Migrating Data between servers but keeping permissions

active-directorymigrationwindows-server-2003windows-server-2008-r2

I need to migrate my shares from an old Server (server2003 DomainA.co.uk) to a new server (2008R2 DomainB.Local) these are on different domains. My major problem is I need to keep share permissions on each of these shares. (There are hundreds)

All the old shares have got Useraccount\DomainB.Local users with permissions on them. But are physically stored on a server in DomainA.co.uk. The server in DomainB has got a DFS share and this is where I will be storing the data. I just need help migrating the shares and setting the permissions.

Doing it manually isn’t an option. PowerShell maybe?

Best Answer

You can use robocopy for this. If you run it on the 2008 R2 machine, you can run:

robocopy \\source\share c:\destination /MIR /SEC /SECFIX /r:5 /w:5

The switches are documented here.

The /MIR switch makes a mirror on both servers. This will skip unchanged files on the destination, which allows you to use this command during business hours to get a decent seed of the share on the destination, and then will only copy changes when you run it a second time off-hours to do the cutover.

The only thing that you'll have to set is the share permissions (if you use them). It will copy all NTFS permissions on all files and folders. If you are still actually using share permissions, now might be the time to reevaluate whether or not you really need them. Unless you have old Win 9x clients, it's standard practice to give everyone Full Control in the share permissions and control access via NTFS permissions.

Related Solutions

Linux – Migrating users between Linux servers if the UIDs need to change

For the first question, there is no salt issue if your shadow file is with $1$FZPUn/2R$JsQCE3TP3Uraez2P8ISIh0 password format (with a dollar, a number, a dollar at the beginning). Because, the salt ils the first part between the next dollars (FZPUn/2R in my example). The crypted password is on the rest. See man crypt, at the 'Glibc Notes' section for details.

So you can move your shadow file without risk.

For the second part, I prefer edit /etc/passwd file directly and change the groupe manualy. Your method is maybe the best (because of lock).

Don't forget files : if you change UID or GID, you must chown each to authorize your user to read his files !

Windows 2003; Find folders with non-inherited/changed permissions

I would recommend to use Powershell (for Win2003: http://support.microsoft.com/kb/968929/en-us) and a additional add-on module also for this ( http://gallery.technet.microsoft.com/scriptcenter/1abd77a5-9c0b-4a2b-acef-90dbb2b84e85 ).

This will help you first to get the inheritance for a folder structure with (when running from your startfolder) eg.

get-childitem -Recurse | get-inheritance | export-CSV C:\Inheritance.csv -NoTypeInformation

You will get all files and folders in a csv which can then be filter in Excel or other DBs if you need.

Additional benefit of the NTFSSecurity Modul is that you can change the inheritance or the ACLs also during migration with a similar Powershell script.

e.g. you can completly remove inheritance in a folder (your start folder) with:

get-childitem | Disable-Inheritance

or add the -recurse switch again for all subfolders / files again.

Hope this help Cheers

Best Answer

Related Solutions

Linux – Migrating users between Linux servers if the UIDs need to change

Windows 2003; Find folders with non-inherited/changed permissions

Related Topic