New DFS namespace design

[gshaw]

We're planning a migration of a couple of TB of data from legacy file servers to 2012 R2 (considered SharePoint but data needs a lot more cleaning up before it'll sit nicely there) and currently thinking of doing something like this:

 

• domain-based DFS namespace
  
• multiple file servers for load balancing
  
• aiming for up to around 1TB per server so they're not too large for creating snapshots, migrations etc.
  
• no replication at present (all VMs stored on the same SAN anyway)
  

Question is does anyone use multiple file shares on each file server for their shared areas or do you just use the one? Not sure if there's any benefit to making a couple of shares e.g. DATA1, DATA2 and spreading the subfolders between them (each subfolder will have individual NTFS permissions per AD group).

 

One final question that will come out in testing anyway but saves some time: if an individual server hosting files goes down does the namespace still display the structure but gives errors (or timeout) on access or does the missing part of the namespace disappear from view?

[3s-gtech]

We use multiple shares with DFS. A share for staff, one for pupils, one for admins etc. Allows us to manage how they're replicated and gives some share security as well as NTFS permissions. So long as there aren't a huge number of different shares it should be fine.

 

If a server goes down (that's replicated) nothing happens for users - they just get punted to a working replication partner. If it's not replicated, the namespace will still show (as this is hosted by all of the DFS servers) but the share won't be accessible.

[gshaw]

Yeah will have different ones for staff shared, curriculum shared etc. but within our staff and admin areas there's a lot of subfolders so just mulling over if to split it up a bit to get a nice balance between have some separation but not going mad with shares everywhere.

 

How reliable has the replication been for you? General consensus seems to be it works well but having had to recover from a DFS replication issue between two DCs after a power cut the thought of doing that with potentially thousands of files and not knowing which is the correct version is making me think twice.

[3s-gtech]

On 2008 R2 it was okay - used to get issues which would freeze up replication every so often. I switched the servers to 2012 R2 as soon as it was available - since then it has been excellent. I have one folder which I don't publish from one server to the namespace - it's replicated but users never connect to that server for that folder - done because some changes would never appear in there if done on other servers or vice versa. All of the other namespaces have been fine. I suspect it was an issue with the staging area, but the setup works nicely otherwise - I added a third server to replicate offsite following this and that works lovely.

[gshaw]

Just running a few more tests before I start putting the live environment in, just looking to verify the permissions side of things.

 

Will probably go for a namespace of \\domain.fqdn\shared for the shared drive data then do something else for homes later on.

 

Server-wise I have a couple of servers up and running which will host the namespace (domain namespace), which will also be hosting the data shares. Because we're migrating multiple servers I've spread the shares over two new servers.

 

Permissions-wise I have this, which is where I start wondering:

 

> default Windows SYSTEM, Administrators etc. with Full Control, plus some "Supervisors" AD groups I'm adding for Helpdesk etc. to be able to browse through the file system without needing Domain Admin level rights.

> at the top level folder i.e. the one that's shared I grant Authenticated Users read rights (This Folder Only) so users have rights to read the subfolders beneath

> on each subfolder I add a particular AD group for the department in question with Modify (This folder, subfolders and files) so users can do whatever they need within the folder

> on the subfolder add a Deny (This Folder Only) for the Delete right to prevent users accidentally deleting the subfolder and everything within it (!)

 

Obviously within DFS world users can't delete subfolders as they're governed by the DFS namespace rights but just in case someone, somehow navigates to the share target wanted to make sure there's no chance of any accidents occurring. On the DFS Management console I've also done:

 

> on creation of namespace use the "Users can view" option i.e. grant read-only permissions to the DFS Root for users

> Enable Access Based Enumeration for namespace

> on each Folder added to the namespace change permissions to Set explicit view permissions and added the security group for the department in each case (ensures staff can only see folders they have access to)

 

In testing all seems to work but any other suggestions to the above would be much appreciated

Edited July 13, 2016 by gshaw

[cmpwat]

Hi

 

I was wondering what you r physical layer looked like as I am in the process of trying to design a file server and wondering whether to:

 

a.) have one VM FS sitting on HA Hyper-V Cluster with 600Gb of disk space or

b). have 2 VM FSs sitting on HA Hyper-V Cluster with new cluster created with the 2 new FSs as hosts and connected to SAN LUN and then create File Serve role from Cluster manager?

 

Any thoughts?