# Independent challenge — Which gate denied the operation?

Start after the complete baseline passes. Keep the same private run state, isolated domain and €20 operating allowance. Leave time to begin cleanup by 4½ hours from initial Preflight.

## Your assignment

An application team reports that its private share is unreliable. One engineer proposes opening the public endpoint; another wants Full Control for every domain user. You have three incident reports and must prove the failing layer before changing access.

1. Establish the baseline using fresh sessions for Reader, Writer and Outsider. Record both normal storage hostnames, private resolution, exact CIFS AES256 tickets, sole AES-256-GCM client/server settings, observed encrypted SMB3.1.1 sessions, run marker and real operations. Explain why the agent's SYSTEM identity is insufficient.
2. Run the Kerberos fault. Prove the exact exercise CIFS principal is missing, no HOST fallback covers it, DNS/TCP remain healthy and the independent storage account still works. Record the actual client/KDC diagnostic. Restore only the SPN, validate, repeat repair and validate again.
3. Run the ShareGate fault. Prove Writer can read but cannot create a new file despite its unchanged Modify ACE. Show that the account-wide default affects both folders in the exercise account, while the independent account still works. Restore Elevated Contributor and prove both recovery windows.
4. Run the Ntfs fault. Prove that a new file cannot be created in the exercise account's protected Exercise folder while its sibling Control folder and the independent account work. Preserve LabAdmin ownership and other ACEs. Restore only Writer Modify and prove both recovery windows.
5. Correlate actual SMB operations with StorageFileLogs and client/AD observations. Explain why a missing-SPN failure can have no corresponding storage request row.
6. Restore intended configuration, obtain zero unexpected Terraform drift, clean up exact recorded resources, repeat cleanup and compare the original unrelated-resource baseline. Export reviewed sanitized evidence.

## Evidence acceptance

| Claim | Minimum evidence |
|---|---|
| Healthy access | Fresh named-user session; private normal hostname; exact AES256 CIFS ticket; sole client/server cipher plus observed encrypted SMB3.1.1; correct run marker; operation matrix |
| Kerberos incident | Exact SPN absent and no HOST fallback; real fresh-session authentication error; DNS/TCP and independent control healthy |
| ShareGate incident | Default Reader on exercise account; unchanged Modify ACL; read success/new-write denial; independent control success |
| Ntfs incident | Protected Exercise Writer RX; LabAdmin owner/other ACEs preserved; new-file denial; sibling and independent successes |
| Recovery | First and repeated repair each followed by fresh successful validation; Reader/Outsider boundaries remain |
| Completion | Real logs/AD-client correlation, no unexpected drift, twenty genuine captures, exact resources absent twice and baseline preserved |

All permission claims apply inside the protected `workshop-<run-id>` namespace. The default share permission applies account-wide; root-directory default ACLs do not become the protected-folder ACL automatically.

Use HINTS.md progressively. Record your diagnosis before opening SOLUTION.md. Do not use public storage, broad grants, RC4, a storage-key SMB mount or an old cached connection to manufacture a pass.