DFS Management

Distributed File System is implemented as a role service of the File Services role. Distributed File System consists of two role services:

  • DFS Namespaces

  • DFS Replication

To manage DFS Namespaces and DFS Replication, you can use the DFS Management snap-in hosted by Server Manager, or you can use the DFS Management snap-in from the Administrative Tools folder. Or you can use command prompt tools, as discussed later in this topic.

Important

To view or manage replication groups that contain read-only replicated folders or members that are failover clusters, you must use the version of DFS Management that is included with Windows Server 2008 R2.

For more information about DFS Namespaces and DFS Replication, see the following topics:

  • Installing DFS

  • Namespaces

  • Replication

  • Resources for DFS Management

Managing DFS from a Command Prompt

To manage Distributed File System from a command prompt you can use the commands listed in the following table, or write scripts that use Windows Management Instrumentation (WMI).

Command | Description
DfsUtil | Manages DFS namespaces, server and client computers.
DfsCmd | Configures DFS folders and folder targets in a DFS namespace.
DfsDiag | Performs diagnostics tests of DFS Namespaces.
DfsrAdmin | Manages DFS Replication replicated folders.
DfsrDiag | Performs diagnostic tests of DFS Replication.

Additional references

  • What's New in Distributed File System in Windows Server® 2008 R2

    (http://go.microsoft.com/fwlink/?LinkId=139569)

  • SYSVOL Replication Migration Guide: FRS to DFS Replication

    (http://go.microsoft.com/fwlink/?LinkId=139749)

  • Windows Server 2008 Command Reference

    (http://go.microsoft.com/fwlink/?LinkId=140139)


Installing DFS

To manage DFS Namespaces and DFS Replication, you must install the DFS Management snap-in. Use one of the following methods to install the DFS Management snap-in.

Important

To view or manage replication groups that contain read-only replicated folders or members that are failover clusters, you must use the version of DFS Management that is included with Windows Server 2008 R2.

Installing DFS Management

  • Using the Windows interface

  • Using a command line
To install DFS Management by using the Windows interface

  • To install DFS Management and related services, from Server Manager, use the Add Roles Wizard to select the File Services role, and then select the Distributed File System role service. This configures the server to be a file server, installs the DFS Management snap-in, and installs and starts the DFS Namespaces and DFS Replication services.

  • To install only DFS Management and command-line tools, from Server Manager, use the Add Features Wizard to install the Remote Server Administration Tools feature, select Role Administration Tools and select the File Services Tools feature with the Distributed File System Tools option. The Distributed File System Tools option installs the DFS Management snap-in and command-line tools, but it does not install any DFS services on the server.

To install DFS Management by using a command line

  • Open a command prompt window and type the following command, where <name> is the role, role service, or feature that you want to install (see the following table for an abbreviated list of relevant parameters):

    ServerManagerCmd -install <name>

    For example, to install the Distributed File System Tools portion of the Remote Server Administration Tools feature, type:

    ServerManagerCmd -install RSAT-DFS-Mgmt-Con

    Description Parameter

    File Services server role

    File-Services

    Distributed File System role service

    FS-DFS

    DFS Namespaces role service

    FS-DFS-Namespace

    DFS Replication role service

    FS-DFS-Replication

    Distributed File System Tools feature

    RSAT-DFS-Mgmt-Con
    Note

    To install DFS Replication on Windows Web Server 2008 R2, you must use the OCSetup DFSR-Infrastructure-ServerEdition command.

Additional references

  • Namespaces

  • Replication


Namespaces

DFS Namespaces enables you to group shared folders that are located on different servers into one or more logically structured namespaces. Each namespace appears to users as a single shared folder with a series of subfolders. However, the underlying structure of the namespace can consist of numerous shared folders that are located on different servers and in multiple sites.

This structure increases availability and automatically connects users to shared folders in the same AD DS site, when available, instead of routing them over wide area network (WAN) connections.

  • Overview of DFS Namespaces

  • Checklist: Deploy DFS Namespaces

  • Checklist: Tune a DFS Namespace

  • Deploying DFS Namespaces

  • Tuning DFS Namespaces

  • Resources for DFS Management

Note

Most tasks require you to be a member of the Domain Admins group in Active Directory Domain Services (AD DS), unless you have been delegated the appropriate authority. To manage a remote server, you might also need to be a member of local Administrators group on the server that you want to manage. For more information see Delegate Management Permissions for DFS Namespaces.


Overview of DFS Namespaces

A namespace is a virtual view of shared folders in an organization. The path to a namespace is similar to a Universal Naming Convention (UNC) path to a shared folder, such as \\Server1\Public\Software\Tools. In this example, the shared folder Public and its subfolders Software and Tools are all hosted on Server1.

If you want to give users a single place to locate data, but you want to host data on different servers for availability and performance purposes, you can deploy a namespace similar to the one shown in the following figure. The elements of this namespace are described following the figure.

DFS Namespaces technology elements
  • Namespace server. A namespace server hosts a namespace. The namespace server can be a member server or a domain controller.

  • Namespace root. The namespace root is the starting point of the namespace. In the previous figure, the name of the root is Public, and the namespace path is \\Contoso\Public. This type of namespace is a domain-based namespace because it begins with a domain name (for example, Contoso) and its metadata is stored in Active Directory Domain Services (AD DS). Although a single namespace server is shown in the previous figure, a domain-based namespace can be hosted on multiple namespace servers to increase the availability of the namespace.

  • Folder. Folders without folder targets add structure and hierarchy to the namespace, and folders with folder targets provide users with actual content. When users browse a folder that has folder targets in the namespace, the client computer receives a referral that transparently redirects the client computer to one of the folder targets.

  • Folder targets. A folder target is the UNC path of a shared folder or another namespace that is associated with a folder in a namespace. The folder target is where data and content is stored. In the previous figure, the folder named Tools has two folder targets, one in London and one in New York, and the folder named Training Guides has a single folder target in New York. A user who browses to \\Contoso\Public\Software\Tools is transparently redirected to the shared folder \\LDN-SVR-01\Tools or \\NYC-SVR-01\Tools, depending on which site the user is currently located in.

Note

Folders can contain folder targets or other DFS folders, but not both at the same level in the folder hierarchy.

You can administer namespaces by using DFS Management, the DfsUtil command, or scripts that call WMI.

Additional references

  • DFS Management


Checklist: Deploy DFS Namespaces

DFS Namespaces and DFS Replication can be used to publish documents, software, and line-of-business data to users throughout an organization. Although DFS Replication alone is sufficient to distribute data, you can use DFS Namespaces to configure the namespace so that a folder is hosted by multiple servers, each of which holds an updated copy of the folder. This increases data availability and distributes the client load across servers.

When browsing a folder in the namespace, users are not aware that the folder is hosted by multiple servers. When a user opens the folder, the client computer is automatically referred to a server on its site. If no same-site servers are available, you can configure the namespace to refer the client to a server that has the lowest connection cost as defined in AD DS.

To deploy DFS Namespaces, perform the following tasks:

Task | Reference
Review the basic concepts of DFS Namespaces | Overview of DFS Namespaces
Review requirements and prepare to deploy DFS Namespaces | Prepare to Deploy DFS Namespaces
Install DFS Management | Installing DFS
Create a DFS namespace | Create a DFS Namespace
Migrate existing domain-based namespaces to Windows Server 2008 mode domain-based namespaces | Migrate a Domain-based Namespace to Windows Server 2008 Mode
Increase availability by adding namespace servers to a domain-based namespace | Add Namespace Servers to a Domain-based DFS Namespace
Add folders to a namespace | Create a Folder in a DFS Namespace
Add folder targets to folders in a namespace | Add Folder Targets
Replicate content between folder targets using DFS Replication (optional) | Replicate Folder Targets Using DFS Replication

Additional references

  • Namespaces

  • Checklist: Tune a DFS Namespace

  • Replication


Checklist: Tune a DFS Namespace

After creating a namespace and adding folders and targets, use the following checklist to tune or optimize the way DFS Namespace handles referrals and polls Active Directory Domain Services (AD DS) for updated namespace data.

In addition, by using a DFS Namespaces enhancement known as target priority, you can specify the priority of servers so that a specific server is always placed first or last in the list of servers (known as a referral) that the client receives when it accesses a folder with targets in the namespace.

Task | Reference
Prevent users from seeing folders in a namespace that they do not have permissions to access | Enable Access-Based Enumeration on a Namespace
Enable or prevent users from being referred to a namespace or folder target when they access a folder in the namespace | Enable or Disable Referrals and Client Failback
Adjust how long clients cache a referral before requesting a new one | Change the Amount of Time That Clients Cache Referrals
Specify in what order users should be referred to folder targets | Set the Ordering Method for Targets in Referrals
Override referral ordering for a specific namespace server or folder target | Set Target Priority to Override Referral Ordering
Optimize how namespace servers poll AD DS to obtain the most current namespace data | Optimize Namespace Polling
Use inherited permissions to control which users can view folders in a namespace for which access-based enumeration is enabled | Using Inherited Permissions with Access-Based Enumeration

Additional references

  • Namespaces

  • Checklist: Deploy DFS Namespaces

  • Tuning DFS Namespaces


Deploying DFS Namespaces

To deploy DFS Namespaces, refer to the following topics:

  • Prepare to Deploy DFS Namespaces

  • Create a DFS Namespace

  • Migrate a Domain-based Namespace to Windows Server 2008 Mode

  • Add Namespace Servers to a Domain-based DFS Namespace

  • Create a Folder in a DFS Namespace

  • Add Folder Targets

  • Replicate Folder Targets Using DFS Replication

  • Delegate Management Permissions for DFS Namespaces


Prepare to Deploy DFS Namespaces

The following sections provide information about preparing to deploy DFS Namespaces:

  • Review DFS Namespaces Client Requirements

  • Review DFS Namespaces Server Requirements

  • Choose a Namespace Type


Review DFS Namespaces Client Requirements

The following operating systems include full support for DFS Namespaces, including support for client failback to the preferred folder target:

  • Windows 7

  • Windows Server 2008 R2

  • Windows Server 2008

  • Windows Vista Business, Windows Vista Enterprise, Windows Vista Ultimate

  • Windows Server 2003 R2

  • Windows Storage Server 2003 R2

  • Windows Server 2003 with SP2, or SP1 and the Windows Server 2003 client failback hotfix

  • Windows XP Professional with SP3, or SP2 and the Windows XP client failback hotfix

These hotfixes are described in article 898900 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=53202).

Users who are running the following operating systems can access namespaces, but if a folder target becomes unavailable and then later comes back online, the computer will not fail back (return) to the preferred folder target.

  • Windows Storage Server 2003

  • Windows XP Professional

  • Windows Preinstallation Environment (Windows PE)

    (Windows PE can access stand-alone namespaces, but it cannot access domain-based namespaces.)

  • Windows 2000 Server

  • Windows 2000 Professional

Additional references

  • Deploying DFS Namespaces

  • Enable or Disable Referrals and Client Failback


Review DFS Namespaces Server Requirements

A namespace server is a domain controller or member server that hosts a namespace. The number of namespaces you can host on a server is determined by the operating system running on the namespace server.

The following servers can host multiple domain-based and stand-alone namespaces:

  • Windows Server 2008 R2 Enterprise

  • Windows Server 2008 R2 Datacenter

  • Windows Server 2008 Enterprise

  • Windows Server 2008 Datacenter

  • Windows Server 2003 R2, Enterprise Edition

  • Windows Server 2003 R2, Datacenter Edition

  • Windows Server 2003, Enterprise Edition

  • Windows Server 2003, Datacenter Edition

Servers that are running the following operating systems can host multiple domain-based namespaces in addition to a single stand-alone namespace:

  • Windows Server 2008 R2 Standard

  • Windows Server 2008 Standard

  • Windows Server 2003 R2, Standard Edition with Service Pack 2 or later

  • Windows Server 2003, Standard Edition with Service Pack 2 or later

Servers running the following operating systems can host only a single namespace of any type:

  • Windows Server 2003 R2, Standard Edition

  • Windows Server 2003, Standard Edition

  • Any version of Windows 2000 Server

Note

Windows Server 2003, Web Edition cannot host any namespaces. It can act as a folder target; though a maximum of 10 concurrent incoming server message block (SMB) connections are permitted.

The following table describes additional factors to consider when choosing servers to host a namespace.

Guidelines for Servers that Host Namespaces

Server Hosting Stand-Alone Namespaces Server Hosting Domain-Based Namespaces
  • Only servers running Windows Server 2008 support access-based enumeration for stand-alone or domain-based (Windows Server 2008 mode) namespaces.

  • Must contain an NTFS volume to host the namespace.

  • Can be a member server or domain controller.

  • Can be hosted by a failover cluster to increase the availability of the namespace.
  • Only servers running Windows Server 2008 can host domain-based namespaces in Windows Server 2008 mode.

  • Must contain an NTFS volume to host the namespace.

  • Must be a member server or domain controller in the domain in which the namespace is configured. (This requirement applies to every namespace server that hosts a given domain-based namespace.)

  • Can use multiple namespace servers to increase the availability of the namespace

  • The namespace cannot be a clustered resource in a failover cluster. However, you can locate the namespace on a server that also functions as a node in a failover cluster if you configure the namespace to use only local resources on that server.

Additional references

  • Deploying DFS Namespaces

  • Choose a Namespace Type


Choose a Namespace Type

When creating a namespace, you must choose one of two namespace types: a stand-alone namespace or a domain-based namespace. In addition, if you choose a domain-based namespace, you must choose a namespace mode: Windows 2000 Server mode or Windows Server 2008 mode.

Choosing a namespace type

Choose a stand-alone namespace if any of the following conditions apply to your environment:

  • Your organization does not use Active Directory Domain Services (AD DS).

  • You want to increase the availability of the namespace by using a failover cluster.

  • You need to create a single namespace with more than 5,000 DFS folders in a domain that does not meet the requirements for a domain-based namespace (Windows Server 2008 mode)—as described later in this topic.

    Note

    To check the size of a namespace, right-click the namespace in the DFS Management console tree, click Properties, and then view the namespace size in the Namespace Properties dialog box. For more information about DFS Namespace scalability, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=92838).

Choose a domain-based namespace if any of the following conditions apply to your environment:

  • You want to ensure the availability of the namespace by using multiple namespace servers.

  • You want to hide the name of the namespace server from users. This makes it easier to replace the namespace server or migrate the namespace to another server.

Choosing a domain-based namespace mode

If you choose a domain-based namespace, you must choose whether to use the Windows 2000 Server mode or the Windows Server 2008 mode. The Windows Server 2008 mode includes support for access-based enumeration and increased scalability. The domain-based namespace introduced in Windows 2000 Server is now referred to as "domain-based namespace (Windows 2000 Server mode)."

To use the Windows Server 2008 mode, the domain and namespace must meet the following minimum requirements:

  • The forest uses the Windows Server 2003 or higher forest functional level.

  • The domain uses the Windows Server 2008 domain functional level.

  • All namespace servers are running Windows Server 2008.

If your environment supports it, choose the Windows Server 2008 mode when you create new domain-based namespaces. This mode provides additional features and scalability, and also eliminates the possible need to migrate a namespace from the Windows 2000 Server mode.

For information about migrating a namespace to Windows Server 2008 mode, see Migrate a Domain-based Namespace to Windows Server 2008 Mode.

If your environment does not support domain-based namespaces in Windows Server 2008 mode, use the existing Windows 2000 Server mode for the namespace.

Comparing namespace types and modes

The characteristics of each namespace type and mode are described in the following table.

Characteristic | Stand-Alone Namespace | Domain-based Namespace (Windows 2000 Server Mode) | Domain-based Namespace (Windows Server 2008 Mode)
Path to namespace | \\ServerName\RootName | \\NetBIOSDomainName\RootName \\DNSDomainName\RootName | \\NetBIOSDomainName\RootName \\DNSDomainName\RootName
Namespace information storage location | In the registry and in a memory cache on the namespace server | In AD DS and in a memory cache on each namespace server | In AD DS and in a memory cache on each namespace server
Namespace size recommendations | The namespace can contain more than 5,000 folders with targets | The size of the namespace object in AD DS should be less than 5 megabytes (MB) to maintain compatibility with domain controllers that are not running Windows Server 2008. This means no more than approximately 5,000 folders with targets. | The namespace can contain more than 5,000 folders with targets
Minimum AD DS forest functional level | AD DS is not required | Windows 2000 | Windows Server 2003
Minimum AD DS domain functional level | AD DS is not required | Windows 2000 mixed | Windows Server 2008
Minimum supported namespace servers | Windows 2000 Server | Windows 2000 Server | Windows Server 2008
Support for access-based enumeration (if enabled) | Yes, requires Windows Server 2008 namespace server | No | Yes
Supported methods to ensure namespace availability | Create a stand-alone namespace on a failover cluster. | Use multiple namespace servers to host the namespace. (The namespace servers must be in the same domain.) | Use multiple namespace servers to host the namespace. (The namespace servers must be in the same domain.)
Support for using DFS Replication to replicate folder targets | Supported when joined to an AD DS domain | Supported | Supported

Additional references

  • Deploying DFS Namespaces

  • Migrate a Domain-based Namespace to Windows Server 2008 Mode


Create a DFS Namespace

You can create a new namespace when you install the DFS Namespaces role service by using the Add Roles Wizard or Add Role Service Wizard of Server Manager. Or you can use the following procedure to create a namespace after installing the role service.

To create a namespace

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, right-click the Namespaces node, and then click New Namespace.

  3. Follow the instructions in the New Namespace Wizard.

    To create a stand-alone namespace on a failover cluster, specify the name of a clustered file server instance on the Namespace Server page of the New Namespace Wizard.

    Important

    Do not attempt to create a domain-based namespace using the Windows Server 2008 mode unless the forest functional level is Windows Server 2003 or higher. Doing so can result in a namespace for which you cannot delete DFS folders, yielding the following error message: “The folder cannot be deleted. Cannot complete this function.”

Additional references

  • Deploying DFS Namespaces

  • Choose a Namespace Type

  • Add Namespace Servers to a Domain-based DFS Namespace

  • Delegate Management Permissions for DFS Namespaces.


Migrate a Domain-based Namespace to Windows Server 2008 Mode

The Windows Server 2008 mode for domain-based namespaces includes support for access-based enumeration and increased scalability.

To migrate a domain-based namespace from Windows 2000 Server mode to Windows Server 2008 mode, you must export the namespace to a file, delete the namespace, recreate it in Windows Server 2008 mode, and then import the namespace settings. To do so, use the following procedure.

To migrate a domain-based namespace to Windows Server 2008 mode

  1. Open a Command Prompt window and type the following command to export the namespace to a file, where \\domain\namespace is the name of the appropriate domain and namespace and path\filename is the path and file name of the export file:

    Dfsutil root export \\domain\namespace path\filename.xml

  2. Write down the path (\\server\share) for each namespace server. You must manually add namespace servers to the recreated namespace because Dfsutil cannot import namespace servers.

  3. In DFS Management, right-click the namespace and then click Delete, or type the following command at a command prompt, where \\domain\namespace is the name of the appropriate domain and namespace:

    Dfsutil root remove \\domain\namespace

  4. In DFS Management, recreate the namespace with the same name, but use the Windows Server 2008 mode, or type the following command at a command prompt, where \\server\namespace is the name of the appropriate server and share for the namespace root:

    Dfsutil root adddom \\server\namespace v2

  5. To import the namespace from the export file, type the following command at a command prompt, where \\domain\namespace is the name of the appropriate domain and namespace and path\filename is the path and file name of the file to import:

    Dfsutil root import merge path\filename.xml \\domain\namespace
    Note

    To minimize the time that is required to import a large namespace, run the Dfsutil root import command locally on a namespace server.

  6. Add any remaining namespace servers to the recreated namespace by right-clicking the namespace in DFS Management and then clicking Add Namespace Server, or by typing the following command at a command prompt, where \\server\share is the name of the appropriate server and share for the namespace root:

    Dfsutil target add \\server\share
    Note

    You can add namespace servers before importing the namespace, but doing so causes the namespace servers to incrementally download the metadata for the namespace instead of immediately downloading the entire namespace after being added as a namespace server.

Additional references

  • Deploying DFS Namespaces

  • Choose a Namespace Type


Add Namespace Servers to a Domain-based DFS Namespace

You can increase the availability of a domain-based namespace by specifying additional namespace servers to host the namespace.

To add a namespace server to a domain-based namespace

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a domain-based namespace, and then click Add Namespace Server.

  3. Enter the path to another server, or click Browse to locate a server.
Note

This procedure is not applicable for stand-alone namespaces because stand-alone namespaces support only a single namespace server. To increase the availability of a stand-alone namespace, specify a failover cluster as the namespace server in the New Namespace Wizard.

Additional references

  • Deploying DFS Namespaces

  • Review DFS Namespaces Server Requirements

  • Create a DFS Namespace

  • Delegate Management Permissions for DFS Namespaces


Create a Folder in a DFS Namespace

You can use folders to create additional levels of hierarchy in a namespace. You can also create folders with folder targets to add shared folders to the namespace. DFS folders with folder targets cannot contain other DFS folders, so if you want to add a level of hierarchy to the namespace, do not add folder targets to the folder. Follow this procedure to create a folder in a namespace.

To create a folder in a namespace

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a namespace or a folder within a namespace, and then click New Folder.

  3. In the Name text box, type the name of the new folder.

  4. To add one or more folder targets to the folder, click Add and specify the Universal Naming Convention (UNC) path of the folder target, and then click OK.

Additional references

  • Deploying DFS Namespaces

  • Delegate Management Permissions for DFS Namespaces


Add Folder Targets

A folder target is the Universal Naming Convention (UNC) path of a shared folder or another namespace that is associated with a folder in a namespace. Adding multiple folder targets increases the availability of the folder in the namespace.

To add a folder target

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a folder, and then click Add Folder Target.

  3. Type the path to the folder target, or click Browse to locate the folder target.

  4. If the folder is replicated by using DFS Replication, you can specify whether to add the new folder target to the replication group.
Note

Folders can contain folder targets or other DFS folders, but not both, at the same level in the folder hierarchy.

Additional references

  • Deploying DFS Namespaces

  • Delegate Management Permissions for DFS Namespaces

  • Replicate Folder Targets Using DFS Replication


Replicate Folder Targets Using DFS Replication

You can use DFS Replication to keep the contents of folder targets in sync so that users see the same files regardless of which folder target the client computer is referred to.

To replicate folder targets using DFS Replication

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a folder that has two or more folder targets, and then click Replicate Folder.

  3. Follow the instructions in the Replicate Folder Wizard.

Note

Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

Additional references

  • Deploying DFS Namespaces

  • Delegate Management Permissions for DFS Namespaces

  • Replication


Delegate Management Permissions for DFS Namespaces

The following table describes the groups that can perform basic namespace tasks by default, and the method for delegating the ability to perform these tasks.

Task | Groups that Can Perform this Task by Default | Delegation Method
Create a domain-based namespace | Domain Admins group in the domain where the namespace is configured | Right-click the Namespaces node in the console tree, and then click Delegate Management Permissions. You must also add the user to the local Administrators group on the namespace server.
Add a namespace server to a domain-based namespace | Domain Admins group in the domain where the namespace is configured | Right-click the domain-based namespace in the console tree, and then click Delegate Management Permissions. You must also add the user to the local Administrators group on the namespace server to be added.
Manage a domain-based namespace | Local Administrators group on each namespace server | Right-click the domain-based namespace in the console tree, and then click Delegate Management Permissions.
Create a stand-alone namespace | Local Administrators group on the namespace server | Add the user to the local Administrators group on the namespace server.
Manage a stand-alone namespace* | Local Administrators group on the namespace server | Right-click the stand-alone namespace in the console tree, and then click Delegate Management Permissions.
Create a replication group or enable DFS Replication on a folder | Domain Admins group in the domain where the namespace is configured | Right-click the Replication node in the console tree, and then click Delegate Management Permissions.

* Delegating management permissions to manage a stand-alone namespace does not grant the user the ability to view and manage security by using the Delegation tab unless the user is a member of the local Administrators group on the namespace server. This issue occurs because the DFS Management snap-in cannot retrieve the discretionary access control lists (DACLs) for the stand-alone namespace from the registry. To enable the snap-in to display delegation information, you must follow the steps in article 314837 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink?linkid=46803).


Tuning DFS Namespaces

After creating a namespace and adding folders and targets, refer to the following sections to tune or optimize the way DFS Namespace handles referrals and polls Active Directory Domain Services (AD DS) for updated namespace data:

  • Enable Access-Based Enumeration on a Namespace

  • Enable or Disable Referrals and Client Failback

  • Change the Amount of Time That Clients Cache Referrals

  • Set the Ordering Method for Targets in Referrals

  • Set Target Priority to Override Referral Ordering

  • Optimize Namespace Polling

  • Using Inherited Permissions with Access-Based Enumeration

Note

To search for folders or folder targets, select a namespace, click the Search tab, type your search string in the text box, and then click Search.


Enable Access-Based Enumeration on a Namespace

Access-based enumeration hides files and folders that users do not have permission to access. By default, this feature is not enabled for DFS namespaces. You can enable access-based enumeration of DFS folders by using DFS Management. To control access-based enumeration of files and folders in folder targets, you must enable access-based enumeration on each shared folder by using Share and Storage Management.

To enable access-based enumeration on a namespace, all namespace servers must be running Windows Server 2008 or newer. Additionally, domain-based namespaces must use the Windows Server 2008 mode. For information about the requirements of the Windows Server 2008 mode, see Choose a Namespace Type.

In some environments, enabling access-based enumeration can cause high CPU utilization on the server and slow response times for users. For more information, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=140356).

Note

If you upgrade the domain functional level to Windows Server 2008 while there are existing domain-based namespaces, DFS Management will allow you to enable access-based enumeration on these namespaces. However, you will not be able to edit permissions to hide folders from any groups or users unless you migrate the namespaces to the Windows Server 2008 mode. For more information, see Migrate a Domain-based Namespace to Windows Server 2008 Mode.

To use access-based enumeration with DFS Namespaces to control which groups or users can view which DFS folders, you must follow these steps.

  • Enable access-based enumeration on a namespace

  • Control which users and groups can view individual DFS folders

Caution

Access-based enumeration does not prevent users from getting a referral to a folder target if they already know the DFS path. Only the share permissions or the NTFS file system permissions of the folder target (shared folder) itself can prevent users from accessing a folder target. DFS folder permissions are used only for displaying or hiding DFS folders, not for controlling access, making Read access the only relevant permission at the DFS folder level. For more information, see Using Inherited Permissions with Access-Based Enumeration.

Enabling access-based enumeration on a namespace

  • Using the Windows interface

  • Using a command line
To enable access-based enumeration by using the Windows interface

  1. In the console tree, under the Namespaces node, right-click the appropriate namespace and then click Properties.

  2. Click the Advanced tab and then select the Enable access-based enumeration for this namespace check box.

To enable access-based enumeration by using a command line

  1. Open a command prompt window on a server that has the Distributed File System role service or Distributed File System Tools feature installed.

  2. Type the following command, where <namespace_root> is the root of the namespace:

    dfsutil property abe enable \\<namespace_root>

Controlling which users and groups can view individual DFS folders

  • Using the Windows interface

  • Using a command line
To control folder visibility by using the Windows interface

  1. In the console tree, under the Namespaces node, locate the folder with targets for which you want to control visibility, right-click it and then click Properties.

  2. Click the Advanced tab.

  3. Click Set explicit view permissions on the DFS folder and then Configure view permissions.

  4. Add or remove groups or users by clicking Add or Remove.

  5. To allow users to see the DFS folder, select the group or user and then select the Allow check box.

    To hide the folder from a group or user, select the group or user and then select the Deny check box.

To control folder visibility by using a command line

  1. Open a command prompt window on a server that has the Distributed File System role service or Distributed File System Tools feature installed.

  2. Type the following command, where <DFSPath> is the path of the DFS folder (link), <DOMAIN\Account> is the name of the group or user account, and (…) is replaced with additional Access Control Entries (ACEs):

    dfsutil property sd grant <DFSPath> DOMAIN\Account:R (…) Protect Replace

    For example, to replace existing permissions with permissions that allows the Domain Admins and CONTOSO\Trainers groups Read (R) access to the \\contoso.office\public\training folder, type the following command:

    dfsutil property sd grant \\contoso.office\public\training ”CONTOSO\Domain Admins”:R CONTOSO\Trainers:R Protect Replace

  3. To perform additional tasks from the command prompt, use the following commands

    Command Description

    Dfsutil property sd deny

    Denies a group or user the ability to view the folder.

    Dfsutil property sd reset

    Removes all permissions from the folder.

    Dfsutil property sd revoke

    Removes a group or user ACE from the folder.

Additional references

  • Create a DFS Namespace

  • Delegate Management Permissions for DFS Namespaces

  • Installing DFS

  • Using Inherited Permissions with Access-Based Enumeration


Enable or Disable Referrals and Client Failback

A referral is an ordered list of servers that a client computer receives from a domain controller or namespace server when the user accesses a namespace root or DFS folder with targets. After the computer receives the referral, the computer attempts to access the first server in the list. If the server is not available, the client computer attempts to access the next server. If a server becomes unavailable, you can configure clients to fail back to the preferred server after it becomes available.

The following sections provide information about how to enable or disable referrals or enable client fail back.

Enable or disable referrals

By disabling a namespace server’s or folder target’s referral, you can prevent users from being directed to that namespace server or folder target. This is useful if you need to temporarily take a server offline for maintenance.

To enable or disable referrals

  • To enable or disable referrals to a folder target, use the following steps:

    1. In the DFS Management console tree, under the Namespaces node, click a folder with targets, and then click the Folder Targets tab in the details pane.

    2. Right-click the folder target, and then click either Disable Folder Target or Enable Folder Target.

  • To enable or disable referrals to a namespace server, use the following steps:

    1. In the DFS Management console tree, select the appropriate namespace and then click the Namespace Servers tab.

    2. Right-click the appropriate namespace server and then click either Disable Namespace Server or Enable Namespace Server.

Enable client fail back

If a target becomes unavailable, you can configure clients to fail back to the target after it is restored. For fail back to work, client computers must meet the requirements listed in the following topic: Review DFS Namespaces Client Requirements.

To enable client failback for a namespace root

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a namespace, and then click Properties.

  3. On the Referrals tab, select the Clients fail back to preferred targets check box.

Folders with targets inherit client failback settings from the namespace root. If client failback is disabled on the namespace root, you can use the following procedure to enable the client to fail back on a folder with targets.

To enable client fail back for a folder with targets

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a folder with targets, and then click Properties.

  3. On the Referrals tab, click the Clients fail back to preferred targets check box.

Additional references

  • Tuning DFS Namespaces

  • Review DFS Namespaces Client Requirements

  • Delegate Management Permissions for DFS Namespaces


Change the Amount of Time That Clients Cache Referrals

A referral is an ordered list of targets that a client computer receives from a domain controller or namespace server when the user accesses a namespace root or folder with targets in the namespace. You can adjust how long clients cache a referral before requesting a new one.

To change the amount of time that clients cache namespace root referrals

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a namespace, and then click Properties.

  3. On the Referrals tab, in the Cache duration (in seconds) text box, type the amount of time (in seconds) that clients cache namespace root referrals. The default setting is 300 seconds (five minutes).
To change the amount of time that clients cache folder referrals

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a folder that has targets, and then click Properties.

  3. On the Referrals tab, in the Cache duration (in seconds) text box, type the amount of time (in seconds) that clients cache folder referrals. The default setting is 1800 seconds (30 minutes).

Additional references

  • Tuning DFS Namespaces

  • Delegate Management Permissions for DFS Namespaces


Set the Ordering Method for Targets in Referrals

A referral is an ordered list of targets that a client computer receives from a domain controller or namespace server when the user accesses a namespace root or folder with targets. After the client receives the referral, the client attempts to access the first target in the list. If the target is not available, the client attempts to access the next target.

Targets on the client's site are always listed first in a referral. Targets outside of the client's site are listed according to the ordering method.

Use the following sections to specify in what order targets should be referred to clients and to understand the different methods of ordering target referrals.

Set the ordering method

Use the following procedure to set the ordering method on the namespace root.

To set the ordering method for targets in namespace root referrals

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a namespace, and then click Properties.

  3. On the Referrals tab, select an ordering method.

Folders with targets inherit the ordering method from the namespace root. You can override the ordering method by using the following procedure.

To set the ordering method for targets in folder referrals

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a folder with targets, and then click Properties.

  3. On the Referrals tab, select the Exclude targets outside of the client's site check box.

Target referral ordering methods

The three ordering methods are:

  • Random order

  • Lowest cost

  • Exclude targets outside of the client's site

Random order

In this method, targets are ordered as follows:

  1. Targets in the same AD DS site as the client are listed in random order at the top of the referral.

  2. Targets outside of the client’s site are listed in random order.

If no same-site target servers are available, the client computer is referred to a random target server regardless of how expensive the connection is or how distant the target is.

Lowest cost

In this method, targets are ordered as follows:

  1. Targets in the same site as the client are listed in random order at the top of the referral.

  2. Targets outside of the client’s site are listed in order of lowest cost to highest cost. Referrals with the same cost are grouped together, and the targets are listed in random order within each group.

Note

Site link costs are not shown in the DFS Management snap-in. To view site link costs, use the Active Directory Sites and Services snap-in.

Exclude targets outside of the client's site

In this method, the referral contains only the targets that are in the same site as the client. These same-site targets are listed in random order. If no same-site targets exist, the client does not receive a referral and cannot access that portion of the namespace.

Note

Targets that have target priority set to "First among all targets" or "Last among all targets" are still listed in the referral, even if the ordering method is set to Exclude targets outside of the client's site.

Additional references

  • Tuning DFS Namespaces

  • Delegate Management Permissions for DFS Namespaces


Set Target Priority to Override Referral Ordering

A referral is an ordered list of targets that a client computer receives from a domain controller or namespace server when the user accesses a namespace root or folder with targets in the namespace. Each target in a referral is ordered according to the ordering method for the namespace root or folder. To refine how targets are ordered, you can set priority on individual targets. For example, you can specify that the target is first among all targets, last among all targets, or first (or last) among all targets of equal cost.

To set target priority on a root target for a domain-based namespace, use the following procedure.

To set target priority on a root target for a domain-based namespace

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, click the domain-based namespace for the root targets that you want to set priority on.

  3. In the details pane, on the Namespace Servers tab, right-click the root target with the priority that you want to change, and then click Properties.

  4. On the Advanced tab, click Override referral ordering, and then click the priority that you want.

    • First among all targets Specifies that users should always be referred to this target if the target is available.

    • Last among all targets Specifies that users should never be referred to this target unless all other targets are unavailable.

    • First among targets of equal cost Specifies that users should be referred to this target before other targets of equal cost (which usually means other targets in the same site).

    • Last among targets of equal cost Specifies that users should never be referred to this target if there are other targets of equal cost available (which usually means other targets in the same site).

To set target priority on a folder target, use the following procedure.

To set target priority on a folder target

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, click the folder of the targets that you want to set priority on.

  3. In the details pane, on the Folder Targets tab, right-click the folder target with the priority that you want to change, and then click Properties.

  4. On the Advanced tab, click Override referral ordering, and then click the priority that you want.

Additional references

  • Tuning DFS Namespaces

  • Delegate Management Permissions for DFS Namespaces


Optimize Namespace Polling

To maintain a consistent domain-based namespace across namespace servers, it is necessary for namespace servers to periodically poll Active Directory Domain Services (AD DS) to obtain the most current namespace data. You can use this procedure to optimize how this polling occurs.

To optimize namespace polling

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Namespaces node, right-click a domain-based namespace, and then click Properties.

  3. On the Advanced tab, select whether the namespace will be optimized for consistency or scalability.

    • Choose Optimize for consistency if there are 16 or fewer namespace servers hosting the namespace.

    • Choose Optimize for scalability if there are more than 16 namespace servers. This reduces the load on the Primary Domain Controller (PDC) Emulator, but increases the time it requires for changes to the namespace to replicate to all namespace servers. Until changes replicate to all servers, users might have an inconsistent view of the namespace.

    Note

    Namespace servers running Windows 2000 Server continue to poll the PDC emulator every hour by default, even if you enable Optimize for scalability on the namespace.

Additional references

  • Tuning DFS Namespaces

  • Delegate Management Permissions for DFS Namespaces


Using Inherited Permissions with Access-Based Enumeration

By default, the permissions used for a DFS folder are inherited from the local file system of the namespace server. The permissions are inherited from the root directory of the system drive and grant the DOMAIN\Users group Read permissions. As a result, even after enabling access-based enumeration, all folders in the namespace remain visible to all domain users.

Advantages and limitations of inherited permissions

There are two primary benefits to using inherited permissions to control which users can view folders in a DFS namespace:

  • You can quickly apply inherited permissions to many folders without having to use scripts.

  • You can apply inherited permissions to namespace roots and folders without targets.

Despite the benefits, inherited permissions in DFS Namespaces have many limitations that make them inappropriate for most environments:

  • Modifications to inherited permissions are not replicated to other namespace servers. Therefore, use inherited permissions only on stand-alone namespaces or in environments where you can implement a third-party replication system to keep the Access Control Lists (ACLs) on all namespace servers synchronized.

  • DFS Management and Dfsutil cannot view or modify inherited permissions. Therefore, you must use Windows Explorer or the Icacls command in addition to DFS Management or Dfsutil to manage the namespace.

  • When using inherited permissions, you cannot modify the permissions of a folder with targets except by using the Dfsutil command. DFS Namespaces automatically removes permissions from folders with targets set using other tools or methods.

  • If you set permissions on a folder with targets while you are using inherited permissions, the ACL that you set on the folder with targets combines with inherited permissions from the folder’s parent in the file system. You must examine both sets of permissions to determine what the net permissions are.

Tip

When using inherited permissions, it is simplest to set permissions on namespace roots and folders without targets. Then use inherited permissions on folders with targets so that they inherit all permissions from their parents.

Using inherited permissions

To limit which users can view a DFS folder, you must perform one of the following tasks:

  • Set explicit permissions for the folder, disabling inheritance. To set explicit permissions on a folder with targets (a link) using DFS Management or the Dfsutil command, see Enable Access-Based Enumeration on a Namespace.

  • Modify inherited permissions on the parent in the local file system. To modify the permissions inherited by a folder with targets, if you have already set explicit permissions on the folder, switch to inherited permissions from explicit permissions, as discussed in the following procedure. Then use Windows Explorer or the Icacls command to modify the permissions of the folder from which the folder with targets inherits its permissions, as described on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=140259).

Note

Access-based enumeration does not prevent users from obtaining a referral to a folder target if they already know the DFS path of the folder with targets. Permissions set using Windows Explorer or the Icacls command on namespace roots or folders without targets control whether users can access the DFS folder or namespace root. However, they do not prevent users from directly accessing a folder with targets. Only the share permissions or the NTFS file system permissions of the shared folder itself can prevent users from accessing folder targets.

To switch from explicit permissions to inherited permissions

  1. In the console tree, under the Namespaces node, locate the folder with targets for which you want to control visibility, right-click the folder and then click Properties.

  2. Click the Advanced tab.

  3. Click Use inherited permissions from the local file system and then click OK in the Confirm Use of Inherited Permissions dialog box.

    Doing this removes all explicitly set permissions on this folder, restoring inherited NTFS permissions from the local file system of the namespace server.

  4. To change the inherited permissions for folders or namespace roots in a DFS namespace, use Windows Explorer or the ICacls command, as described on the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=140259).

To change the way permissions are applied by using a command prompt, or to restore inheritance of NTFS permissions from the local file system and preserve permissions that were set by using DFS Management, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=140259).

Additional references

  • Create a DFS Namespace


Replication

DFS Replication is a multiple-master replication engine that can replicate data between multiple servers over limited-bandwidth network connections. The following topics provide information about using DFS Replication:

  • Overview of DFS Replication

  • FRS Overview

  • Checklist: Deploy DFS Replication

  • Checklist: Manage DFS Replication

  • Deploying DFS Replication

  • Managing DFS Replication

  • Troubleshooting DFS Replication

Note

Most tasks require you to be a member of the Domain Admins group in Active Directory Domain Services (AD DS), unless you have been delegated the ability to manage DFS Replication. To manage a remote server, you might also need to be a member of local Administrators group on the server that you want to manage. If you are the creator of the replication group, you can perform most procedures related to that replication group. For more information, see Delegate the Ability to Manage DFS Replication

Additional references

  • SYSVOL Replication Migration Guide: FRS to DFS Replication

    (http://go.microsoft.com/fwlink/?LinkId=139749)


Overview of DFS Replication

DFS Replication is an efficient, multiple-master replication engine that you can use to keep folders synchronized between servers across limited bandwidth network connections. It replaces the File Replication Service (FRS) as the replication engine for DFS Namespaces, as well as for replicating the Active Directory Domain Services (AD DS) SYSVOL folder in domains that use the Windows Server 2008 domain functional level. For more information about replicating SYSVOL using DFS Replication, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=139749).

DFS Replication uses a compression algorithm known as remote differential compression (RDC). RDC detects changes to the data in a file and enables DFS Replication to replicate only the changed file blocks instead of the entire file.

To use DFS Replication, you must create replication groups and add replicated folders to the groups. Replication groups, replicated folders, and members are illustrated in the following figure.

DFS Replication Groups and Folders

This figure shows that a replication group is a set of servers, known as members, which participates in the replication of one or more replicated folders. A replicated folder is a folder that stays synchronized on each member. In the figure, there are two replicated folders: Projects and Proposals. As the data changes in each replicated folder, the changes are replicated across connections between the members of the replication group. The connections between all members form the replication topology.

Creating multiple replicated folders in a single replication group simplifies the process of deploying replicated folders because the topology, schedule, and bandwidth throttling for the replication group are applied to each replicated folder. To deploy additional replicated folders, you can use Dfsradmin.exe or follow the instructions in a wizard to define the local path and permissions for the new replicated folder.

Each replicated folder has unique settings, such as file and subfolder filters, so that you can filter out different files and subfolders for each replicated folder.

The replicated folders stored on each member can be located on different volumes in the member, and the replicated folders do not need to be shared folders or part of a namespace. However, the DFS Management snap-in makes it easy to share replicated folders and optionally publish them in an existing namespace.

You can administer DFS Replication by using DFS Management, the DfsrAdmin and Dfsrdiag commands, or scripts that call WMI.

Additional references

  • Replication

  • DFS Management


FRS Overview

File Replication Service (FRS) is a technology that was originally introduced on Windows 2000 Server to replicate Distributed File System (DFS) folders and the SYSVOL folder on domain controllers. FRS has been replaced in Windows Server 2008 R2 by DFS Replication for replicating DFS folders and for replicating the SYSVOL folder.

To manage a Distributed File System namespace that uses FRS to replicate content, open the Distributed File System snap-in on a computer running Windows Server 2003 or Windows 2000 Server.

Important

In Windows Server 2008 R2, FRS can be used only to replicate the SYSVOL folder on domain controllers in domains that use the Windows Server 2003 or Windows 2000 domain functional levels. All other replication tasks that were performed by FRS are now performed by DFS Replication. FRS replicas are disabled on servers that have been upgraded to Windows Server 2008 R2. For more information, see the Microsoft Web site (http://go.microsoft.com/fwlink/?LinkId=140224 ).

Additional references

  • SYSVOL Replication Migration Guide: FRS to DFS Replication

    (http://go.microsoft.com/fwlink/?LinkId=139749)

  • FRS Technical Reference

    (http://go.microsoft.com/fwlink/?LinkID=27595)

  • Replication


Checklist: Deploy DFS Replication

To collect data for backup or other purposes, use the New Replication Group Wizard to set up a replication group for data collection. This option sets up a two-way replication between two servers, such as a branch server and a hub server. Administrators at the hub office can use backup software to back up the branch server’s data from a hub server. This eliminates the error-prone process of having end users perform the backups at branch offices that are not staffed by trained information technology (IT) personnel.

Important

The data collection topology allows data to replicate from the hub server to the branch server. If you do not want changes made at the hub server to replicate to the branch server, make the replicated folder read-only on the hub server.

Use the following tasks to deploy DFS Replication for data collection or other purposes:

Task | Reference
Review DFS Replication concepts. | Overview of DFS Replication
Review the requirements for DFS Replication. | Review Requirements for DFS Replication
Install the newest version of DFS Management. | Installing DFS
Create a replication group. | Create a Replication Group
Add replicated folders to the replication group. | Add a Replicated Folder to a Replication Group
Add member servers to the replication group. | Add a Member to a Replication Group
Add a failover cluster as a member of a replication group. | Add a Failover Cluster to a Replication Group
Make a replicated folder read-only. | Make a Replicated Folder Read-Only on a Particular Member
Create a connection between member servers. | Create a Connection
Delegate the ability to manage DFS Replication. | Delegate the Ability to Manage DFS Replication
Important

To view or manage replication groups that contain read-only replicated folders or members that are failover clusters, you must use the version of DFS Management that is included with Windows Server 2008 R2.

Additional references

  • Share or Publish a Replicated Folder


Checklist: Manage DFS Replication

To manage DFS Replication, perform the following tasks:

Task | Reference
Edit replication schedules or manually force replication. | Edit Replication Schedules and Bandwidth
Enable or disable replication. | Enable or Disable Replication
Enable or disable replication on a specific member of a replication group. | Enable or Disable Replication on a Specific Member
Change the size of staging folders or Conflict and Deleted folders. | Edit the Quota Size of the Staging Folder and Conflict and Deleted Folder
Control what file types are replicated. | Edit the Replication Filters for a Replicated Folder
Share a replicated folder on a network or add the folder to a DFS namespace. | Share or Publish a Replicated Folder
Change the topology of a replication group. | Change the Replication Topology
Note

To view or manage replication groups that contain read-only replicated folders or members that are failover clusters, you must use the version of DFS Management that is included with Windows Server 2008 R2.


Deploying DFS Replication

The following topics present information about deploying DFS Replication:

  • Review Requirements for DFS Replication

  • Create a Replication Group

  • Add a Replicated Folder to a Replication Group

  • Add a Member to a Replication Group

  • Add a Failover Cluster to a Replication Group

  • Make a Replicated Folder Read-Only on a Particular Member

  • Create a Connection

  • Delegate the Ability to Manage DFS Replication


Review Requirements for DFS Replication

Before you can deploy DFS Replication, you must configure your servers as follows:

  • Extend (or update) the Active Directory Domain Services (AD DS) schema to include Windows Server 2003 R2, Windows Server 2008, or Windows Server 2008 R2 schema additions. To use read-only replicated folders, the schema must include the Windows Server 2008 or newer schema additions. For information about extending the AD DS schema, see the Microsoft Web site at (http://go.microsoft.com/fwlink/?LinkId=93051).

  • Ensure that all servers in a replication group are located in the same forest. You cannot enable replication across servers in different forests.

  • Verify that all members of the replication group are running Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 R2. DFS Replication is supported on all x64 editions of Windows Server 2008 R2 and all x64 and x86 editions of Windows Server 2008. DFS Replication is not available for Itanium-Based Systems.

  • Install DFS Replication on all servers that will act as members of a replication group.

  • Install the DFS Management snap-in on a server to manage replication. This server cannot run a Server Core installation of the Windows Server 2008 operating system.

  • Contact your antivirus software vendor to check that your antivirus software is compatible with DFS Replication.

  • Store replicated folders on NTFS volumes.

  • To include a failover cluster in a replication group, the failover cluster must be running Windows Server 2008 R2. Install and configure the failover cluster feature and then use the High Availability Wizard to create a clustered File Server instance before adding the instance as a replication group member. For more information, see Add a Failover Cluster to a Replication Group.

    On a server that is running a version of Windows older than Windows Server 2008 R2, locate replicated folders for failover clusters in the local storage of a node. Versions of the DFS Replication service older than Windows Server 2008 R2 are not designed to coordinate with cluster components, and the service will not fail over to another node.

Additional references

  • Deploying DFS Replication

  • DFS Management

  • Installing DFS

  • Add a Failover Cluster to a Replication Group


Create a Replication Group

Follow this procedure to create a replication group.

To create a replication group

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, right-click the Replication node, and then click New Replication Group.

  3. Follow the instructions in the New Replication Group Wizard.

    Before making a member of a replication group read-only, review the Performance Considerations section of Make a Replicated Folder Read-Only on a Particular Member.

    To include a failover cluster in a replication group, see Add a Failover Cluster to a Replication Group.

What happens during the initial replication

When you first set up replication, you must choose a primary member. Choose the member that has the most up-to-date files that you want to replicate to all other members of the replication group, because the primary member's content is considered "authoritative" during initial replication. This means that during initial replication, the primary member's files will always win the conflict resolution that occurs when the receiving members have files that are older or newer than the associated files on the primary member.

The following concepts will help you better understand the initial replication process:

  • Initial replication does not begin immediately. Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

  • Initial replication always occurs between the primary member and the receiving replication partners of the primary member. After a member has received all files from the primary member and completed building its database, initial replication is complete. The member will then replicate out any local files not already on the primary member. In this way, replication for a new replicated folder starts from the primary member and then progresses to the other members of the replication group.

  • When receiving files from the primary member during initial replication, if a receiving member contains files that are not present on the primary member, those files are moved to their respective DfsrPrivate\PreExisting folder. If a file is identical to a file on the primary member, the file is not replicated. If the version of a file on the receiving member is different from the primary member’s version, the receiving member's version is moved to the Conflict and Deleted folder and remote differential compression (RDC) can be used to download only the changed blocks. To avoid conflicts, do not make changes to files in the replicated folder on non-primary members until initial replication completes.

  • To determine whether files are identical on the primary member and receiving member, DFS Replication compares the files by using a hash algorithm. If the files are identical, only minimal metadata is transferred.

  • After the initialization of the replicated folder, when all existing files in the replicated folder are added to the DFS Replication database, the primary member designation is removed. That member is then treated like any other member and its files are no longer considered authoritative over other members that have completed initial replication. Any member that has completed initial replication is considered authoritative over members that have not completed initial replication.

Additional references

  • Deploying DFS Replication

  • Create a Diagnostic Report for DFS Replication

  • Delegate the Ability to Manage DFS Replication


Add a Replicated Folder to a Replication Group

Follow this procedure to create a replicated folder.

To create a replicated folder

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, right-click a replication group, and then click New Replicated Folders.

  3. Follow the instructions in the New Replicated Folders Wizard.
Note

Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

Additional references

  • Deploying DFS Replication

  • Create a Diagnostic Report for DFS Replication

  • Delegate the Ability to Manage DFS Replication


Add a Member to a Replication Group

Follow this procedure to add a member to a replication group.

To add a member to a replication group

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, right-click a replication group, and then click New Member.

  3. Follow the instructions in the New Member Wizard.

    Before making a member of a replication group read-only, review the Performance Considerations section of Make a Replicated Folder Read-Only on a Particular Member.

    To include a failover cluster in a replication group, see Add a Failover Cluster to a Replication Group.
Note

Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

Additional references

  • Deploying DFS Replication

  • Create a Diagnostic Report for DFS Replication

  • Delegate the Ability to Manage DFS Replication


Add a Failover Cluster to a Replication Group

DFS Replication in Windows Server 2008 R2 now includes the ability to add a failover cluster as a member of a replication group. To add a failover cluster as a member of a replication group, use the following procedure

Important

To include a failover cluster in a replication group, the failover cluster must be running Windows Server 2008 R2. To view or manage replication groups that contain read-only replicated folders or members that are failover clusters, you must use the version of DFS Management that is included with Windows Server 2008 R2.

Add a failover cluster to a replication group

  1. Install and configure the Failover Cluster feature. For additional information, see the Failover Cluster Manager Help.

  2. In the Failover Cluster Manager snap-in, if the cluster that you want to configure is not displayed, in the console tree, right-click Failover Cluster Manager, click Manage a Cluster, and then select or specify the cluster that you want.

  3. Click Services and Applications and then, under Actions (on the right), click Configure a Service or Application.

  4. Follow the instructions in the High Availability Wizard to specify the service or application that you want to configure for high availability, along with the following details:

    • On the Select Service or Application page of the High Availability Wizard, click File Server.

    • On the Client Access Point page of the High Availability Wizard, type the name for the clustered file server instance. This name will be registered in the Domain Name System (DNS) server and AD DS as the computer account for this clustered file server.

  5. In DFS Management, launch the New Replication Group Wizard or the New Member Wizard, and then type the name of the clustered file server instance that you want to add to the replication group. You must store the replicated folder and staging folder on shared storage.
Note

To move the replicated folder between nodes, create a shared folder for the replicated folder, or perform other cluster administration tasks, use the Failover Cluster Manager snap-in. DFS Management cannot directly perform these tasks on a failover-cluster.

Additional references

  • Deploying DFS Replication

  • DFS Management


Make a Replicated Folder Read-Only on a Particular Member

A read-only replicated folder is a replicated folder on a particular member in which users cannot add or change files. This is convenient for read-only folders that you want to keep up-to-date with a central server (or servers). For example, software installation folders, or folders that contain published reports or documents. Read-only replicated folders are also used by read-only domain controllers (RODCs) to keep the SYSVOL shared folder updated while preventing local changes.

Read-only replicated folders can be updated only with content from a read-write member of the replication group. All other attempts to write to the folder will fail. This includes performing an authoritative restore operation using a backup program.

Warning

When you make a replicated folder read-only, DFS Replication overwrites any content on the read-only member that has not yet replicated back to a read-write member. For this reason, it is a good idea to backup the folder, create a diagnostic report of replication and check the replication backlog before you make a replicated folder that contains existing content read-only.

Making a replicated folder read-only or writeable

  • Using the Windows interface

  • Using a command line
To make a replicated folder read-only or writeable by using the Windows interface

  1. Open DFS Management and then select the appropriate replication group in the console tree.

    Important

    To use read-only replicated folders, the schema must include the Windows Server 2008 or newer schema additions. To view or manage replication groups that contain read-only replicated folders or members that are failover clusters, you must use the version of DFS Management that is included with Windows Server 2008 R2.

  2. On the Memberships tab, right-click the appropriate replicated folder and member and then click Make read-only, or Make read-write.
To make a replicated folder read-only or writeable by using a command line

  • Open a command prompt window and then type the following command (to make a read-only folder writeable again, replace /RO:true with /RO:false):

    Dfsradmin membership set /RGName:<replication_group> /RFName:<replicated_folder> /MemName:<DOMAIN\Server>/RO:true

Performance Considerations

Read-only replicated folders can impact the performance of a file server when an existing folder is set to read-only, or if the replicated folder is stored on the same volume as the Windows operating system.

  • Changing the read-only or read-write status for a replicated folder causes DFS Replication to perform an initial replication and rebuild the DFS Replication database for the folder. On replicated folders that contain a large number of files, this can slow replication and consume system resources until the operation is complete.

  • Storing a read-only replicated folder on the same volume as the Windows installation will result in decreased performance for that volume. The performance decrease occurs primarily when loading the first mini-filter driver. If there are other mini-filter drivers installed, such as an antivirus program or backup program, the additional performance decrease of using a read-only replicated folder is small.

    The DFS Replication mini-filter driver intercepts all create and open (IRP_MJ_CREATE) operations for the volume on which the read-only replicated folder is located, and then inspects the destination to see if it is located in a read-only replicated folder. If the destination is in a read-only replicated folder, the driver fails the request to ensure that the folder remains read-only. Inspecting each create and open operation on a volume can impact performance if the read-only replicated folder is located on the system volume or any other volume for which there are frequent create or open requests to many different files.

Additional references

  • Deploying DFS Replication

  • Create a Diagnostic Report for DFS Replication

  • IRP_MJ_CREATE

  • Overview of DFS Replication


Create a Connection

Follow this procedure to create a connection.

To create a connection

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, right-click the replication group that you want to create a new connection in, and then click New Connection.

  3. Specify the sending and receiving members, and specify the schedule to use for the connection. At this point, replication is one-way.

  4. Select Create a second connection in the opposite direction to create a second connection for two-way replication between the sending and receiving members. All members must have two-way connections.

    Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

    Warning

    Microsoft does not support one-way connections for DFS Replication. Creating a one-way replication connection can cause numerous issues including health check topology errors, staging issues, and issues with the DFS Replication database. To create a one-way connection, instead make the replicated folder on the appropriate member read-only.

Additional references

  • Deploying DFS Replication

  • Delegate the Ability to Manage DFS Replication

  • Make a Replicated Folder Read-Only on a Particular Member


Delegate the Ability to Manage DFS Replication

The following table describes the groups that can perform basic DFS Replication tasks by default and the method for delegating the ability to perform these tasks.

To view the delegation list for a replication group in the console tree, select the replication group, and then click the Delegation tab in the details pane.

Task Users or Groups that Can Perform this Task by Default Delegation Method

Create a replication group or enable DFS Replication on a folder that has folder targets.

Domain Admins group in the domain where the replication group will be created.

In the console tree, right-click the Replication node, and then click Delegate Management Permissions.

Administer a replication group.

Domain Admins group in the domain where the replication group is configured, or the creator of the replication group.

In the console tree, right-click the replication group, and then click Delegate Management Permissions.

Add a server to a replication group.

(The server to be added must be online, and the user must be delegated the ability to administer the replication group.)

If the server is a member server, the user must be a member of the local Administrators group of the server to add.

If the server is a domain controller, the user must be a member of the Domain Admins group in the domain where the server is located.

Add the user to local Administrators group of the member server to add, or add the user to the Domain Admins group of the domain controller to add.

If you plan to delegate the ability to create and administer replication groups, consider the following:

  • If you delegate to a user or group the ability to create replication groups, and you later remove the user or group from the delegation list, there is no change to the security settings on existing replication groups.

  • If you delegate to a user or group the ability to administer a specific replication group, and you later remove the user or group from the delegation list, there is no change to the security settings on existing configuration data. For example, if the user who is being removed had created a connection in the replication group, then the user would still have permissions to edit that connection because the user is the owner of the AD DS object that contains the configuration information for the connection.

Additional references

  • Advanced Delegation of DFS Replication Permissions

    (http://go.microsoft.com/fwlink/?LinkId=140355)

  • Deploying DFS Replication


Managing DFS Replication

The following topics provide information about managing DFS Replication:

  • Edit Replication Schedules and Bandwidth

  • Enable or Disable Replication

  • Enable or Disable Replication on a Specific Member

  • Edit the Quota Size of the Staging Folder and Conflict and Deleted Folder

  • Edit the Replication Filters for a Replicated Folder

  • Share or Publish a Replicated Folder

  • Change the Replication Topology


Edit Replication Schedules and Bandwidth

To edit the replication schedule or bandwidth for a replication group or connection, or to force replication with a specific member of a replication group, use the following procedures.

To edit the replication schedule and bandwidth

  • To edit the schedule and bandwidth for a replication group, use the following steps:

    1. In the console tree under the Replication node, right-click the replication group with the schedule that you want to edit, and then click Edit Replication Group Schedule.

    2. Use the Edit Schedule dialog box to control when replication occurs, as well as the maximum amount of bandwidth replication can consume.

  • To edit the schedule and bandwidth for a specific connection, use the following steps:

    1. In the console tree under the Replication node, select the appropriate replication group.

    2. Click the Connections tab, right-click the connection that you want to edit, and then click Properties.

    3. Click the Schedule tab, select Custom connection schedule and then click Edit Schedule.

    4. Use the Edit Schedule dialog box to control when replication occurs, as well as the maximum amount of bandwidth replication can consume.
Note

Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

To force replication immediately

  1. In the console tree, under the Replication node, select the appropriate replication group.

  2. Click the Connections tab.

  3. Right-click the member you want to use to replicate, and then click Replicate Now.

Additional references

  • Managing DFS Replication

  • Delegate the Ability to Manage DFS Replication


Enable or Disable Replication

Follow this procedure to enable or disable replication.

To enable or disable replication for a specific connection

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, click the replication group that contains the connection you want to edit.

  3. In the details pane, click the Connections tab.

  4. Do one of the following:

    • To disable a connection, right-click the connection, and then click Disable.

    • To enable a connection, right-click the connection, and then click Enable.

Additional considerations

  • Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

  • Microsoft does not support one-way connections for DFS Replication. Creating a one-way replication connection can cause numerous issues including health check topology errors, staging issues, and issues with the DFS Replication database. To create a one-way connection, instead make the replicated folder on the appropriate member read-only.

Additional references

  • Managing DFS Replication

  • Delegate the Ability to Manage DFS Replication

  • Make a Replicated Folder Read-Only on a Particular Member


Enable or Disable Replication on a Specific Member

You can enable or disable replication with specific members of a replication group. However, it is important to understand the ramifications of doing so. After a disabled member is enabled, the member must complete an initial replication of the replicated folder. Initial replication will cause about 1 KB of data to be transferred for each file or folder in the replicated folder, and any updated or new files present on the member will be moved to the DfsrPrivate\PreExisting folder on the member, and it will be replaced with authoritative files from another member.

If all members are disabled for a replicated folder, then the first member that is enabled will automatically be made the primary member. If the discretionary access control list (DACL) on the local path for this member contains any inherited access-control entries (ACE), these ACEs will be converted to explicit ACEs with the same permissions so that all members will have the same DACL on the replicated folder root.

Follow this procedure to enable or disable replicating a replicated folder to a specific member.

To enable or disable replicating a replicated folder to a specific member

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, click the replication group that contains the membership you want to enable or disable.

  3. In the details pane, click the Memberships tab.

  4. Select the replicated folder on the specific member, and then do one of the following:

    • To disable the replicated folder on the member, right-click the replicated folder, and then click Disable.

    • To enable the replicated folder on the member, right-click the replicated folder, and then click Enable.
Note

Membership changes are not applied immediately. The membership changes must be replicated to all domain controllers, and the member must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the short polling interval (5 minutes) on the member.

Additional references

  • Managing DFS Replication

  • Delegate the Ability to Manage DFS Replication

  • Create a Replication Group


Edit the Quota Size of the Staging Folder and Conflict and Deleted Folder

DFS Replication uses staging folders for each replicated folder to act as caches for new and changed files that are ready to be replicated from sending members to receiving members. These files are stored under the local path of the replicated folder in the DfsrPrivate\Staging folder.

When a file is modified on two or more members before the changes can be replicated, the most recently updated file "wins" the conflict and DFS Replication moves the "losing" file or files to the Conflict and Deleted folder. The losing file or files are stored in the DfsrPrivate\ConflictandDeleted folder under the local path of the replicated folder on the member that resolves the conflict. The Conflict and Deleted folder is also used to store files that are deleted from replicated folders.

By default, the quota size of each staging folder is 4,096 MB, and the quota size of each Conflict and Deleted folder is 660 MB. The size of each folder on a member is cumulative per volume, so if there are multiple replicated folders on a member, DFS Replication creates multiple staging and Conflict and Deleted folders, each with its own quota.

The following subsections provide information about how to edit the quota of the staging folder and Conflict and Deleted folder and how to optimize the size of staging folders.

Note

The files in the Conflict and Deleted folder are renamed and are accessible only by members of the local Administrators group. The access control lists (ACLs) on the conflict files are preserved to help ensure security. You can view a log of conflict files and their original file names by viewing the ConflictandDeletedManifest.xml file in the DfsrPrivate folder.

Edit the quota size or location of the staging folder and Conflict and Deleted folder

You can edit the quota of the staging folder and Conflict and Deleted folder on a per-replicated folder, per-member basis. You can also change the location of the staging folder.

To edit the quota size or location of the staging folder and Conflict and Deleted folder

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, click the replication group that contains the replicated folder with the quotas that you want to edit.

  3. In the details pane, on the Memberships tab, right-click the replicated folder on the member with the quota that you want to edit, and then click Properties.

  4. On the Staging tab, adjust the staging folder quota and path as necessary.

  5. On the Advanced tab, adjust the Confict and Deleted folder quota as necessary.
Note

Changes are not applied immediately. The updates must be replicated to all domain controllers, and the member must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the short polling interval (5 minutes) on the member.

Optimize the size of staging folders

Although you can adjust the size of each staging folder, you must take the following factors into account while doing so:

  • Increase the staging folder quota when you must replicate multiple large files that change frequently.

  • If possible, increase the staging folder quota on hub members that have many replication partners.

  • If a staging folder quota is configured to be too small, DFS Replication might consume additional CPU and disk resources to regenerate the staged files. Replication might also slow down because the lack of staging space can effectively limit the number of concurrent transfers with partners.

  • For the initial replication of existing data on the primary member, it is important that you size the staging folder quota large enough so that if multiple large files are blocked in staging due to partners not being able to download the files, the remaining files can continue replicating. To properly size the staging folder for initial replication, you must take into account the size of the files to be replicated. At a minimum, the staging folder quota should be twice the size of the largest file in the replicated folder. For increased performance, the staging folder quota should be increased to the size of the four largest files in the replicated folder on spoke members and to the size of the sixteen largest files in the replicated folder on hub members.

  • If free disk space is a concern, you might need to configure the staging quota to be lower than the default quota when several replicated folders share staging space on the same volume.

  • During normal operation, if the event that indicates the staging quota (event ID 4208 in the DFS Replication event log) is over its configured size and is logged multiple times in an hour, increase the staging quota by 20 percent.

  • To improve input/output (I/O) throughput, locate staging folders and replicated folders on different physical disks. This can be done by editing the path of the staging folder.

Note

The staging quota for DFS Replication is not a hard limit, and it can grow over its configured size, unlike the staging quota for FRS. When the quota is reached, DFS Replication deletes old files from the staging folder to reduce the disk usage under the quota. The staging folder does not reserve hard disk space, and it only consumes as much disk space as is currently needed.

Additional references

  • Managing DFS Replication

  • Delegate the Ability to Manage DFS Replication


Edit the Replication Filters for a Replicated Folder

You can configure file and subfolder filters to prevent files and subfolders from replicating. Both types of filters are set on a per-replicated folder basis. You exclude subfolders by specifying their name or by using the asterisk (*) wildcard character. You exclude files by specifying their name or by using the asterisk (*) wildcard character to specify file names and extensions.

By default, no subfolders are excluded. The default file filters exclude the following files from replication:

  • File names starting with a tilde (~) character

  • Files with .bak or .tmp extensions

Regardless of which filters are set, the following types of files are always excluded from replication:

  • NTFS volume mount points

  • Files that are encrypted by using the encrypting file system (EFS)

  • Any reparse points except those associated with DFS Namespaces

    (If a file has a reparse point that is used for Hierarchical Storage Management (HSM) or Single Instance Store (SIS), DFS Replication replicates the underlying file but not the reparse point.)

  • Files on which the temporary attribute has been set

To edit the replication filters for a replicated folder

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, click the replication group that contains the replicated folder with the filters that you want to edit.

  3. In the details pane, on the Replicated Folders tab, right-click a replicated folder, and then click Properties.

  4. On the General tab, edit the existing filters or add new filters, paying attention to the following restrictions:

    • You cannot create file or subfolder filters by specifying a full path, such as C:\Replicatedfolder\Temp or C:\Replicatedfolder\file.dat.

    • You cannot use a comma in a filter because commas are used as delimiters.

After a member detects a new filter, the member scans its database and removes the file records of files that match the filter. Because the files are no longer listed in the database, future changes to the files are ignored.

After a member detects that a filter has been removed, the member scans the file system, adds records for all files that match the removed filter, and replicates the files.

Note

Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

Additional references

  • Managing DFS Replication

  • Delegate the Ability to Manage DFS Replication


Share or Publish a Replicated Folder

To enable file sharing on a replicated folder and optionally add the folder to a DFS namespace, use the following procedures:

To share a replicated folder without publishing the folder to a DFS namespace

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, click the replication group that contains the replicated folder you want to share.

  3. In the details pane, on the Replicated Folders tab, right-click the replicated folder that you want to share, and then click Share and Publish in Namespace.

  4. In the Share and Publish Replicated Folder Wizard, click Share the replicated folder, and then follow the steps in the wizard.
To share a replicated folder and publish it to a DFS namespace

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, click the replication group that contains the replicated folder you want to share.

  3. In the details pane, on the Replicated Folders tab, right-click the replicated folder that you want to share, and then click Share and Publish in Namespace.

  4. In the Share and Publish Replicated Folder Wizard, click Share and publish the replicated folder in a namespace, and then follow the steps in the wizard.

Additional considerations

  • To perform this procedure, you must meet the security requirements for managing DFS Replication and namespaces. If folders will be shared as part of the Share and Publish Replicated Folder Wizard, you must also be a member of the local Administrators group on the servers where each folder is shared.

  • If you do not have an existing namespace, you can create one in the Namespace Path page in the Share and Publish Replicated Folder Wizard. To create the namespace, in the Namespace Path page, click Browse, and then click New Namespace.

Additional references

  • Managing DFS Replication

  • Namespaces


Change the Replication Topology

The replication topology consists of the logical connections that DFS Replication uses to replicate files among servers. When choosing a topology, keep in mind that two one-way connections are created between the members you choose. These two connections allow data to flow in both directions.

To create a replication topology

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, right-click the replication group to create a new topology for, and then click New Topology.

  3. Follow the instructions in the New Topology Wizard to choose one of the following topologies:

    • Hub and spoke. This topology requires three or more members. For each spoke member, choose a required hub member and an optional second hub member for redundancy. This optional hub ensures that a spoke member can still replicate if one of the hub members is unavailable. If you specify two hub members, the hub members will have a full-mesh topology between them.

    • Full mesh. In this topology, every member replicates with all other members of the replication group. This topology works well when there are ten or fewer members in the replication group.

Note

Configuration changes are not applied immediately to all members. The new configuration must be replicated to all domain controllers, and each member in the replication group must poll its closest domain controller to obtain the changes. The amount of time this takes depends on AD DS replication latency and the long polling interval (60 minutes) on each member. To poll immediately for configuration changes, open a command prompt window and then type the following command once for each member of the replication group: dfsrdiag.exe PollAD /Member:DOMAIN\Server1.

Additional references

  • Managing DFS Replication

  • Delegate the Ability to Manage DFS Replication


Troubleshooting DFS Replication

The following topics present information about troubleshooting DFS Replication:

  • Create a Diagnostic Report for DFS Replication

  • Repair a Disconnected Topology

Additional references

  • Resources for DFS Management

  • The Troubleshooting section of the Windows Server 2008 Technical Library (http://go.microsoft.com/fwlink/?LinkID=83365)

  • The Distributed File Systems and File Replication Service discussion group (http://go.microsoft.com/fwlink/?LinkId=93050)

  • The Windows Server 2008 File Services and Storage TechNet forum (http://go.microsoft.com/fwlink/?LinkID=93045)


Create a Diagnostic Report for DFS Replication

DFS Management in Windows Server 2008 includes the ability to run a propagation test and generate two types of diagnostic reports—a propagation report and a general health report:

  • Propagation test Tests replication progress by creating a test file in a replicated folder.

  • Propagation report Generates a report that tracks the replication progress for the test file created during a propagation test.

  • Health report Generates a report that shows the health of replication and replication efficiency.

Follow this procedure to create a diagnostic report for DFS replication.

To create a diagnostic report for DFS replication

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, right-click the replication group that you want to create a diagnostic report for, and then click Create Diagnostic Report.

  3. Follow the instructions in the Diagnostic Report Wizard.

Additional considerations

  • To create a diagnostic report, you must be a member of the local Administrators group on each server that you prepare a report for.

  • The amount of time necessary to generate a diagnostic report will vary based on a number of factors, including: DFS Replication health; the number of replicated folders; available server resources (for example, CPU and memory); WAN availability (connectivity, bandwidth, and latency); and the chosen reporting options. Because of the potential delay in creating diagnostic reports, we recommend creating diagnostic reports for no more than 50 servers at a time.

Additional references

  • Troubleshooting DFS Replication


Repair a Disconnected Topology

Follow this procedure to repair a disconnected topology.

To repair a disconnected topology

  1. Click Start, point to Administrative Tools, and then click DFS Management.

  2. In the console tree, under the Replication node, click the replication group that contains the disconnected topology.

  3. In the results pane, on the Connections tab, click the error message at the top of the tab to open the Disconnected Topology dialog box.

  4. To view disconnected members, select a replicated folder from the Replicated folder list, and then expand the Disconnected Members.

  5. Click Close.

  6. Repair the topology by performing any of the following procedures, as appropriate:

    • Create a Connection

    • Edit Replication Schedules and Bandwidth

    • Enable or Disable Replication

    • Enable or Disable Replication on a Specific Member

    Tip

    In some instances you might have to remove disconnected members and then add them back to the replication group to repair a disconnected topology.

Additional references

  • Create a Diagnostic Report for DFS Replication

  • Troubleshooting DFS Replication

  • Delegate the Ability to Manage DFS Replication


Resources for DFS Management

For more information about Distributed File System and DFS Management, see the following resources on the Microsoft Web site:

  • The File Services section of the Windows Server 2008 Technical Library

    (http://go.microsoft.com/fwlink/?LinkID=85622)

  • The Troubleshooting section of the Windows Server 2008 Technical Library

    (http://go.microsoft.com/fwlink/?LinkID=83365)

  • The Windows Server 2008 File Services and Storage TechNet forum

    (http://go.microsoft.com/fwlink/?LinkId=93045)

  • What's New in Distributed File System in Windows Server 2008 R2

    (http://go.microsoft.com/fwlink/?LinkId=139569)

  • DFS Replication Frequently Asked Questions

    (http://go.microsoft.com/fwlink/?LinkId=140270)

  • SYSVOL Replication Migration Guide: FRS to DFS Replication

    (http://go.microsoft.com/fwlink/?LinkId=139749)

  • Current Hotfixes for Distributed File System (DFS) technologies in Windows Server 2008 and Windows Server 2008 R2

    (http://go.microsoft.com/fwlink/?LinkId=140177)

  • The Storage Team at Microsoft Filecab blog

    (http://go.microsoft.com/fwlink/?LinkId=139751)

  • Ask the Directory Services Team blog

    (http://go.microsoft.com/fwlink/?LinkId=139752)

  • Administering DFS from a command prompt

    (http://go.microsoft.com/fwlink/?LinkID=92840)