# Progressive hints — Follow the file operation

Open one hint at a time. Keep the same private ledger and enough time for cleanup.

## Hint 1 — Identify the user and the exact operation

Who owns the logon session and SMB connection? Did the test attempt to read, create a new file, overwrite an old file or delete a file? A successful existing-handle operation may answer a different question from new file creation.

## Hint 2 — Check the name before the permissions

Does the normal `<account>.file.core.windows.net` name resolve through AD DNS to the private endpoint? Is TCP445 reachable? The private endpoint being approved in Portal does not prove client resolution or user authentication.

## Hint 3 — A configured identity is not a fresh ticket

Find the exact CIFS service principal and its AD owner. Does a fresh user logon obtain its AES256 service ticket? During the fault, could a HOST service-principal mapping or an existing ticket/session hide the missing CIFS entry? Compare with the independent control account.

## Hint 4 — Separate the two encryption checks

`klist` describes the Kerberos ticket. The SMB connection describes the observed dialect and encryption. `Encrypted=True` alone does not identify its cipher. Require AES256 ticket evidence, sole AES-256-GCM settings on both client/server, and a fresh encrypted SMB3.1.1 session. The constrained settings plus actual connection establish the channel cipher; no direct cipher getter is claimed.

## Hint 5 — Read success narrows the problem

If the same fresh user reads the marker but cannot create, inspect both authorization layers. An NTFS Modify ACE cannot override a Reader share gate. The account default reaches all shares in that storage account, so use the second account as the independent control.

## Hint 6 — One folder can fail while its account is healthy

Compare the protected Exercise folder with its sibling Control folder. Is only Writer's ACE different? Is inheritance protected? Does LabAdmin still own the folder? Avoid replacing the whole ACL or testing only a file that Writer already owns.

## Hint 7 — The point of failure determines the log source

Which service actually received the attempted request? A KDC can reject a service-ticket request before the storage service sees SMB. Storage logs can show genuine SMB denials for later gates; client/KDC observations establish an earlier authentication failure. Preserve real values instead of assuming every failure is HTTP403.

## Hint 8 — A repair needs two fresh observations

Validate after the first repair, then repeat repair and validate again. Verify Reader remains read-only and Outsider remains denied. Finish with a restored full matrix and no unexpected drift, then prove exact absence twice and preservation of unrelated resources.