I've setup DFS-R (Hub and spoke) for a share between 6 Windows 2012 R2 servers.

The share on all servers is called "Websites$" with "full access" permission for everyone.

All servers have high performance 4 Xeon-Cores, 32 GB RAM, 8 GB RAM are free and are connected via 10Gb VMware Connections.

  • Server1 is defined as primary server (hub)
  • Server2 - Server6 are member servers (spokes)

The origin NTFS permissions are correctly replicated to the members. My first change on permission on share root level "D:\Websites" is also transferred correctly to all subfolders.

Now I have to change permission on a subfolder "D:\Websites\Special". The "users" group should be deleted and the local group "IIS IUSRS" should get read permissions in this subfolder.

So I block Inheritance on this folder, keep all permissions, delete the "users" group and add the "IIS IUSRS" group with read permissions. All subfolders in "D:\Websites\Special" have the proper permission.

This works kind of strange on members.

On member servers the inheritance on "D:\Websites\Special" is also blocked, the "users" group is deleted and the "IIS IUSRS" is added. The permissions on some Subfolders are configured properly, but on some other subfolders e.g. "D:\Websites\Special\Website1" the old permissions are active and don't change regardless which permissions are configured on primary server.

When I delete the folder "D:\Websites\Special\Website1" and copy the old contents from a backup everything works fine and the permissions are correct. I can configure new permissions on primary server and they are replicated. After some permission changes, this folder is damaged on members again and don't get new permissions from primary server. There are only few (<20) small (<20kb) files in all folders.

I have no idea what's the root cause of this strange behaviour. Do you have any clue what I'm doing wrong?

  • Do you have bi-directional replication setup between Server1 and Server2-Server6? – GregL Nov 2 '15 at 18:13
  • Yes, single direction replication isn't recommended by Microsoft, so I implement the standard version – StefanK Nov 2 '15 at 19:55
  • 1
    And are you letting the backlog clear between operations to make sure everything is as it should? Are there any errors in the Event Log, or files in ConflictAndDeleted? – GregL Nov 2 '15 at 19:57
  • Since there are only some files and folders changed, the backlog should be clear between the operations. There are many files in ConflictAndDeleted. Is it safe to clean this folder? – StefanK Nov 2 '15 at 20:10
  • ... should be clear .... Best to check that it does before making assumptions about what does and doesn't work. – GregL Nov 2 '15 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.