docs/Workflows/Windows/Windows Server/Roles/DFS/Creating and Configuring DFS Namespaces with Replication.md

Purpose

If you want data available from a single, consistent UNC path while hosting it on multiple file servers, use DFS Namespaces (DFSN). A namespace presents a virtual folder tree (for example, \\bunny-lab.io\Projects) whose folders point to one or more folder targets (actual SMB shares on your servers). DFS Replication (DFSR) is a separate feature you configure to keep the contents of those targets in sync.

This document walks through creating a domain-based DFS namespace and enabling DFS Replication for two servers.

!!! info "Assumptions" You have two Windows Server machines (e.g., LAB-FPS-01 and LAB-FPS-02) running an edition that supports DFS (Standard or Datacenter), both activated, domain-joined, and using static IPs.

Installing Server Roles

Install the roles on both servers:

• Server Manager → Manage → Add Roles and Features
• Click Next to Server Roles
• Expand File and Storage Services
  • Expand File and iSCSI Services
    • Check File Server
    • Check DFS Namespaces
    • Check DFS Replication
• Next → Next → Install, then finish.

Create & Configure Network Shares

Create (or identify) the folders you want to publish in the namespace, and share them on each server. Be sure to enable Access-based Enumeration on all of the folder shares for additional security. You only need to ensure that the folders exist on one of the servers, it will be created on-the-fly and replicated automatically.

Additionally, it is recommended (if possible) to set the share names to be hidden. For example \\LAB-FPS-01\Projects$, that way it ensures that users access the share via DFS at \\bunny-lab.io\Projects and users don't accidentally access the network shares directly, bypassing DFS. For example, the local path would be Z:\Projects but the network share would be \\LAB-FPS-01\Projects$. This wouldn't break things like replication, but it would muck things up a little bit organizationally.

!!! warning "What must match vs. what can differ" - Must exist on each server: a shared folder to act as the folder target (path can differ per server). - Share permissions: are not replicated; set them on each server. - NTFS permissions inside the replicated folder: are replicated by DFSR and should be consistent. - Targets do not have to use identical share names/paths, but keeping them consistent simplifies things.

Permission Type	User / Group	Access	Level**
Share	Everyone (or Authenticated Users)	Full Control	Best practice is to grant broad Full Control on the share and enforce access with NTFS.
NTFS	SYSTEM	Full Control	Required for DFSR service.
NTFS	Share_Admins	Full Control	Optional admin group for data management.
NTFS	Business groups needing access	Modify	Grant least privilege to required users/groups.

!!! info "Note On Inheritance" Disabling inheritance is not required for DFS/DFSR. Keep it enabled unless you have a clear reason to flatten ACLs; inheritance often reduces long-term admin overhead.

DFS Breakdown

A namespace is a logical view like \\bunny-lab.io\Projects. Inside it, you create DFS folders (e.g., Scripting) that point to one or more folder targets, such as:

• \\LAB-FPS-01\Projects$\Scripting
• \\LAB-FPS-02\Projects$\Scripting

The namespace root itself isn't where you store data; it's a directory of links. Place data in the folder targets the DFS folder points to.

DFS Configuration

You can run these steps from either server (or any admin workstation with the RSAT tools). DFSN configuration is stored in AD and on namespace servers and applies across members automatically.

Create Namespace

• Server Manager → Tools → DFS Management
• Right-click Namespaces → New Namespace...
  • Choose a server to host the namespace (e.g., LAB-FPS-01) → Next
  • Name the namespace (e.g., Projects) → Next
    • You can leave Edit Settings at defaults; those control the local folder that backs the namespace root, not your data.
  • Choose Domain-based namespace and check Enable Windows Server 2008 mode (required for larger scale and Access-based enumeration).
    • Resulting path: \\bunny-lab.io\Projects
  • Next → Create

Make Namespace Highly-Available

We have to perform an extra step to ensure that every file server can act as within a multi-master context, allowing for high availability. To do this in this example, we will add LAB-FPS-02 as a secondary namespace server for every namespace that we create.

• Right-Click DFS Management > Namespaces > \\bunny-lab.io\Projects
• Click Add Namespace Server...
• Under "Namespace Server" enter LAB-FPS-02 then click OK.

Enable Access-Based Enumeration on Namespace

• Right-Click DFS Management > Namespaces > \\bunny-lab.io\Projects
• Click Properties
• Click Advanced
• Check Enable access-based enumeration for this namespace
• Click OK

Link Folders to Namespace

Create the DFS folders and add folder targets:

• Right-click the new namespace (e.g., \\bunny-lab.io\Projects) → New Folder...
  • Name: Scripting
  • Add folder targets (one per server), e.g.:
    • \\LAB-FPS-01\Projects$\Scripting
    • \\LAB-FPS-02\Projects$\Scripting
      • You can simply copy-paste the previous server location and substitute the hostname (e.g. switching 01 to 02) instead of browsing for the folder.
        • You may be prompted to create the folder because it does not exist on LAB-FPS-02, in this circumstance, you can tell it to create the folder automatically with read-only permissions. Don't worry, when replication from LAB-FPS-01 occurs, NTFS permissions will be overwritten to the correct users and groups.
  • When prompted "Create a replication group to synchronize the folder targets?", click Yes to launch the DFS Replication wizard.

!!! info "Be patient" The Replication wizard can take ~1 minute to appear.

Configure Replication Group

In the Replication wizard that appears after about a minute, you can configure the replication group for the folder:

!!! bug "If Wizard did Not Appear (or Crashed)" In my homelab testing, I had two times when the wizard crashed or simply never opened. If this happens to you, you can manually re-trigger the wizard for the target folder by right-clicking the folder (e.g. \\bunny-lab.io\Projects\Scripting) and selecting Replicate Folder.

• Replication Group Name: (leave as suggested)
• Replicated Folder Name: (leave as suggested)
• Next → Next
• Primary member: pick the server with the most up-to-date copy of the data (e.g., LAB-FPS-01).

!!! abstract "Replication Behavior and Expectations" When you first create a replication group, DFSR needs a baseline copy of the data to start from. You designate one server as the Primary Member to serve as that baseline. (e.g. LAB-FPS-01) During the first sync, DFSR assumes that whatever exists on the primary member's folder is the "truth." So if the same file exists on another server (e.g. LAB-FPS-02) but with different timestamps, sizes, or hashes, the primary member's copy wins - but only during this first synchronization. After that initial sync is complete, the "primary" flag loses all authority. Replication becomes multi-master, meaning every member can make changes, and DFSR uses its conflict resolution algorithm (based on version vectors, update sequence numbers, and timestamps) to decide which change wins going forward. In other words, no server remains “the boss” after initialization. Files unique to other member servers that only exist on them will not be wiped and will be replicated across all member servers including the primary member.

• Topology: Full mesh (good for two servers; for many sites, consider hub-and-spoke).
• Replication schedule: leave Full (24x7) unless you need bandwidth windows.
• Create

!!! success "Replication group created" You should see green ticks for the following. Give everything some time to replicate as it depends on active directory replication speeds to push out the configuration across the DFS member servers and begin the replication.

- ✅Create replication group
- ✅Create members
- ✅Update folder security
- ✅Create replicated folder
- ✅Create membership objects
- ✅Update folder properties
- ✅Create connections

Checking DFS Status

You may want to put together a simple table report of the DFS namespaces, replication info, and target folders. You can run the following powershell script to generate a nice table-based report of the current structure of the DFS namespaces in your domain.

??? example "Powershell Reporting Script" ```powershell # Automatically detect current AD domain and use it as DFS prefix try { $Domain = ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).Name $DomainPrefix = "\$Domain" } catch { Write-Warning "Unable to detect domain automatically. Falling back to manual value." $DomainPrefix = "\bunny-lab.io" }

Import-Module DFSN -ErrorAction Stop
Import-Module DFSR -ErrorAction Stop

function Get-ServerNameFromPath {
  param([string]$Path)
  if ([string]::IsNullOrWhiteSpace($Path)) { return $null }
  if ($Path -like "\\*") { return ($Path -split '\\')[2] }
  return $null
}
function Get-Max3 {
  param([int[]]$Values)
  if (-not $Values) { return 0 }
  return (($Values | Measure-Object -Maximum).Maximum)
}

# Build: GroupName (lower) -> memberships[]
$allGroups = Get-DfsReplicationGroup -ErrorAction SilentlyContinue
$groupMembershipMap = @{}
foreach ($g in $allGroups) {
  $ms = Get-DfsrMembership -GroupName $g.GroupName -ErrorAction SilentlyContinue
  $groupMembershipMap[$g.GroupName.ToLower()] = $ms
}

# Flatten all memberships for regex fallback
$allMemberships = @()
foreach ($arr in $groupMembershipMap.Values) { if ($arr) { $allMemberships += $arr } }

$rows = New-Object System.Collections.Generic.List[psobject]

# Enumerate namespace roots
$roots = Get-DfsnRoot -ErrorAction Stop | Where-Object { $_.Path -like "$DomainPrefix\*" }

Write-Host "DFS Namespace and Replication Overview" -ForegroundColor Cyan
Write-Host "------------------------------------------------------`n"

foreach ($root in $roots) {

  $rootPath  = $root.Path
  $rootLeaf  = ($rootPath -split '\\')[-1]

  $nsServers = @()
  $rootTargets = Get-DfsnRootTarget -Path $rootPath -ErrorAction SilentlyContinue
  foreach ($rt in $rootTargets) {
    $srv = Get-ServerNameFromPath $rt.TargetPath
    if ($srv) { $nsServers += $srv }
  }

  # Folders under this root
  $folders = Get-DfsnFolder -Path "$rootPath\*" -ErrorAction SilentlyContinue | Sort-Object Path

  foreach ($f in $folders) {
    $namespaceFull = $f.Path
    $leaf          = ($f.Path -split '\\')[-1]

    # DFSN folder targets
    $targets = Get-DfsnFolderTarget -Path $f.Path -ErrorAction SilentlyContinue
    $targets = @($targets | Sort-Object { Get-ServerNameFromPath $_.TargetPath })  # ensure array

    # Map to DFSR group by naming; fallback to regex on ContentPath
    $candidateGroup = ((($rootPath -replace '^\\\\','') + '\' + $leaf).ToLower())
    if ($groupMembershipMap.ContainsKey($candidateGroup)) {
      $msForFolder = $groupMembershipMap[$candidateGroup]
    } else {
      $escapedRootLeaf = [regex]::Escape($rootLeaf)
      $escapedLeaf     = [regex]::Escape($leaf)
      $regex = "\\$escapedRootLeaf\\$escapedLeaf($|\\)"
      $msForFolder = $allMemberships | Where-Object { $_.ContentPath -imatch $regex }
    }
    $msForFolder = @($msForFolder) # normalize to array

    # Build aligned rows: one per target
    $targetLines = @()
    $replLines   = @()

    foreach ($t in $targets) {
      $tServer = Get-ServerNameFromPath $t.TargetPath
      $targetLines += $t.TargetPath

      $msForServer = $null
      if ($msForFolder.Count -gt 0) {
        $msForServer = $msForFolder | Where-Object { $_.ComputerName -ieq $tServer } | Select-Object -First 1
      }
      if ($msForServer -and $msForServer.ContentPath) { $replLines += $msForServer.ContentPath } else { $replLines += '' }
    }

    # Max line count for row expansion (PS 5.1 safe)
    $maxLines = Get-Max3 @($targetLines.Count, $replLines.Count, $nsServers.Count)

    for ($i = 0; $i -lt $maxLines; $i++) {

      # Precompute values (PS 5.1: no inline-if in hashtables)
      $nsVal = ''
      if ($i -eq 0) { $nsVal = $namespaceFull }

      $targetVal = ''
      if ($i -lt $targetLines.Count) { $targetVal = $targetLines[$i] }

      $replVal = ''
      if ($i -lt $replLines.Count) { $replVal = $replLines[$i] }

      $nsServerVal = ''
      if ($i -lt $nsServers.Count) { $nsServerVal = $nsServers[$i] }

      $row = [PSCustomObject]@{
        'Namespace'               = $nsVal
        'Member Folder Target(s)' = $targetVal
        'Replication Locations'   = $replVal
        'Namespace Servers'       = $nsServerVal
      }
      $rows.Add($row) | Out-Null
    }
  }
}

# Render as a PowerShell bordered grid with one-space left/right padding in every cell
function Write-DfsGrid {
  [CmdletBinding()]
  param(
    [Parameter(Mandatory)]
    [System.Collections.IEnumerable]$Data,

    [string[]]$Columns = @('Namespace','Member Folder Target(s)','Replication Locations','Namespace Servers'),

    # Reasonable max widths; tune to your console (these are content+padding widths)
    [int[]]$MaxWidths = @(70, 70, 52, 30),

    [switch]$Ascii  # use +-| instead of box-drawing if your console garbles Unicode
  )

  # Ensure arrays align
  if ($MaxWidths.Count -lt $Columns.Count) {
    $pad = New-Object System.Collections.Generic.List[int]
    $pad.AddRange($MaxWidths)
    for ($i=$MaxWidths.Count; $i -lt $Columns.Count; $i++) { $pad.Add(40) }
    $MaxWidths = $pad.ToArray()
  }

  # Characters
  if ($Ascii) {
    $H = @{ tl='+'; tr='+'; bl='+'; br='+'; hz='-'; vt='|'; tj='+'; mj='+'; bj='+' }
  } else {
    # Box-drawing
    $H = @{ tl='┌'; tr='┐'; bl='└'; br='┘'; hz='─'; vt='│'; tj='┬'; mj='┼'; bj='┴' }
    try { [Console]::OutputEncoding = [Text.UTF8Encoding]::UTF8 } catch {}
  }

  function TruncPad([string]$s, [int]$w) {
    if ($null -eq $s) { $s = '' }
    $s = $s -replace '\r','' -replace '\t',' '
    if ($s.Length -le $w) { return $s.PadRight($w, ' ') }
    if ($w -le 1) { return $s.Substring(0, $w) }
    return ($s.Substring(0, $w-1) + '…')
  }

  # Materialize and compute widths (include one-space left/right padding for header and data)
  $rows = @($Data | ForEach-Object {
    $o = @{}
    foreach ($c in $Columns) { $o[$c] = [string]($_.$c) }
    [pscustomobject]$o
  })

  $widths = @()
  for ($i=0; $i -lt $Columns.Count; $i++) {
    $col = $Columns[$i]
    # Start with header length including padding
    $max = (" " + $col + " ").Length
    foreach ($r in $rows) {
      $len = (" " + [string]$r.$col + " ").Length
      if ($len -gt $max) { $max = $len }
    }
    $widths += [Math]::Min($max, $MaxWidths[$i])
  }

  # Line builders
  function DrawTop() {
      $line = $H.tl
      for ($i = 0; $i -lt $widths.Count; $i++) {
          $line += ($H.hz * $widths[$i])
          if ($i -lt ($widths.Count - 1)) {
              $line += $H.tj
          } else {
              $line += $H.tr
          }
      }
      $line
  }
  function DrawMid([string[]]$Columns, [int[]]$widths, $H) {
    $line = $H.vt
    for ($i=0; $i -lt $widths.Count; $i++) {
      $line += TruncPad (" " + $Columns[$i] + " ") $widths[$i]
      $line += $H.vt
    }
    $line
  }
  function DrawSep() {
    $line = $H.vt
    for ($i=0; $i -lt $widths.Count; $i++) {
      $line += ($H.hz * $widths[$i])
      $line += $H.vt
    }
    $line
  }
  function DrawHeaderSep() {
    $line = $H.vt
    for ($i=0; $i -lt $widths.Count; $i++) {
      $line += ($H.hz * $widths[$i])
      $line += $H.vt
    }
    $line
  }
  function DrawBottom() {
      $line = $H.bl
      for ($i = 0; $i -lt $widths.Count; $i++) {
          $line += ($H.hz * $widths[$i])
          if ($i -lt ($widths.Count - 1)) {
              $line += $H.bj
          } else {
              $line += $H.br
          }
      }
      $line
  }
  function DrawRow($r, [string[]]$Columns, [int[]]$widths, $H) {
    $line = $H.vt
    for ($i=0; $i -lt $widths.Count; $i++) {
      $val = [string]$r.($Columns[$i])
      $line += TruncPad (" " + $val + " ") $widths[$i]
      $line += $H.vt
    }
    $line
  }

  # Render with group separators between namespaces (when the Namespace cell is non-empty)
  Write-Host (DrawTop)
  Write-Host (DrawMid -Columns $Columns -widths $widths -H $H)
  Write-Host (DrawHeaderSep)

  $first = $true
  foreach ($r in $rows) {
    if (-not $first -and ([string]$r.$($Columns[0])) ) {
      # Namespace changed → draw a separator
      Write-Host (DrawSep)
    }
    $first = $false
    Write-Host (DrawRow -r $r -Columns $Columns -widths $widths -H $H)
  }

  Write-Host (DrawBottom)
}

Write-DfsGrid -Data $rows
```