ADMT v3 and DFS jmp13 15.06.2007 14:31:01 We are currently in a middle of an NT to AD migration. The issue is data has been consolidated from the servers to DFS with NT credentials because the user acccounts and servers have not yet been migrated over to the AD domain. The DFS servers are in the AD domain so there is no need to migrate them. All the NTFS permissions are pointing to the NT user account instead of the AD user account so when the trust is broken nobody will be able to access these files. Can I use the ADMT v3 Security Translation Wizard to replace the source domain with the target domain? Is there another tool that will work? I know that subinacl does not work with DFS according to the documentation.

Re: ADMT v3 and DFS "Ned Pyle [MSFT]" <nedpyle[ at ]online.microsoft.com> 15.06.2007 15:31:48 If you migrate the users and groups with SID History, there will be no need to do anything. Source Translation on works on machines being migrated, but it sounds like this is not the case. What part of DFS does subinacl not work with (and which docs are you reading)? As far as resources go, these are just shares to be accessed by users - subinacl scripts should work fine. DFS, in the end, is just a nice way to get users pointed to what they've been pointed at for 20 years - NTFS shares. :) -- Ned Pyle Microsoft Enterprise Platform Support This posting is provided "AS IS" with no warranties, and confers no rights. Please read http://www.microsoft.com/info/cpyright.htm for more information. "jmp13" <jmp13[ at ]discussions.microsoft.com> wrote in message news:00784DD8-A869-4AF4-AA54-055C5D4BF68D[ at ]microsoft.com... [Quoted Text] > We are currently in a middle of an NT to AD migration. The issue is data > has > been consolidated from the servers to DFS with NT credentials because the > user acccounts and servers have not yet been migrated over to the AD > domain. > The DFS servers are in the AD domain so there is no need to migrate them. > All > the NTFS permissions are pointing to the NT user account instead of the AD > user account so when the trust is broken nobody will be able to access > these > files. Can I use the ADMT v3 Security Translation Wizard to replace the > source domain with the target domain? Is there another tool that will > work? I > know that subinacl does not work with DFS according to the documentation.

Re: ADMT v3 and DFS jmp13 15.06.2007 18:11:02 In the htm that comes with subinacl dowload: it states "SubInACL is not supported on distributed file system (DFS) volumes" I need to change NTFS permissions on files and folders. Subinacl would work do the job. "Ned Pyle [MSFT]" wrote: [Quoted Text] > If you migrate the users and groups with SID History, there will be no need > to do anything. Source Translation on works on machines being migrated, but > it sounds like this is not the case. > > What part of DFS does subinacl not work with (and which docs are you > reading)? As far as resources go, these are just shares to be accessed by > users - subinacl scripts should work fine. DFS, in the end, is just a nice > way to get users pointed to what they've been pointed at for 20 years - NTFS > shares. :) > > -- > > Ned Pyle > Microsoft Enterprise Platform Support > This posting is provided "AS IS" with no warranties, and confers no rights. > Please read http://www.microsoft.com/info/cpyright.htm for more information. > > > "jmp13" <jmp13[ at ]discussions.microsoft.com> wrote in message > news:00784DD8-A869-4AF4-AA54-055C5D4BF68D[ at ]microsoft.com... > > We are currently in a middle of an NT to AD migration. The issue is data > > has > > been consolidated from the servers to DFS with NT credentials because the > > user acccounts and servers have not yet been migrated over to the AD > > domain. > > The DFS servers are in the AD domain so there is no need to migrate them. > > All > > the NTFS permissions are pointing to the NT user account instead of the AD > > user account so when the trust is broken nobody will be able to access > > these > > files. Can I use the ADMT v3 Security Translation Wizard to replace the > > source domain with the target domain? Is there another tool that will > > work? I > > know that subinacl does not work with DFS according to the documentation. > >

Re: ADMT v3 and DFS "Ned Pyle [MSFT]" <nedpyle[ at ]online.microsoft.com> 18.06.2007 13:48:21 Hmmm... I have no idea what that doc is trying to state. :) Subinacl should work fine on shares and folders, regardless of whether you get to them via DFS or just \\server\share. -- Ned Pyle Microsoft Enterprise Platform Support This posting is provided "AS IS" with no warranties, and confers no rights. Please read http://www.microsoft.com/info/cpyright.htm for more information. "jmp13" <jmp13[ at ]discussions.microsoft.com> wrote in message news:BF1A0DE5-0B25-4037-9A86-4FEB20B261DD[ at ]microsoft.com... [Quoted Text] > In the htm that comes with subinacl dowload: it states "SubInACL is not > supported on distributed file system (DFS) volumes" I need to change NTFS > permissions on files and folders. Subinacl would work do the job. > > "Ned Pyle [MSFT]" wrote: > >> If you migrate the users and groups with SID History, there will be no >> need >> to do anything. Source Translation on works on machines being migrated, >> but >> it sounds like this is not the case. >> >> What part of DFS does subinacl not work with (and which docs are you >> reading)? As far as resources go, these are just shares to be accessed by >> users - subinacl scripts should work fine. DFS, in the end, is just a >> nice >> way to get users pointed to what they've been pointed at for 20 years - >> NTFS >> shares. :) >> >> -- >> >> Ned Pyle >> Microsoft Enterprise Platform Support >> This posting is provided "AS IS" with no warranties, and confers no >> rights. >> Please read http://www.microsoft.com/info/cpyright.htm for more >> information. >> >> >> "jmp13" <jmp13[ at ]discussions.microsoft.com> wrote in message >> news:00784DD8-A869-4AF4-AA54-055C5D4BF68D[ at ]microsoft.com... >> > We are currently in a middle of an NT to AD migration. The issue is >> > data >> > has >> > been consolidated from the servers to DFS with NT credentials because >> > the >> > user acccounts and servers have not yet been migrated over to the AD >> > domain. >> > The DFS servers are in the AD domain so there is no need to migrate >> > them. >> > All >> > the NTFS permissions are pointing to the NT user account instead of the >> > AD >> > user account so when the trust is broken nobody will be able to access >> > these >> > files. Can I use the ADMT v3 Security Translation Wizard to replace the >> > source domain with the target domain? Is there another tool that will >> > work? I >> > know that subinacl does not work with DFS according to the >> > documentation. >> >>

Re: ADMT v3 and DFS "Matt Seitz" <matseitz[ at ]cisco.com> 06.07.2007 18:20:06 "Ned Pyle [MSFT]" <nedpyle[ at ]online.microsoft.com> wrote in message news:uSwyW9asHHA.508[ at ]TK2MSFTNGP02.phx.gbl... [Quoted Text] > Hmmm... I have no idea what that doc is trying to state. :) Subinacl > should work fine on shares and folders, regardless of whether you get to > them via DFS or just \\server\share. When I try using "subinacl" on a DFS path, I get an error message: C:\Program Files\Windows Resource Kits\Tools>subinacl /file z:\seitz\export\supp ort\ANON_FTP_ACCOUNTS z:\seitz\export\support\ANON_FTP_ACCOUNTS will not be processed. Dfs path is not supported Elapsed Time: 00 00:00:00 Done: 0, Modified 0, Failed 0, Syntax errors 0 C:\Program Files\Windows Resource Kits\Tools>