docs/Workflows/Windows/Windows Server/Roles/DFS/Setting Up DFS Across Multiple File Servers.md

Purpose

If you want to ensure that data is safely replicated across multiple file servers in a domain environment, you will want to set up DFS "namespaces". These are network shares that are distributed across multiple file servers, and appear as one network share. They replicate to eachother automatically, keeping both in sync with eachother. The document below outlines the process of deploying DFS across two (2) file servers.

!!! info "Assumptions" It is assumed that you have at least two Windows Server based servers already set-up, both are running the correct Editions of Windows Server (e.g. "Standard"), are activated, and are domain joined with sensible hostnames (e.g. LAB-FPS-01 and LAB-FPS-02), and that both have statically-assigned IP addresses.

Installing Server Roles

The first step you want to perform is installing the necessary roles on both servers.

• Navigate to "Server Manager > Manage > Add Roles and Features
• Click "Next" through the windows of the role wizard until you reach the "Server Roles" page
• Expand "File and Storage Services"
  • Expand "File and iSCSI Services"
    • Check "File Server"
    • Check "DFS Namespaces"
    • Check "DFS Replication"
• Click the "Next" button
• Click the "Next" button
• Click the "Install" button and wait for the installation to finish.

Create & Configure Network Shares

The next step in the process is to ensure that the network shares that will be shared via DFS have sane permissions. You will want to ensure the following minimum permissions are configured.

!!! warning "Replicate Folders and Permissions Across all File Servers" It is important for you to understand that every member server of the DFS namespaces and replication need to be configured identically, with the same shared folder structures. To clarify, you can have the underlying files in different locations on-disk, but they need to have the same permissions and paths on the network shares themselves under \\SERVER\<share$>

**NOTE**: The data for the shares only needs to exist on one server to ensure it can be replicated across to the other member servers of the DFS namespaces.  During DFS configuration, this server is designated as the "Primary Member". This server's folder contents are treated as authoritative for the initial sync and replicate to the other members of the DFS namespace.

Permission Type	User / Group	Access Level	Details
Share	Authenticated Users	Full Control	This is to ensure that only domain authenticated users can access the share.
NTFS	SYSTEM	Full Control	This is so DFS replication can properly function.
NTFS	Share_Admins	Full Control	This is a security group I created for admins to manage the data on network shares unilaterally.
NTFS	<Any Users / Groups That Need Access>	Modify	This is for anyone who needs access to these specific files / folders.

!!! info "Disable Permission Inheritance" It's just more organized to keep permission inheritance turned-off for the share, so parent folder permissions don't influence it, which could cause unexpected issues in the future if the parent's permissions were changed.

DFS Breakdown

At this point, we need to create a DFS "Namespace". This is basically a logical representation of either a single or a group of individual folders on one or more file servers. The files and folders appear under a singular location like \\bunny-lab.io\Projects\Scripting. In this example, Projects is the namespace (Its not a real folder with data), and Scripting is a folder replicated across one or more file servers, mapping to a real (generally hidden) network share like \\LAB-FPS-01\Projects$\Scripting. In this example, there is a network share located at Projects$ that (organizationally) correlates to the Projects DFS namespace, but you should not put files and folders in this root location, as it can cause issues or introduce potential corruption.

DFS Configuration

Now, we need to start working on actually setting up DFS now that the shares exist (and are configured identically) on all member servers. You can choose to do these steps on any of the member servers, but I recommend using the lowest number server (e.g. LAB-FPS-01). The configurations will be automatically replicated across to all member servers from the server you choose to configure, so in reality, it really doesn't matter which server you choose.

Create Namespace

• Navigate to "Server Manager > Tools > DFS Management"
• In the left-hand sidebar, right-click "Namespaces" > "New Namespace..."
  • Choose a member server (e.g. LAB-FPS-01) then click "Next"
  • Give a name to the namespace (e.g. Projects) then click "Next"
    • You do not need to click on the "Edit Settings" button. Just leave all of the settings as-is with All users have read-only permissions as this permission controls the namespace configuration data permissions in C:\DFSRoots\<Namespace>
  • Click "Next"
  • Ensure that the "Domain-based namespace" radio button is checked, and the "Enable Windows Server 2008 mode" is checked.
    • The domain-based namespace example should look something like this: \\bunny-lab.io\Projects
  • Click "Next"
• At this point, the namespace was created and you can move onto linking folders to the namespace to make their data appear inside of it and replicate to other member servers.

Link Folders to Namespace

At this point, we need to configure folders on every member server to be linked to the namespace we created. In this context, the "Folders" are the subfolders of the network share we want to share and replicate in DFS.

• Right-click the namespace we just created (e.g. \\bunny-lab.io\Projects)
• Click on "New Folder"
  • This is the point where we link subfolders to folders inside of the namespace. For example, if we have a folder located at \\LAB-FPS-01\Projects\Scripting, the folder name we create here would be named Scripting.
  • Under "Folder Targets" you will click on the "Add" button
    • Browse the "Path to folder target" and navigate to the equivalant location on all member servers, one entry per server:
      • \\LAB-FPS-01\Projects$\Scripting
      • \\LAB-FPS-02\Projects$\Scripting
    • Click the "OK" button
  • You will be prompted with "A replication group can be used to synchronize the folder targets of the folder you just created. Do you want to create a replication group?". You will click the "Yes" button and proceed to the next section.

!!! info "Be patient, it takes about a minute to load the replication group wizard"

Configure Replication Group

As mentioned in the previous section, you clicked "Yes" to the automatic replication group wizard and arrived at the replication wizard. Follow the steps below to finalize replication for the share.