Hello

i am trying to audit all file accesses for a specific folder structure (right-click on folder --> Properties --> Security --> Advanced --> Auditing) but i want to exclude one single user (service account "acct.deletefiles", deleting old files based on a schedule).

My understanding is that i have to add an condition to the audit-rule as below:

https://imgur.com/a/GNQ5DJl

User     Group      Not member of each        Value        1 item(s) selected

"1 item(s) selected" is an Domain Local Active Directory Security Group in which account ".acct.deletefiles" is member of.

Nevertheless, all file accesses for this user are logged, what am i doing wrong?

Thanks in advance

Hi

Current setup is a single Win2012R2 server in a failover cluster. The other Win2012R2 node has been shut down, so not much failover clustering left ;)

This server (SERVER01) runs DFS (standalone namespaces) which is accessed by the clients using the name OURDFS. So drives are mapped with \\OURDFS\Shares01\Data01,\\OURDFS\Shares02\Data01 and so on..... All data being accessed through DFS is located on file servers on the network, so it's only DFS Namespace service this server is hosting.

Now this server needs to be closed down pretty soon, so I need to move DFS to another 2012R2 server (or newer version). For reasons I don't wanna address here, we still need to be able to access the drives using the same UNC paths.

Method 1: I have thought about taking SERVER01 offline and just building a new server which I call OURDFS and configure it with the same namespaces and folders, but this probably is a point of no return as I can't fall back to the old SERVER01 if anything goes wrong as I'll be removing the OURDFS AD computer object created by the clustering service when I join the new server to the domain. So no going back from this point.

Method 2: Also thought about adding another node to the cluster (SERVER02) and then shutting down SERVER01, but this leaves me with a cluster I actually don't need anymore and I fear I can't remove the cluster without also removing the AD computer object and then messing up DFS. Probably could then fix it by just renaming the server but this brings me back to method 1 i believe.....    

So I actually don't not know which way is the better way when I wanna minimize downtime and most importantly of all my weekend-work time :)

Perhaps I'm missing a better solution or perhaps it's no biggie and I should just go ahead with one of the mentioned methods.

Also if you've got any caveats please help me out by mentioning them :)

Best

Thomas

Hi,
I have a single-node Windows server 2016 with a dual parity storage space, on which a bitlockered ReFS volume resides with enabled file integrity. This ReFS volume hosted/contained a ~17TB vhdx file with archive data since its setup half a year ago. This file has now suddenly been removed by ReFS! More precisely, I see the following two events in system log:

1. Microsoft-Windows-ReFS Event ID 133 (Error): The file system detected a checksum error and was not able to correct it. The name of the file or folder is "R:\Extended Data Archive@dParity.vhdx".
   
2. immediately followed by Microsoft-Windows-ReFS Event ID 513 (Warning): The file system detected a corruption on a file. The filehas been removed from the file system namespace. The name of the file is "R:\Extended Data Archive@dParity.vhdx".

I have the following questions:

1. As 26TB are still used on volume level (constant, not decreasing over time), but only 7TB of files are visible, I assume that ReFS did not yet delete the missing vhdx file.How can I get read access to the corrupt vhdx file again for manual recovery of itsinternal file system?
   
2. If I understand dual parity correctly, at least two physical disks must have failed simultaneously for this to happen. I do not see any useful events in the system log regarding this. How can I get any clues, which of the physical disks in my array need to be replaced?
   (Their SMART level is 100%. I plan to run extended SMART self tests on each individual physical disk, but only after data recovery. Still, Windows or ReFS might have logged some clues about the physical disks involved in this checksum error somewhere?)
   

Thanks.

Hi, 

We have a file server which is running WS 2008R2, 

we have different departments like sales,customer,web etc

All the users are able to see all shared folders on File server. (But they are unable to open all folders as we assigned restrictions department wise).

 Actually now all users are able to see all folders which are shared in Network.

Can we Hide Sales department Shared folders  for other department users ?. So that sales department users can only see their shared Folders,other folders in network should be hide for them ? Please suggest. Thanks

Regards,

Ram

I am running Windows Server 2012 R2 and have been testing DFSR for several months.  I have noticed in the event viewer every night that replication is stopped because of a backup operation (1102) and subsequently restarts (1104) and contacts the DC (1206).  The issue is it also logs events 4010 and 2010 saying the DFS Replication service detected that the replicated folder has been removed from configuration.  And that the DFS Replication service has detected that all replicated folders on volume F: have been disabled or deleted. 

The strange thing is that according to DFS management, my replication group is green and happy.  Also files are replicating fine as they always have.

I have reviewed other posts, but I'm still foggy as to how this can be resolved.

Any help is greatly appreciated.

Hi,

I have two replication groups on this virtual Windows 2012 R2 server both replicating to the same target virtual Windows 2012 R2 server.  The replication groups are both working and files are replicating as designed.

Each night at around 11pm this file server (and others) are backed up via EMC Avamar.  At this time, as I believe is expected, the replication service stops (1102) due to the backup and subsequent snapshot.  The replication service subsequently restarts (1206) and then 1 second later, each RG logs event ID 4004 with Error: 9226.

The DFS Replication service stopped replication on the replicated folder at local path F:\DFS_Shares\Data. 

Additional Information: 
Error: 9226 (Multiple volumes share the same volume serial number which prevents DFSR from finding the right volume) 
Additional context of the error:   
Replicated Folder Name: RFData 
Replicated Folder ID: 0FCA83F3-C440-4157-B9C9-97B9E5C3DA4F 
Replication Group Name: RGData 
Replication Group ID: EDF8035C-3B84-41A8-8C83-EA18F9E489F4 
Member ID: 32CFD858-CF89-404B-B041-F473431923AC

The DFS Replication service stopped replication on the replicated folder at local path F:\DFS_Shares\Notes. 

Additional Information: 
Error: 9226 (Multiple volumes share the same volume serial number which prevents DFSR from finding the right volume) 
Additional context of the error:   
Replicated Folder Name: RFNotes 
Replicated Folder ID: F593A73D-FAD0-475A-93F1-2CA289A9982C 
Replication Group Name: RGNotes 
Replication Group ID: 881DAB4A-FA1E-4719-BB5D-FDC9ECBC2534 
Member ID: D70C4240-5476-4A93-A2A8-07E92DA98232

This is closely followed by each RG logging event ID 4002 which leads me to believe things are well at that point.  The target or secondary server does not log the 4004 events.

When I check the volume serials, I do not find any duplicates.

I have two windows 2016 servers with a DFS file replication connection in between. Domain functional level is 2008 R2.

Replication is intended to move 2 TB of data to a new server, but it is not working properly. It starts and works for almost half an hour and then it stops. Network connection is stable and reliable between servers. Other than event 4202 staging area being higher that high watermark, a few other events are logged in the event log on source server including:

- event 5014: Error: 1727 (The remote procedure call failed and did not execute.)
- event 5014: Error: 1722 (The RPC server is unavailable.)
- event 5014: Error: 1726 (The remote procedure call failed.)

on replication target server, if I try to restart DFS Replication service, hoping to fix the issue, I get Error 1053 "the service did not respond to the start or control request in a timely fashion"

Any idea on what may be cause or where to look to find the problem?

https://social.technet.microsoft.com/Forums/getfile/1377691

设置NTFS权限，有“写入” 的权限，但是保存的时候，office 的文档保存不了，txt的文档可以保存。我不想设置“修改”权限!!!!

Setting NTFS has  “Write” permission，but Save files，the ofiice file cannot Save，txt file can Save！ I do not want to set "Modify" Permission!!!!

Hello all,

Right now, we are running a fileserver (Windows Server 2016) with a really big data-disk (D:\) of round about 6,5 TB. This server is virtualized by VMware and the storage is located in the SAN.

Our storage administrator provides us one big LUN and we have created one big vmdk on this LUN. So right now, this server has two vmdk-disks (C:\ and disk D:\). On Disk D:\ we have created one Share, which is mapped by all endusers.

Now we had a discussion with our storage administrator, because he wants to rebuild the whole SAN/LUN environment. Instead of one big LUN, he will provide use 6 or 7 smaller LUNs (with round about 1TB) - because from his site, small LUNs are more comfortable and he can manage them (move) better.

What is the best practice for diskmanagement and partition designing in such a case?

Should we use all the LUNs as different disks (vmdks) and build one partition over all disks? (problem: when there is an issue with one disk, then the whole partition has a failure).

Should we use all the LUNs as different disks and build a partition on each disk? (problem: when using more than one partition, we have to create a share on each partition and therefore the users has to be mapped to all shares - normally we would like to have only one share)

Does anyone know what is the best solution?

This is a general question. Can more VSS hardware providers coexist on the same server?

Recently I came across a situation in which two VSS hardware providers are installed on the same server. The problem is that uninstalling one of them completed OK but the provider was still registered with the system VSS Command vssadmin list providers show that still in the system. I received this explanation from the development support, and I wanted to get your feedback. I replaced the actual vss providers name with A and B in order to keep that undisclosed.

"In environment having both of A and B, their registry information were in confusion, special A's vssprov.dll file. When uninstall A, the registry information of A's vssprov.dll indicates it is used by B, instead of A. So when you uninstall A, the A's vssprov.dll won't be uninstalled completely. Even though you uninstalled B firstly, there is no step to unistall A's vssprov.dll in uninstall B process and the A's vssprov.dll will be left. After uninstall B, the registry information of A's vssprov.dll is still displayed that A's vssprov.dll is used by B though B has been unistalled."

Is this an installation issue?

I have the idea that you can have more hardware providers installed on the same server, and they can work without problem. Is that so?

I have just recently gone live with a new DFSR pair.  Both servers on Windows 2012 R2.  I have little experience working with DFS and am trying to rationalize events I am seeing.

I'm seeing some 4304 events throughout the day, such as the following:

The DFS Replication service has been repeatedly prevented from replicating a file due to consistent sharing violations encountered on the file. The service failed to stage a file for replication due to a sharing violation. 

Additional Information: 
File Path: F:\DFS_Shares\Dept\Somefile.pdf 
Replicated Folder Root: F:\DFS_Shares\Dept 
File ID: {537D9C72-F301-4218-8D0A-B9B444A2545A}-v4351597 
Replicated Folder Name: RFDept 
Replicated Folder ID: 97CFC089-639C-41F1-94B6-8F6EE0567C49 
Replication Group Name: RGDept 
Replication Group ID: 5B8B2D1C-EC01-45B7-BC77-739F0E5218A6 
Member ID: 2B1F5AC5-DE92-4938-B54B-286892CCA5D9

I found this link https://support.microsoft.com/en-us/help/973836/the-dfsr-diagnostics-report-shows-sharing-violations-events-in-windows that seems to be a close match other than the OS I'm running.

As the KB explains, the files are in fact replicating fine, abd the dfsrdiag backlog output indicates that the RG is in sync.

Is these just normal messages or signs of a larger problem?

I also see the occasional 4412 event indicating a file has changed on multiple servers.  I am very confused as to how this takes place as the namespace is set such that only the primary server is enabled.

Any ideas?

Hi everyone,

On the fileserver we have Windows on one disk and on another disk we have shares. Both disks have a folder called Recovery bin. RecoveryBin folder weights 64% of the total disk space. Inside this folder it looks like there is another virtual volume inside it. I tried to delete, but i comes back.

My question>

what is the meaning of this RecoveryBin folder?

can I delete it?

I can't create a screenshot as the policy of this site doesn't allow me cause I'm new to it. I asked first this question on> https://answers.microsoft.com/en-us/windows/forum/windows_other-files/recoverybin-folder-in-windows-server-2012/40d8c43b-92e8-44f0-81d4-062db5742c49

but they reidrected me here...

thank you all

Hello,

I had an issue where the drive for a DFS replicated folder filled up and corrupted the DFS database for this folder and stopped in from replicating.  I do have 3 other drives and replicated folder groups on this server and those continued to work fine. I initially followed these steps.

1. Check that all members are set to "disabled" for the folder, check for event 4008 on all of them when you need to change the setting.
2. Force Active Directory replication when members in different Active Directory sites and use DFSRDIAG POLLAD /MEM:<MEMBER> to update the DFSR service after each change in the configuration.
3. Enable the folder on the designated primary member first and wait for Event ID 4112 indicating that "This member is the designated primary member for this replicated folder."
4. Enable other member(s) for the replicated folder and wait for Event ID 4104 indicating that "The DFS Replication service successfully finished initial replication on the replicated folder..."

Both servers are 2008 R2

I did everything through step 3 but never received a 4112.  So Server1 replicates live data to Server2.  Server1 is primary and is the one I re-enabled in step 3 - to make 'Primary.'


The server was patched and booted last night and then I receive event 2213 which provides the recovery steps along with a 'ResumeReplication' command.  I have used this in the past and was glad to see it. 

I ran the Resume command and soon saw

Event 2212 that there was an unexpected shutdown and the the database will be rebuilt.

I now see status 4 for this replication group - so it appears normal.  But I had still never re-enabled Server2.  I do have a 4114 event on it saying...

The replicated folder at local path D:\Users has been disabled. The replicated folder will not participate in replication until it is enabled. All data in the replicated folder will be treated as pre-existing data when this replicated folder is enabled. 

My concern is that when I initially re-enabled Server1 I never received a 4112 saying it was designated as Primary.  Now if I re-enable server2, will it think it is Primary and overwrite the live data on Server1?

thanks!

Hello,

Any thoughts or concerns to run Docker on hosts that are part of Storage Spaces Direct?  I believe the hosts should be clean with only the OS.  Does Microsoft recommend not running anything else on hosts that are part of Storage Spaces Direct cluster?

Thx

Robert

thanks, prashant chalke

Hi.

I am cleaning up my DFS environment, moving some data to new servers, deleting and recreating groups, and once the new configuration is fully built, I am deleting old data to reclaim space.

I removed a DFS Replication Group - on purpose. One of the replicated folders in the group was marked Read Only. I forgot to change it back to Read Write before I deleted the group. Now I cannot delete the data in that location - it's all set to Read Only.

I cannot delete, rename, or change anything in this folder in any way. I cannot change permissions on this data. I cannot change ownership. I've tried sharing the parent folder and giving everyone full control. I've tried ICACLS and TAKEOWN - I get Access denied. Right-clicking the folder/Properties/Security/Advanced, if I try to take ownership or Change Permissions, it causes all controls to become grayed out and I can do nothing.

I've done all this with the DFS Replication Service stopped and disabled. I've tried it all as domain admin, local admin, given a specific account local admin access. Nothing works.

I've searched for an answer and found only the things I've already tried. I have also searched to try to find out exactly how/where DFS sets the Read Only flag, but I cannot find this information.

Anyone know how I can regain access to these files and folders so I can delete them?

Thank you!

Dan

Hello,

I know this question has been asked before, but all of the posts I found when I searched for it were rather old or did not apply.

Here's the situation:
Two servers are part of two different domains in two different location.
Let's say they have the FQDNs server1.hq.local and server2.branch.local
Server1 runs Windows Server 2008 R2, server2 runs Windows Server 2016, both are domain controllers. Both sites are connected via VPN.

There are files on server1 which are to be synced with server2. The original idea was to use DFS for this. So I need to have DFS across two domains with separate forests. Now I find posts that say it is possible, and posts that say it isn't.

So my question is, is it possible, if so, how? And if it isn't, is there any way to do it otherwise
The files may be edited on both sides, so having two different versions of one file on different locations has to be avoided.
Cloud is not an option.