QSUnlock is a simple command-line based tool that allows the NSS administrator to unlock directories that have been locked with NSS' legacy ACL locking method - hard 'NAS Quotas'.

In normal conditions these locks are lifted automatically by NSS as users clean up and usage levels go back below locking thresholds. However in certain conditions, such as a failure of the NSS host, it may not be possible to have NSS remove these locks. The command-line tool QSUnlock is available for fast and semi-automated removal of ACL locks when these types of conditions arise.

When run, QSUnlock will parse the entire directory structure for the specified path and remove the QS-created ‘Deny’-roles for all files and directories within the Access Control Lists. This article describes how this is done in more detail.

QSUnlock should only be run with the same account as the Quota Server service is running with. The reason for this is that it needs to be able to find the ACL separator and be able read and write ACL-s to a directory or a file. It is possible to use the tool either on a local path or on an UNC path.

1. Open up the Command Prompt as an administrator. The tool will not work unless it’s activated as an administrator.
2. When inside the Command Prompt as an administrator, navigate to C:\Program Files\Northern\Storage Suite\QS
3. Type QSUnlock and press Enter to receive a brief description of the tool.
4. Specify the path of the location that you wish to unlock. Examples:
   
   QSUNLOCK D:\Users\JohnDoe
   QSUNLOCK \\server\share$\path

Here’s a locked NAS-quota where users have been given ‘Deny’-roles in the folder's access control list by Quota Server:

An attempt to add files to this directory will be denied:

If we go to the Security settings for this directory we can see that the ‘Everyone’-group has been given Special permissions. If we click on ‘Advanced’ we can see what these permissions are. We can see that these are the Deny-roles that NSS created. Users are still able to read and access files, but they are not able to write to them. This is what makes it a ‘Special permission’.

Removing the lock with QSUnlock:

The path to the locked directory is specified and the tool is launched. It goes through the entire directory structure for the specified path and effectively removes the Deny roles for all folders and files.

The Deny roles are gone:

1. Perform the QSUnlock-operation as suggested above.
2. Confirm that the Deny-roles are removed from the Windows Access Control List.
3. Try to add files to the directory to confirm that directory is unlocked.

For advanced troubleshooting, please contact the Technical Support team at Northern (support@northern.net).