Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 4.4.0

Lockout Settings

Introduction​

When Ransomware Defender responds to a security event, it can lock out the affected user — removing their access to the shares and exports they can reach, across all managed clusters. This page explains how lockout works, how it differs between SMB and NFS, and between VAST and Qumulo.

What lockout does​

When a lockout is triggered for a user, the system performs the following actions:

  1. Restricts access to the SMB shares and NFS exports the affected user can reach, across all managed clusters. The exact mechanism differs by protocol and platform — see SMB lockout and NFS lockout below.
  2. Takes snapshots of the affected share and export paths, subject to the snapshot budget. These snapshots serve as recovery points if data has been affected. See Snapshot Settings for the full snapshot configuration reference.
  3. Logs the lockout to the event's Activity Log tab with a timestamp and a list of every share, export, and cluster involved.

The lockout covers all clusters managed by Eyeglass, not just the cluster where the suspicious activity was detected — if a credential is compromised, it poses a threat across the entire managed environment.

SMB lockout​

SMB lockout works the same way on VAST and Qumulo as it does on PowerScale: the system applies an explicit DENY READ ACE (Access Control Entry) to every SMB share the affected user had access to at the time of detection. Share access is determined by the user's Active Directory group membership, resolved at lockout time.

NFS lockout​

NFS does not use the same ACE-based permission model as SMB — NFS access is controlled at the export or view level, and the exact mechanism is platform-specific.

Qumulo​

The offending client's IP address is added to the export's allowed host list as read-only. The client keeps read access to the export but loses write access.

VAST​

  • If the affected view has NFS access, the offending client IP(s) are added to the view's existing nfs_read_only host list.
  • If the same view also has SMB access, the client is also added to the view's smb_read_only host list.
  • These changes are made on the view's policies, not directly on the view.
note

This differs from PowerScale, where NFS lockout blocks the source IP entirely by removing it from the export, and SMB lockout applies a deny ACE (the same mechanism used on VAST and Qumulo).

Limitations and known issues​

Lockout scope is cluster-wide: The lockout applies to all shares and exports the user can access across all managed clusters, not just the ones where suspicious activity was observed. In environments where a large number of shares are accessible to any given user, this can result in broad disruption to a legitimate user if the event is a false positive.

Active Directory group resolution: Group membership is resolved at the moment the lockout is triggered. If a user's group membership changes between detection and lockout, the lockout may not cover all expected shares (if the user was removed from a group) or may cover unexpected shares (if the user was added to a group during the detection window).

Restoring user access after lockout​

Restoring access is a deliberate, administrator-initiated action. The system does not automatically restore access at any point.

Before restoring access, confirm:

  • You have reviewed the Items & Recovery tab and understand what files were affected.
  • You have reviewed the Activity Log tab and understand the sequence of events.
  • The user's machine has been scanned and cleared, or you are confident the activity was not malicious.
  • You have collected any evidence needed for your incident response process.

To restore access:

  1. Navigate to the event on the Threat Detections page.
  2. Click Take an Action → Restore User Access (or from the Investigate & Recover page).
  3. The system starts a background job to remove the restrictions from all locked shares and exports.
  4. Monitor the job status in the Jobs section of the sidebar.
  5. Once complete, verify in the Assets tab that the restriction has been removed.
  6. Confirm with the user that they can reconnect to their shares.

After restoring access, the event moves to Restored Access state. You can then close the event using the Close Event wizard.

See Restore User Access for the full operational procedure.

See also​