I'm trying to figure out the best way to migrate an FTP server from old hardware to new hardware. The server is on a domain, but not all the users setup on the server (to use FTP) are domain accounts, some are local to the server.

For example, I have users both ways:

domain\username machinename\username

The new machine name will be different.

So I need to copy all the files with permissions in tact from the old server to the new server. Then I need to convert all the user accounts from the old server to the new server. Then I need to change the file permissions so that they are no longer oldserver\username but newserver\username.

Can this be accomplished all with CALCS? Is there an easy way that perhaps I'm missing?


There is no "easy" solution to this problem - ACLs for local accounts are lost when moved to a new server because the SID associated with that user doesn't map to a valid user account any longer.

There is a way to do it though without having to wipe out your system. I'm going to walk through what I think is the easiest way, using Powershell (with WMI), icacls and some text editing.

  1. Create all of the new users on the new server
  2. On both the old server and the new server, get a listing of all the username to SID mappings. To do this, open up Powershell and run the command (on each server):

    get-wmiobject win32_useraccount | where { $_.localaccount } | export-csv serverusers.csv

  3. You've got some manual work to do now - you need to take both of the spreadsheets and map the SIDS from the old server users to the new ones. Create this in a new CSV (c:\sids.csv) with a format this is something like: oldusername,newusername,oldsid,newsid

  4. On the old server, save the ACLs for the files you care about using icacls. For example, if your files are in a folder called c:\ftproot\ you would go into that folder and do:

    icacls * /save c:\acls.bak /T

  5. Now you need to do a search and replace on the acls.bak file - for every row in your CSV, find all instances of oldsid and replace it with newsid. Here is a powershell script to do that:

    $file = get-content C:\acls.bak -encoding unicode
    $csv = import-csv c:\sids.csv
    foreach ($row in $csv) {
    $file = $file -replace $row.oldsid,$row.newsid
    set-content c:\acls2.bak $file -encoding unicode

  6. Copy all of the files to the new server

  7. Restore the ACLs on the files in the new server (again, assuming this is under c:\ftproot):

    icacls . /restore c:\acls2.bak /T

And that should do it - the files should now have the permissions set using the new local user accounts.

  • Wow... okay. I already moved all the users/groups to the new server using AddUsers.exe. I found this which may help me map the SIDs from the user accounts... support.microsoft.com/kb/250267 Thanks for all your help. – Brad Apr 8 '10 at 17:03
  • One more question, that CSV file, can it just have both sids listed in two columns? Are those just column names used for the PowerShell CSV object? – Brad Apr 8 '10 at 17:25
  • @Brad: The CSV really only needs the old sid and new sid. For it to work properly in Powershell, the first row of the CSV has to be a "header" row with the column names, so something like oldsid,newsid and then you can use $row.oldsid and $row.newsid when you loop through. – MattB Apr 8 '10 at 18:37
  • @MattB: I've ran into another issue. The ACL file dumped by ICACLS seems to be formatted differently. After I run my PowerShell command and replace the SIDs the file size is half as big. I downloaded WinMerge to compare the two, and the originaly dump has a (00) code after every character. Will this matter when restoring the permissions? – Brad Apr 9 '10 at 20:36
  • @MattB: Nevermind, I think I've figured it out. set-content c:\acls2.bak $file needs to be appended with -encoding unicode – Brad Apr 9 '10 at 20:45

The easiest way is to use IIS Sites Transfer software or IIS Easy Migration Tool from http://www.hoststools.com There are free versions. These tools help to migrate FTP sites, FTP accounts as long as ACL permissions.

  • I didn't care for this tool, especially the Gather function which tries to pull in all the domain groups/users instead of just those that exist on the local machine. – Brad Mar 15 '13 at 0:08

Restore from backup on the new hardware, then you will get the local users and all of the files. Then you can just change the server name to the new name.

  • I wish this was an option, but it's not. – Brad Apr 8 '10 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.