permissions to a specific folder (“This folder only”). DryvIQ handles these permissions differently depending on the destination.
When Transferring Between SMB/NFS File Shares
DryvIQ reads "This folder only" permissions from NFS/SMB sources and preserves the permissions throughout the transfer process. When transferring between two SMB/NFS file shares, the permissions are applied correctly and remain limited to the folder only.
When Transferring to Cloud Platforms
Cloud platforms such as Box, SharePoint, and Google Drive do not support a “This folder only” permission model. Permissions in these platforms typically apply to a folder and are inherited by all of its contents. As a result, DryvIQ preserves the permission itself (who has access and the level of access), but not the scope. A "This folder only" permission from the source is applied as a standard folder-level permission on the destination, which then inherits to subfolders and files.
Symbolic Link Limitation
The NFS SMB connector does not support following symbolic links. When the connector encounters a symbolic link, the item is skipped, and the following message will be logged: “The folder was skipped because it was a symbolic link.” Because symbolic links cannot be resolved through the SMB protocol, DryvIQ is unable to read or traverse the target location behind the link.
Unix Users and Groups
DryvIQ's SMB connector works with Windows-style users, groups, and permissions (SIDs and ACLs). It does not display or manage native Unix users and groups, so you won't see Unix uid/gid owners or Unix-style user/group entries when browsing permissions on an SMB/NFS share. Where an identity can't be clearly identified, DryvIQ generally presents it as a group, which is the most common form for NFS permissions.