Permission Hell

HCHTech

Well-Known Member
Reaction score
4,142
Location
Pittsburgh, PA - USA
I have a client that was running out of space on their server last year, and as a stop-gap measure, we created an archive directory on their Synology NAS (used as a backup target). There was plenty of space on the NAS, and after moving about 300Gigs of old files, the server had breathing room again. We're setting up the replacement server now, and I'm trying to copy those archive files BACK from the Synology to the new server. Robocopy will get some of the files, but 70% of them fail with "access denied" errors.

Removing the normal "/copy:DATSOU" flag I use from the robocopy script didn't help, and just playing around trying to drag files with the Windows explorer GUI basically tells me the permissions are scrambled in some fashion. If I right-click on one of the folders from Windows and choose properties, I see the "Read Only" box with a black square in it (rather than a check mark), and the security tab shows "Account Unknown (S-1-5-21-1831.....)" in the list of users. I can reset the owner to the administrator user on the server without error, but I still cannot copy the files. Disabling inheritance and manually changing the owner and effective access users from the Advanced security dialog similarly completes without error, but doesn't help the problem.

The Synology is formatted in their btrfs format, which may be the source of the whole problem, I don't know. I think I normally use EXT4 when setting up a Synology.

I have tried: changing the permissions on that folder from the Synology OS, I've tried taking ownership of that folder from the Server OS, I've tried creating the same user & password in Active Directory as the user/password combination on the Synology, I've tried mapping that folder to a drive letter then running "takeown /f z:\ a r d y". I've tried running "icacls "full path of folder or drive" /setowner "Administrators" /T /C", which, like the other things, completes without error, but I still cannot copy the files. There are a couple of hundred thousand files altogether, so whatever solution I use has to be scripted. There are too many random levels of subfolder and files here to do anything manually.

Suggestions welcome - is there anything I've forgotten?
 
Whenever file permissions get messy (like doing from a directory to a totally different directory)...I like to take an eraser to permissions.

So...grab an external USB drive...format it in FAT32. With FAT or FAT32....all NTFS permissions are dropped. FAT32 goes up to 2TB.
Use that as the middle man....plug into Synology...copy to it. Unplug...plug into server...copy from it.

Not sure if the Synology was joined to AD...which...should even things out too.
 
I believe the Synology will accept a USB drive as a local filesystem, and you could use that as FAT... and copy files from the NAS to the external, which in turn can be ingested to the server.
 
I've been thinking if there's another way around this, but the permission hell you're in involves two filesystems and a network protocol that's not the first language of the storage platform.

The only way remote to possibly do this that I can think of, is SSH into the Synology itself, and mount a remote share and push from the Linux side. But that's harder to do these days with Synology for a ton of really good reasons.
 
I can remember some 20+ years ago other techs being shocked that Linux ignored MS permissions for file/folder access.
It does... but it doesn't... with current versions of Samba. Not to mention the ability to read and write NTFS reliably, which was also not a thing until relatively recently.

Still, with BTRfs under the hood I'm at a loss as to how this poor Synology managed to get this mangled. If files go in, they should be able to come out. And they shouldn't have "permissions" on them anymore, other than the Unix ones at the filesystem level.
 
I can remember some 20+ years ago other techs being shocked that Linux ignored MS permissions for file/folder access.
Yes. I've use Linux many, many times in the past to copy stuff from SBS in small businesses
Home offices and micro businesses too, in fact anytime there were permission issues that couldn't be resolved.
Saved so much time.
 
The wild card here is that there were multiple people at the client's firm tasked with combing through their files and choosing which files to archive. Not to mention the office is a converted house with terrible power - we have UPSes on everything but still have to deal with manually restarting things on a regular basis. I think A + B here explains the cause of the problem.

I went onsite and mounted a new external formatted with FAT32 on the Synology then, copied all of those files to that drive. I'll have an employee move that drive to the server on Monday and see if I can get them back. I had a couple of >4GB files that I had to leave behind, but luckily, they were able to be copied directly to the server without issue.
 
Windows can handle exFAT, so you don't have that 4gb file limit.

Still, glad it seems to be progressing. That's a nightmare of hoops to navigate just to move some files around.
 
Still, glad it seems to be progressing. That's a nightmare of hoops to navigate just to move some files around.

Right? I wanted them to put an additional disk array in their server last year - would have only cost the price of two drives plus configuration, but of course that was denied. I would have never suggested the solution we took had I known what I was in for on the other end.
 
Right? I wanted them to put an additional disk array in their server last year - would have only cost the price of two drives plus configuration, but of course that was denied. I would have never suggested the solution we took had I known what I was in for on the other end.
This is the stuff I remind people of when they claim that SharePoint storage is too expensive.

Sure, $0.20 / gb / month adds up, but you know what else adds up? The metric crapton of time and coordination archive retrieval consumes.

You're doing all of this, and you don't even know the data you're getting back is what they want!
 
Back
Top