Test user "LAB\tester" can perform an operation in the CIFS share "HR" from the SVM...

The correct security trace filter uses protocol cifs, the Windows name LAB\tester, and trace-allow yes. The purpose is to determine why this specific user can perform an operation while other HR users cannot. Because the successful operation is part of the investigation, ONTAP must trace allowed access events, not only denied events. The NFS options are wrong because the access path is a CIFS share and the identity is a Windows domain user. The trace-allow no option would trace only denied access, which would not capture the reason that LAB\tester succeeds. Security trace is used to diagnose permissions across share permissions, NTFS ACLs, UNIX identities, name mapping, and security style behavior. In this case, the engineer needs a targeted trace for the known working user to compare the granted access path against failing users. References/topics: ONTAP SMB security trace, vserver security trace filter create, CIFS identity tracing, trace-allow behavior, and NAS permissions troubleshooting.