Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am copying files and folders from a file share on Windows 2003 32bit to a new file share on Windows 2008 R2 64bit. I have been using Robocopy testing on some folders and am able to only successfully copy the unique security settings, like specific users that only can access that folder, but not all. (ie SYSTEM, USERS)

My question is if there is a utility or way to copy the exact setup as is. Including all permissions as they exist on the old server. I am able to create the permissions (SYSTEM, server administrators, etc) on the new share from the parent but that then gives permissions on folders I want restricted.

I hope this makes sense.

share|improve this question

The default for robocopy is DAT. This means it copies the data (file content itself), the attributes (*H*idden, *S*ystem, *R*ead-only, etc.), and the timestamps. If handing it DATSOU, which includes security ACLs, auditing info, and ownership. This is directly from the documentation, copied over at the wonderful ss64:

 /COPY:copyflag[s] : What to COPY (default is /COPY:DAT)
                      (copyflags : D=Data, A=Attributes, T=Timestamps
                       S=Security=NTFS ACLs, O=Owner info, U=aUditing info).
              /SEC : Copy files with SECurity (equivalent to /COPY:DATS).
          /DCOPY:T : Copy Directory Timestamps. ##
          /COPYALL : Copy ALL file info (equivalent to /COPY:DATSOU).
           /NOCOPY : Copy NO file info (useful with /PURGE).

So why is DATSOU not working for you? That might help us figure out exactly what you are looking for? As you mention, there are some limitations. We ran into a similar wall with directories that did not have inherited permissions, which is the issue you described. You could build your own duct tape solution by parsing out info from SetACL, which is the most ridiculously powerful and dangerous Windows util I have seen. That is a pain in the ass though.

Solution two, pull what is probably an insanely large wim and just apply the thing to a fresh drive with imagex. There is no rule it has to be a Windows system partition; it can be any arbitrary group of files. I have not tried this, so I am sure others can shoot down this idea from experience.

Solution three, consider DFS replication. If you can keep the old share up, you can use DFS replication to just redirect requests for files on one share UNC path to go to another. I did that successfully recently and it saved me a BUNCH of trouble. I do not know your use case though.

share|improve this answer

Firstly, note that all my experience of this is with Windows 2003 only.

I believe that the only way to do this is through the backup and restore API, so you need something that uses that API. On Windows 2003 you could use the built-in backup program, Microsoft Backup, or something like Backup Exec.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.