Solved

DFS or Security?

Posted on 2009-04-14
6
398 Views
Last Modified: 2012-05-06
Looking for some clues here.  We had files scattered over several servers (Server 2003 32-bit) linked using domain DFS.  Bought a new server (Server 2008 64-bit) and using DFS replicated all files into one place on the new server.  To avoid problems, initially the new server target was set to disabled in DFS referral.  The old server needs to be decomissioned.

Where I want help is that I thought it would be a simple case of switching the DFS referral on for the new server and off for the old server.  Replication would continue to take place but users would be re-directed to the new server for their files.  

This doesn't appear to be the case, when I do the above users start to email me saying they can't access folders in the DFS.  I can back out the change and it all reverts to normal for XP users, Win2k have to reboot first.  Also had to reboot server 2k3 running rdp.

The share permissions are set for everyone 'read only' on both servers (and now the change is backed out access is as normal).  However Security on the old 2k3 server includes the domain/users group.  I can not find this group to add it in the new 2k8 server.  The 2k3 server IS a DC.  the 2k8 server is just a member server.

Are my problems DFS or permissions related (or both)?
Thanks in advance.
0
Comment
Question by:dchoxford
  • 3
  • 3
6 Comments
 
LVL 2

Expert Comment

by:FLPeople
ID: 24140374
It looks like your problems are related to permissions.  Since the new server is not a member of the domain  and I'm assuming the users are, the new server will not allow them access.  

Your best option would to be add the server to the domain.  Then add the appropriate user groups to the NTFS security settings on the server.  When you add the server to the domain the domain users group will be added to the local server user account which may be all that your looking for.  

If that is not an option you will have to enable the guest account and allow everyone access on the new server or create all your users as local users on the new server.  
0
 

Author Comment

by:dchoxford
ID: 24142792
The new server is a member of the domain, just not a DC.
0
 
LVL 2

Expert Comment

by:FLPeople
ID: 24147324
Sorry about that.  I read your post as it being a standalone server.  

When you look at the security on the 2k8 server for the DFS structure does it show any groups?  Sid numbers?  Since the NTFS permissions are supposed to replicate with the files I wonder if they are making it or not.  

It looks like you have tried to manually add the groups also, can you find any domain resources when you try to do an add?  

 
0
Do email signature updates give you a headache?

Constantly trying to correctly format email signatures? Spending all of your time at every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

 

Author Comment

by:dchoxford
ID: 24147439
Thanks for the comment FLPeople.  I think I have worked out the security thing.  In Server 2003 you can enter 'users' as a group and this is acceptable.  However on Server 2008 it seems that you have to specify 'domain users'.  I think this will solve my security issue.

However can you tell me if I'm right in my assumptions re DFS?  If I have 2 targets, fully replicated, DFS referral enabled on the original server and disabled on the new server - should I just be able to switch the referrals over and my users non the wiser?  Approx how long should the change over take?

Thanks
0
 
LVL 2

Accepted Solution

by:
FLPeople earned 250 total points
ID: 24148304
Your assumptions are correct on the referrals.  That is how we are using it across sites here.  

The default time to live for a referral is 5 minutes. So if these servers are at the same site you should expect no more than 5 minutes before they are accessing the new server.  If the servers are at separate sites you will have to wait for the domain controllers to replicate the change to dfs, then you are looking at an additional 5 minutes after that.  

Good to hear that you resolved the security issue.  We do not have any production 2k8 boxes in yet.  Had a beta setup in a test domain and didn't see that issue.
0
 

Author Comment

by:dchoxford
ID: 24148354
Hmm, ok guess I'm going to have to bit the bullet again and switch the referral and see what happens.  Pretty certain it was the security issue that locked things up last time.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Join & Write a Comment

Suggested Solutions

Have you considered what group policies are backwards and forwards compatible? Windows Active Directory servers and clients use group policy templates to deploy sets of policies within your domain. But, there is a catch to deploying policies. The…
You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now