File server migration checklist
Six phases, forty-two checks, in the order you actually do them. No email required and nothing gated — print it, save it as a PDF, paste it into your ticket.
Free: we will read your audit output
Run the read-only PowerShell in phase 1, send us the CSVs, and we will tell you what is in them and where the risk sits — on a call, at no charge. You give us no access to anything: the scripts only read, and you decide what to share.
Get the free reviewThe checklist
42 checks1. Audit before you copy anything
The output of this phase is what you compare against after cutover. Without it you cannot prove the migration preserved access rather than appearing to.
- Export every share and its path, description and enumeration mode
- Export share-level ACLs separately — these do not travel with the data
- Find ACEs whose identity is an unresolved S-1-5-21 SID
- Find every folder where inheritance is disabled
- Find every explicit deny entry
- Record folder owners — they are often a departed administrator
- List who has files open at the hour you plan to cut over
- Identify hard-coded UNC paths in applications, scripts and GPO drive maps
- Name a business owner for every share, or record that there is not one
2. Decide before the window opens
Every one of these is a decision that becomes an argument at 2am if it was not made in advance.
- Keep the old server name, or move users to a new one
- Confirm the destination volume has headroom for growth, not just for today
- Decide what happens to data nobody claims — move it, archive it, or leave it
- Agree the cutover window with the owner of the noisiest share
- Warn users that Previous Versions history does not survive the move
- Decide the rollback trigger, who calls it, and by what time
- Confirm backups of both source and destination, and that a restore was tested
3. Copy
Seed early, delta repeatedly, and keep the logs. The final sync should move very little.
- Set /R and /W explicitly — the defaults are 1,000,000 retries at 30 seconds
- Use /COPYALL (/COPY:DATSOU) so security, owner and auditing come across
- Add /DCOPY:DAT — directory timestamps are not preserved by default
- Confirm the account running the copy has backup-operator rights both ends
- Add /EFSRAW if anything on the volume is EFS-encrypted, and test one file
- Run the seed copy, then delta copies on a schedule until the window
- Keep /MIR for the final sync only, and confirm the destination path first
- Read the log for skipped files rather than assuming zero
4. Cut over
This is the phase where the failure is an authentication error that looks like a permissions error.
- Set the source shares read-only before the final sync
- Run the final sync and confirm the log is clean
- Recreate every share from the phase 1 export, including share-level ACLs
- Reapply access-based enumeration, quotas and file screens
- Register the old name with netdom computername /add:, not a DNS CNAME
- Verify the SPNs landed on the computer account with setspn -L
- Repoint DFS namespace folder targets
- Confirm the backup job now points at the new server
5. Validate by people, not by file count
A matching file count proves the copy ran. It proves nothing about access, which is the thing that breaks.
- Re-run the phase 1 queries and diff them against the originals
- Check effective access for one real user per department
- Open the line-of-business applications, not just Explorer
- Test whatever authenticates as a service account
- Confirm mapped drives and GPO drive maps resolve
- Watch the security log for access-denied events for two full days
- Check that a scheduled job which runs weekly has run once successfully
6. Keep the exit open
The old server is the rollback plan. A backup is not, because restoring terabytes takes longer than the window you were given.
- Leave the source server powered on and read-only for at least a month
- Wait for one full monthly cycle before decommissioning anything
- Record what was changed and when, so later failures can be correlated
What does not come across with the files
Each of these is stored somewhere other than the file system, so no copy tool will move it. Recreate each one deliberately.
- •Share permissions
- •Local users and groups
- •Access-based enumeration
- •FSRM quotas and file screens
- •Shadow copies (Previous Versions)
- •DFS namespace targets
- •Offline files and caching mode
- •Share descriptions and hidden-share flags
The free review, and what it is not
Two levels, and it is worth being clear which is which, because "free audit" is a phrase that usually hides something.
Free review
No charge, no commitment
You run the read-only PowerShell from phase 1 on your own server and send us the CSV output. We read it and give you a call: how many unresolved SIDs you are carrying, where inheritance has been broken, which shares have no owner, and whether any of it is likely to bite during a migration. You give us no access to your systems and no credentials. If the answer is that your file server is in good shape, we will tell you that too.
Full engagement
€65/hour, fixed-scope quote
The migration itself, or the permission restructure afterwards, scoped and quoted up front rather than billed open-ended. This is the paid work, and we would rather you knew that before the call than during it.
What happens to the files you send us
We are asking a European company to send us an export of its access permissions, so it is only fair to say plainly what we do with it before you decide.
- •The scripts are read-only. They enumerate shares, ACLs and inheritance, and they change nothing on your server. You run them, not us.
- •Redact freely. Share names and paths can be replaced before you send anything — the findings we report do not depend on knowing what a folder is called.
- •We do not need credentials, a VPN, a remote session or any access to your systems. If someone asks you for those to perform a free audit, that is a different kind of offer.
- •The CSV files go to the engineer doing the review and nowhere else. They are not uploaded to a third-party tool, and they are not used to train anything.
- •We delete them within 30 days of the call, or immediately if you ask. If you engage us afterwards, we keep them for the project and delete them when it ends.
- •If your organisation needs this in writing before you send anything, ask and we will sign an NDA first.
Questions
Is the checklist really free, with no email?
Yes. There is no form in front of it and nothing to sign up for. Print it or save it as a PDF from your browser. We would rather it was useful to people who never contact us than gated to people who never read it.
What exactly is free about the audit?
Reading your audit output and telling you what it means, on a call. That covers unresolved SIDs, broken inheritance, deny entries, shares without owners and the risks specific to your tree. It does not cover doing the migration, writing a formal report or remediating anything — that is the paid engagement, quoted to a fixed scope.
Do you need access to our server?
No. The scripts in the article are read-only and you run them yourself. You send us the CSV files, and you decide what is in them — redact paths or share names if you would rather. Nothing about the free review requires credentials or a remote session.
Does this apply to a migration to SharePoint or a NAS instead?
Partly. Phases 1, 2, 5 and 6 apply to any destination, because auditing what you have, deciding in advance, validating by user and keeping a rollback are destination-independent. Phases 3 and 4 are specific to a Windows-to-Windows move; a NAS or SharePoint target changes how permissions are mapped, and that mapping is usually where those projects go wrong.
How long does a file server migration take?
The copy is a function of volume and bandwidth and is usually the predictable part. The audit and the validation are where the time goes, and on a server that has been accumulating exceptions for a decade that is weeks of elapsed time rather than a weekend — much of it waiting for a full business cycle to prove nothing broke.
Send us the output
Run phase 1, send the CSVs, get a call. No charge, no access to your systems, and a straight answer about whether there is a problem worth paying anyone to fix.
Get the free review