how to add new domain's NTFS permissions and keeping old ones

mrnatsuken 1 Reputation point
2021-09-24T04:16:37.827+00:00

Hi Microsoft Community!

Background: New fileserver (WS2016) for new destination domain has the same folder structure as old fileserver (WS2008R2)from source domain
Also has the files copied over to the destination file server. Existing NTFS permissions (from source domain) was also copied over.
Most user accounts and security groups also have been already migrated.

For a folder example:

SrceF1 folder currently have NTFS permissions with the following:
CREATOR
SYSTEM
SRCLocal1\Administrators
SRCLocal1\Users
SRCDomain\Help1

        DestF1 folder currently have NTFS permissions with the following:

CREATOR
SYSTEM
DESTLocal\Administrators
DESTDomain\Administrators
SRCDomain\Help1

Note: The above example is just top level folder. There will be subfolders with different NTFS permissions

Objective:

To add new domain NTFS permissions to destination folder(s) checking against existing NTFS permissions from source domain
DestF1 folder will have NTFS permissions like below
CREATOR
SYSTEM
DESTLocal\Administrators
DESTDomain\Administrators
SRCDomain\Help1
DESTDomain\Help1

Attempts:
(RUN as Admin)
Subinacl -
I exported source domain SIDs as well as destination domain SIDs in a mapped .txt file. The file has sourceSID = destinationSID
I then tried to use the subinacl command tool with the migratetodomain switch. The commands run successfully, but nothing changed.
I also tried using icacls -
I’m able to save the NTFS permissions to a file but able to restore the permissions on the destination server but this only works for the DestF1folder. Access denied is the error message I get when I try this on the other folders.
Domain admin (destination) user has Full Control and is also the owner of the folder(s).

Powershell -
I also tried with Powershell the Get-ACL command and Set-ACL. I exported the source NTFS permissions into 2 separate files; one for the top level folder and another file for the subfolders. I then tried the following commands.
Ran successfully, but again no changes.

Ran successful also, but actually removed the SRCDomain\Help1 permissions

Maybe I need to use a for(each) loop , but not sure how to.
Thank you for any suggestions or feedback

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,127 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,853 questions
Windows Server Migration
Windows Server Migration
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Migration: The process of making existing applications and data work on a different computer or operating system.
408 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thameur-BOURBITA 32,506 Reputation points
    2021-09-24T08:01:45.647+00:00

    Hi

    Avoid to set a group from another domain on NTFS permission. I recommend you to create a local group in destination domain and add it in NTFS settings instead of SRCDomain\Help1. Once this new local group created and on set on each NTFS settings on destination domain, you can add SRCDOMAIN\Help1 as member in it. A local group can accept a member from another domain.

    Please don't forget to mark helpful reply as answer

    0 comments
  2. MotoX80 31,571 Reputation points
    2021-09-24T16:28:27.627+00:00

    How about trying subinacl's /replace switch. I used it with local groups so I would expect it to work with domain groups too.

    https://learn.microsoft.com/en-us/answers/questions/520748/fix-acl-on-copied-data.html 

    subinacl /subdirectories c:\temp\foo1\ /replace="Domain1\Group1"="Domain2\Group1"

    Try it on a small test folder first.

    0 comments
  3. mrnatsuken 1 Reputation point
    2021-09-24T18:56:26.913+00:00

    Thanks both for your reply.
    Thameur,
    The SRCDomain\Help1 is a security group that was migrated over and the NTFS permissions were copied using robocopy

    MotoX80,
    I can try that command but I’m not wanting to replace but instead add. So the destination folder would have both old domain and new domain NTFS permissions