Your Windows clients were able to access your CIFS SVM yesterday.

The correct conclusion is that the CIFS SVM is not using DNS. A hardened Windows group policy commonly reduces insecure name resolution and authentication fallback behavior. SMB access to a CIFS server should use proper DNS name resolution so that clients can locate the server, validate identity, and use Kerberos or the intended domain authentication path. If users previously connected through weak or non-DNS mechanisms, a new security policy can break access even though the SVM itself is still online. SMBv1/SMBv2 configuration is not the best answer because the scenario points to a domain security policy change rather than protocol version negotiation alone. NFSv3 is irrelevant to Windows CIFS access, and a wrong domain would not normally appear suddenly after a group policy push if access worked the day before. References/topics: ONTAP SMB access, DNS dependency, Kerberos authentication, Windows security policy effects, and CIFS client troubleshooting.