We help IT Professionals succeed at work.

File Server Domain Change

I currently have 2 domains. xyz.com and wxy.local. I inherited wxy.local in an aquisition and am looking to move to a single domain xyz.com. Currently the 2 domains are in a trust and since we use Citrix on xyz.com users have an account in both domains as well for Citrix authentication. The question I have is, if I set all their xyz.com permissions on the file servers in wxy.local and move the server to the xyz.com domain. Will I lose all the permission settings? Or since the accounts were placed there prior to the domain change wiill they still work?
Comment
Watch Question

Commented:
Typically the ACL's would remain intact since a domain membership change on a host would take forever if it had to parse every file and folder on the disk to update the security tab. Same deal as if you were dealing with non-domain computers and swapped a HDD from one to another that had explicit permissions on the files. If those users don't exist on the new box you'd be out of luck.

You should actually be able to test that very easily if you've got appropriate rights on both domains. Set up some dummy shares on a PC in the old domain and then migrate it to the new one and verify the folder ACLs stay intact. It shouldn't behave any differently based on whether it's a server or desktop.
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Do you have a capacity on an existing file server to transfer the data and reconfigure the shares?

You could use cacls to check the current security settings.
There are scripts available online and referenced in posts on EE that can help in transferring share configurations from one system to another.

Author

Commented:
Sadly no capacity to do it any other way but to pull the trigger and hope the xyz.com settings stick when I move it from one domain to the other. Or pull the trigger and spend all night rebuilding the permission structure before everyone comes in the next day.

I will test the workstation idea tomorrow, wish I had thought of doing it before posting the question and I will update after I see what happens.
Leon FesterSenior Solutions Architect

Commented:
CoralonSenior Citrix Engineer
CERTIFIED EXPERT
Commented:
The ACL's and SID's are written into the MFT of the file server.  If you move the File server to the new domain, those ACL's & SID's are still there and still valid.

However, for them to be of any real use, a trust has to exist because when the OS goes to check the permissions of the file, it is going to look at the user's security token, which must contain the same token as the ACL on the file.  The security token won't contain that if the user logs into a different domain, unless the sidHistory attribute is set with the old domain sid of the user.

So in short - it will work just fine as long as your users don't move.  If your users move, or their groups change, then the security token may not contain the needed information to access those files, and you'll have to re-ACL the files.  (that's a good idea to do anyway, but does not need to be rushed.).

Coralon

Author

Commented:
Thank you guys for the help. I was able to test and moving from Domain B to Domain A after setting A's permissions on the folders worked flawlessly and the permissions stayed in tact. I appreciate the help

Explore More ContentExplore courses, solutions, and other research materials related to this topic.