Migrating Data between servers but keeping permissions

Question

I need to migrate my shares from an old Server (server2003 DomainA.co.uk) to a new server (2008R2 DomainB.Local) these are on different domains. My major problem is I need to keep share permissions on each of these shares. (There are hundreds)

All the old shares have got Useraccount\DomainB.Local users with permissions on them. But are physically stored on a server in DomainA.co.uk. The server in DomainB has got a DFS share and this is where I will be storing the data. I just need help migrating the shares and setting the permissions.

Doing it manually isn’t an option. PowerShell maybe?

Solution

You can use robocopy for this. If you run it on the 2008 R2 machine, you can run:

robocopy \\source\share c:\destination /MIR /SEC /SECFIX /r:5 /w:5

The switches are documented here.

The /MIR switch makes a mirror on both servers. This will skip unchanged files on the destination, which allows you to use this command during business hours to get a decent seed of the share on the destination, and then will only copy changes when you run it a second time off-hours to do the cutover.

The only thing that you'll have to set is the share permissions (if you use them). It will copy all NTFS permissions on all files and folders. If you are still actually using share permissions, now might be the time to reevaluate whether or not you really need them. Unless you have old Win 9x clients, it's standard practice to give everyone Full Control in the share permissions and control access via NTFS permissions.

Comments

[Spence]

Are you really talking about "share permissions" or are you talking about NTFS ACLs?

[Zapto]

both NTFS ACL's and Share permissions.

[Rob Moir]

Do these domains trust one another? Are you trying to move the data to "DomainB" while still allowing users from "DomainA" to have access? "DomainA\Robert" and "DomainB\Robert" are two totally different user entities, so copying over ACLs for "Robert" on "DomainA" will not allow the user "Robert" on "DomainB" to access that data.

[Zapto]

The domains trust each other. No domainA users do not need to access domainB.

[joeqwerty]

Mark: Does this hold true for the NTFS permissions? These are two distinctly separate AD domains, if I read the question correctly.

[MDMarra]

Ah, I misread that portion, it was a bit confusing. If there is a trust between the two, which it sounds like, this should still work, but I don't have a test environment to replicate this in.

[Spence]

It will copy NTFS ACLs even across trust relationships.