I have a quite nasty problem with a simple task: copying files from an old file server to a new one. A short description of the situation:
The old server is W2k8 R2 and hosts about 25 TB of data, which are exported via SMB and NFS. The data are the home directories of our users and we have a folder redirection GPO in place. The GPO initially had the special protection (which disallows even Admins accessing the files without taking ownership) in place, but we later disabled that because of issues with Linux NFS clients. Nevertheless, the protection is still active for some users which have been created a long time ago. The new server is Windows Server 2012. It should receive all the data. We also have a DFS namespace in place which enables changing the actual location of the data quite transparently.
The copy process must fulfil the following requirements:
- It is not possible to copy all of the data at once, because it takes too long.
- The copy process needs to be able to access the protected redirected folders.
- All symlinks need to be copied.
- The process must be incremental in order to keep the per-user downtime low.
We have tested several tools and processes in the meantime, but none worked so far. Our best guess is robocopy, because it can run as backup operator and therefore access the protected folders. It can furthermore do incremental backups, i.e. we can create a base copy, lock out the user after that and perform a final sync which should be fast. The problem is that robocopy obviously cannot copy symlinks when running as backup operator.
The second idea therefore was copying only the files using robocopy (DAT, not DATSO), then lock out the user, take ownership of the whole user home directory and do another run of robocopy to copy the symlinks. That should work because as owner of the files, we do not need backup operator privileges for that run, and it should be fast, because only the symlinks must be actually copied. On the target machine we would then restore the owner and give him full control over his files.
Unfortunately, that does not work either, because it is actually slow. The reason for that is the second step, i.e. taking ownership of the files. As there are those protected folders, we must do that recursively for those folders. takeown cannot do that automatically, because after taking ownership, we must give the administrator account full control before we can proceed with the nested folders and files. The script doing that runs almost a whole day for a typical user.
Frankly speaking, I am running out of ideas. If anyone has a useful suggestion for a new process or tool, I am happy to try it…