I've attempted to replicate your scenario on OneFS 7.1.0.  cluster-1# isi auth groups create abe_group cluster-1# isi auth users create user1 --primary-group abe_group --password pass --enabled yes cluster-1# isi auth users create user2 --primary-group abe_group --password pass --enabled yes cluster-1# isi smb shares create abe /ifs/abe1 --create-path --access-based-enumeration yes cluster-1# isi smb shares permission create abe --group abe_group --permission-type allow --permission full  cluster-1# mkdir /ifs/abe1/dir1 cluster-1# mkdir /ifs/abe1/dir2 cluster-1# mkdir /ifs/abe1/dir3 cluster-1# mkdir /ifs/abe1/root_dir  cluster-1# ls -lah /ifs/abe1 total 21 drwxr-xr-x    5 root  wheel    70B Oct  6 09:35 . drwxrwxrwx    7 root  wheel  228B Oct  6 09:33 .. drwxr-xr-x    2 root  wheel    0B Oct  6 09:35 dir1 drwxr-xr-x    2 root  wheel    0B Oct  6 09:35 dir2 drwxr-xr-x    2 root  wheel    0B Oct  6 09:35 dir3 drwxr-xr-x    2 root  wheel    0B Oct  6 09:35 root_dir  By default all of these directories are world readable, so at this point, if either user1 or user2 mounts the abe share, they will see all directories.  I have abe mounted as Z: (with user1) on my windows client.  C:\Documents and Settings\Administrator>dir Z:\ Volume in drive Z is abe Volume Serial Number is 009A-9A03  Directory of Z:\  10/06/2014  09:35 AM      10/06/2014  09:33 AM      10/06/2014  09:35 AM      10/06/2014  09:35 AM      10/06/2014  09:35 AM      10/06/2014  09:35 AM                    0 File(s)              0 bytes               5 Dir(s)  5,928,591,360 bytes free  Now I will set the permissions from the isilon cluster command line so that dir1 will be visible to user1, dir2 will be visible to user2, dir3 will be visible to any member of abe_group, and root_dir will be visible only to root.  cluster-1# chmod 750 /ifs/abe1/* cluster-1# chown user1 /ifs/abe1/dir1 cluster-1# chown user2 /ifs/abe1/dir2 cluster-1# chgrp abe_group /ifs/abe1/dir3  cluster-1# ls -lah /ifs/abe1 total 22 drwxr-xr-x    6 root  wheel        92B Oct  6 09:41 . drwxrwxrwx    7 root  wheel      228B Oct  6 09:33 .. drwxr-x---    2 user1  wheel        0B Oct  6 09:35 dir1 drwxr-x---    2 user2  wheel        0B Oct  6 09:35 dir2 drwxr-x---    2 root  abe_group    0B Oct  6 09:35 dir3 drwxr-x---    2 root  wheel        0B Oct  6 09:35 root_dir   Now from windows:  Mounted with user1: C:\Documents and Settings\Administrator>dir Z:\ Volume in drive Z is abe Volume Serial Number is 009A-9A03  Directory of Z:\  10/06/2014  09:41 AM      10/06/2014  09:33 AM      10/06/2014  09:35 AM      10/06/2014  09:35 AM                    0 File(s)              0 bytes               4 Dir(s)  5,930,614,784 bytes free                       Mounted with user2: C:\Documents and Settings\Administrator>dir Z:\ Volume in drive Z is abe Volume Serial Number is 009A-9A03  Directory of Z:\  10/06/2014  09:41 AM      10/06/2014  09:33 AM      10/06/2014  09:35 AM      10/06/2014  09:35 AM                    0 File(s)              0 bytes               4 Dir(s)  5,930,614,784 bytes free              Mounted with root: C:\Documents and Settings\Administrator>dir Z:\ Volume in drive Z is abe Volume Serial Number is 009A-9A03  Directory of Z:\  10/06/2014  09:41 AM      10/06/2014  09:33 AM      10/06/2014  09:35 AM      10/06/2014  09:35 AM      10/06/2014  09:35 AM      10/06/2014  09:35 AM                    0 File(s)              0 bytes               6 Dir(s)  5,930,614,784 bytes free              From this example, it is possible to set access based enumeration without setting windows ACLs.  You can also revoke group permissions for a particular directory, for example:  cluster-1# mkdir /ifs/abe1/dir4 cluster-1# chgrp abe_group /ifs/abe1/dir4 cluster-1# chmod 705 /ifs/abe1/dir4  In this case, permission is specifically revoked from abe_group, so dir4 will not appear in directory listings for users in abe_group (even though it is world readable).  An explanation of the three settings: isi smb settings global modify --access-based-share-enum     This setting controls enumeration of shares on the cluster. If this setting is on and the user is enumerating shares either through MMC or via Explorer, they will see only shares that they have permission to map (permissions set via isi smb shares permissions ...) isi smb settings shares modify --access-based-enumeration     This setting controls the default value for access-based-enumeration on shares. If a share does not explicitly set access-based-enumeration, it uses the default set here. isi smb shares modify --access-based-enumeration      This setting controls whether files and folders within the share are visible to users that don't have permission to at least read them. If this setting is on and the user enumerating a directory doesn't have at least read permission on a child entry, that entry is not returned in the directory listing.    Hopefully this helps explain the feature a bit more.
Hello all, I'm hoping someone can assist me with this...  I'm installing an Isilon Cluster for a client:  I'm seeing 3 separate commands to enable Access Based Enumeration in the Command Reference Guide:  It's quite confusing so I just enabled all three in the order above. I'm not sure where to go from here - I've tried using chmod on a group to give access to specific folders within the share but the users in the group are still able to see, read and write to all of the folders. What I want is for someone to be able to mount the share in Windows, but just see and access folders I've specified.  Would really appreciate some help with this, please and thanks!  - Cyrus
Access Based Enumeration on Isilon SMB Shares