I need to migrate my shares from an old Server (server2003 DomainA.co.uk) to a new server (2008R2 DomainB.Local) these are on different domains. My major problem is I need to keep share permissions on each of these shares. (There are hundreds)

All the old shares have got Useraccount\DomainB.Local users with permissions on them. But are physically stored on a server in DomainA.co.uk. The server in DomainB has got a DFS share and this is where I will be storing the data. I just need help migrating the shares and setting the permissions.

Doing it manually isn’t an option. PowerShell maybe?

  • Are you really talking about "share permissions" or are you talking about NTFS ACLs? – Evan Anderson Feb 8 '12 at 16:09
  • both NTFS ACL's and Share permissions. – Zapto Feb 8 '12 at 16:12
  • Do these domains trust one another? Are you trying to move the data to "DomainB" while still allowing users from "DomainA" to have access? "DomainA\Robert" and "DomainB\Robert" are two totally different user entities, so copying over ACLs for "Robert" on "DomainA" will not allow the user "Robert" on "DomainB" to access that data. – Rob Moir Feb 8 '12 at 18:03
  • The domains trust each other. No domainA users do not need to access domainB. – Zapto Feb 8 '12 at 18:22

You can use robocopy for this. If you run it on the 2008 R2 machine, you can run:

robocopy \\source\share c:\destination /MIR /SEC /SECFIX /r:5 /w:5

The switches are documented here.

The /MIR switch makes a mirror on both servers. This will skip unchanged files on the destination, which allows you to use this command during business hours to get a decent seed of the share on the destination, and then will only copy changes when you run it a second time off-hours to do the cutover.

The only thing that you'll have to set is the share permissions (if you use them). It will copy all NTFS permissions on all files and folders. If you are still actually using share permissions, now might be the time to reevaluate whether or not you really need them. Unless you have old Win 9x clients, it's standard practice to give everyone Full Control in the share permissions and control access via NTFS permissions.

| improve this answer | |
  • Mark: Does this hold true for the NTFS permissions? These are two distinctly separate AD domains, if I read the question correctly. – joeqwerty Feb 8 '12 at 16:15
  • Ah, I misread that portion, it was a bit confusing. If there is a trust between the two, which it sounds like, this should still work, but I don't have a test environment to replicate this in. – MDMarra Feb 8 '12 at 16:18
  • It will copy NTFS ACLs even across trust relationships. – Evan Anderson Feb 8 '12 at 16:18

Share permissions can be exported via registry key:


NTFS permissions should be copied across via robocopy as described above.

If at all possible, try not to use share permissions, as NTFS permissions do everything share permissions do, and are much easier to deal with.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.