On Demand Migration for Active Directory — File Share ReACL Fails With “SetKernelObjectSecurity: Access is denied” on a Read‑Only Nasuni Share (4383346)

When running the File Share ReACL workflow in On Demand Migration for Active Directory, every item on one specific share fails with the following error, while other shares on the same target complete successfully:

SetKernelObjectSecurity: Access is denied
Unable to update item security for <path>

The migration service account has been granted Full Control on the affected share, and the same account can change NTFS security on the files and folders manually. The shares are hosted on a Nasuni appliance and the service account is a member of the Nasuni Administrators group, so excluding the share is not an acceptable workaround.

Additional symptoms observed on the affected share:

• Every file and folder shows the Archive attribute set, and the attribute cannot be removed — the operation returns Access Denied.
• Creating a new folder on the share returns Access Denied.
• Adding a test account to the ACL of an existing folder fails with Access is denied, even though NTFS permissions show Full Control.

The affected share is exposed as read‑only at the share level on the file server (in this case, the Nasuni appliance). When a share is read‑only, the SMB server rejects all write operations — including changes to security descriptors and file attributes — before the request reaches the NTFS layer. As a result, ReACL’s call to SetKernelObjectSecurity returns Access is denied, even though the service account holds Full Control in the NTFS ACL. The persistent Archive flag on every file and folder is the visible symptom of the share being read‑only: Windows cannot clear the attribute through a read‑only export.

Re‑expose the share as read/write at the file server (Nasuni) level, then re‑run the ReACL job. The NTFS permissions do not need to change; only the share‑level access mode needs to be writable.

From a Windows host, mount the affected share as the migration service account and try a write operation that does not depend on NTFS ACLs. For example:

• Create a new folder at the root of the share.
• Right click on one of the affected File or Folders and check the properties.

If both operations fail with Access Denied while the NTFS ACL still shows Full Control, the share is exported read‑only at the file‑server level.

In the Nasuni Management Console (or the equivalent management interface for the storage device hosting the share), open the share definition and change the access mode from Read‑Only to Read/Write. Save the change and confirm that clients see the new mode.

Re‑run the File Share ReACL job against the previously failing share. Confirm that the SetKernelObjectSecurity: Access is denied errors are no longer raised and that items complete successfully.