?
Solved

File Server Domain Change

Posted on 2012-03-14
6
Medium Priority
?
713 Views
Last Modified: 2012-03-20
I currently have 2 domains. xyz.com and wxy.local. I inherited wxy.local in an aquisition and am looking to move to a single domain xyz.com. Currently the 2 domains are in a trust and since we use Citrix on xyz.com users have an account in both domains as well for Citrix authentication. The question I have is, if I set all their xyz.com permissions on the file servers in wxy.local and move the server to the xyz.com domain. Will I lose all the permission settings? Or since the accounts were placed there prior to the domain change wiill they still work?
0
Comment
Question by:ChrisHornfeldt
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 6

Accepted Solution

by:
Dangle79 earned 1000 total points
ID: 37722437
Typically the ACL's would remain intact since a domain membership change on a host would take forever if it had to parse every file and folder on the disk to update the security tab. Same deal as if you were dealing with non-domain computers and swapped a HDD from one to another that had explicit permissions on the files. If those users don't exist on the new box you'd be out of luck.

You should actually be able to test that very easily if you've got appropriate rights on both domains. Set up some dummy shares on a PC in the old domain and then migrate it to the new one and verify the folder ACLs stay intact. It shouldn't behave any differently based on whether it's a server or desktop.
0
 
LVL 79

Expert Comment

by:arnold
ID: 37723284
Do you have a capacity on an existing file server to transfer the data and reconfigure the shares?

You could use cacls to check the current security settings.
There are scripts available online and referenced in posts on EE that can help in transferring share configurations from one system to another.
0
 

Author Comment

by:ChrisHornfeldt
ID: 37723299
Sadly no capacity to do it any other way but to pull the trigger and hope the xyz.com settings stick when I move it from one domain to the other. Or pull the trigger and spend all night rebuilding the permission structure before everyone comes in the next day.

I will test the workstation idea tomorrow, wish I had thought of doing it before posting the question and I will update after I see what happens.
0
WatchGuard's M Series Appliances - Miecom Approved

WatchGuard's newest M series appliances were put to the test by Miercom.  We had great results and outperformed all of our competitors in both stateless and stateful traffic throghput scenarios! Ready to see how your UTM appliance stacked up? Download the Miercom Report!

 
LVL 26

Expert Comment

by:Leon Fester
ID: 37725107
0
 
LVL 25

Assisted Solution

by:Coralon
Coralon earned 1000 total points
ID: 37726965
The ACL's and SID's are written into the MFT of the file server.  If you move the File server to the new domain, those ACL's & SID's are still there and still valid.

However, for them to be of any real use, a trust has to exist because when the OS goes to check the permissions of the file, it is going to look at the user's security token, which must contain the same token as the ACL on the file.  The security token won't contain that if the user logs into a different domain, unless the sidHistory attribute is set with the old domain sid of the user.

So in short - it will work just fine as long as your users don't move.  If your users move, or their groups change, then the security token may not contain the needed information to access those files, and you'll have to re-ACL the files.  (that's a good idea to do anyway, but does not need to be rushed.).

Coralon
0
 

Author Closing Comment

by:ChrisHornfeldt
ID: 37744196
Thank you guys for the help. I was able to test and moving from Domain B to Domain A after setting A's permissions on the folders worked flawlessly and the permissions stayed in tact. I appreciate the help
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
It’s been over a month into 2017, and there is already a sophisticated Gmail phishing email making it rounds. New techniques and tactics, have given hackers a way to authentically impersonate your contacts.How it Works The attack works by targeti…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question