SBS File/Folder Security problems

Associate
Joined
20 Aug 2007
Posts
1,333
Location
Solihull
Hi guys, this is going to be a bit of an essay, but I could really use some help!

So recently I have been put in charge of looking after IT at my office (a B2B telecommunications company) halfway through a migration from us using windows SBS 2008 and our mail coming through Exchange 2007 on our (dodgy) office based server.
Throughout the week I had been systematically moving round everyones workstations and laptops installing Office 2010 and Lync in preparation for the migration.

On Thursday night we changed the MX record and started exporting our .pst files around 5.30pm and I then spent the rest of the evening up till about midnight making sure everyone's profile had migrated and was uploading to the office 365 cloud.

Friday morning a guy who I had been liaising with at Vodafone (our Microsoft re-seller and business partner) who was in charge of the migration at their end, just to iron out a few creases.
We had a few problems, emails bouncing back to sender etc and then we resolved that the issue was that Exchange 2007 on our server was still trying to get involved, and as part of the migration process we were supposed to remove Exchange 2007 from the local server, we set about doing this, (had to create a string value in the registry to allow us to do this) so we managed to uninstall Exchange, then we went back on to SBS console, it had refreshed and for some reason, there were suddenly NO users on it at all, there had been about 20 including some of the admin users. Somehow, **** know's how, when exchange went, it took ALL of our network users with it!

It didn't seem to instantly affect those still logged on, so I quickly told them not to log off or lock their PC's, they still had access to the public mapped network drive on the server from their PC's, documents locally hosted on their PC's and the internet/email.

However those users who hadn't been logged on when the users disappeared were not able to log on at all! (PANIC)!

The guy from Vodafone and I were now panicking a bit but we checked and were relieved to find that there was no data lost from the server. So basically we tried to do the recovery from a backup, only to find that for the last 3 months (I only took over IT responsibility this week) that the tape drive backup had been failing, so we had nothing at all to back up from!

I then recreated all the users with administrator permissions on SBS (to make setup easier) with intention to simply copy all the users old documents from the server onto their new profile I had created.

I told everyone to stay logged in at the end of the day, but one of the users was logged off accidentally and when I logged back into her new account, obviously there was no data on it. I set up her email and synced it with the cloud based mail and luckily all that came back fine. But I now am facing a problem, I have located her data on the server and have battled to set permissions to view it, but whenever I try and move it (one file at a time or all at once) to her new account or to a memory stick, or even the servers' my documents, it just tells me I have no permission to do so, even though I am logged in as global admin, all the Icons have a funny symbol on, as shown in picture, can anyone help me try and recover this data please? I'm sure it's doable but my experience in this kind of restricted data is limited!

I have found how to access permission for individual files and folders, but because they are all different file types/folders, I can't change permissions for each individually, therefore the only way I could move all these files over would be to set permissions for each individual folder!? Does anyone know a way around this?

Help would be insanely appreciated to the point I'd be willing to pay! XD
 
Sec I'll throw up some screenies, I can set all permissions and stuff for myself, so I can access all the files and folders, but I have to set individual access to get into each folder/file.

I assume there's some way of assigning permissions to a folder and all child objects and folders within it?
 
OH BREMEN I LOVE YOU! You just gave me the idea to reassign full permissions to myself on the parent folder! Success! I have full access to the users folders and files! THANK YOU <3333

:D

watch this space still though! Bound to still be more issues fixing this massive problem! :P
 
As your SBS box had Exchange 2007, presumably your users would have hit the local SCP autodiscover rather than the one for Office 365, was that your problem?
 
That would be because your server was accepting mail for the domain, if you're migrating the data you either needed to remove that domain from your Exchange/users so that outbound mail from your Exchange server would hit the Office 365 servers, or you should have configured the Office 365 users with a secondary address space so you could configure backend forwarding from your users to the new ones.

That's generally how it works anyway, at least when we do migrations.

Other option would be to have configured the domain as Internal Relay, and configured a Send Connector to route mail for the domain to your MX records, or straight to a smart host/Office 365, you could then just mail disable the users as you migrated them.

Doesn't sound like any of this was planned for though, I would question your support on this migration for lack of redundancy planning!
 
Yeah it wasn't very well planned, I've only been in the company for 2 months and I wasn't initially employed as IT support, I was just the only tech savvy person in the office, the MD's had initially set this up but I don't think anyone in the office was quite sure what was entailed in the migration, I've had to learn and understand a lot regarding the migration in a short time, but hey, I've learned a crazy amount because it went to **** and learned to recover all our lost data :)
 
Well if there was one piece of advice I can give, especially when dealing with important user data, it's test and test again. In your shoes I would have definitely tested the migration steps before actually moving anyone! :D

Good you learn a bit though, have a read up on Accepted Domains in Exchange 2007/2010 though, will help you understand where you went a bit wrong, and will still apply to your Office 365 account as well.

Autodiscover is a whole different Kettle of fish, and generally applies to users who are using Outlook 2007+, this can get very messy in migration/co-existence scenarios.
 
Last edited:
Thanks for your help guys! I'll definitely look into reading up on that Eulogy, it's a massive change going from my normal area of gaming/overclocking/performance to server administration without any prior training, I have started comptia N+ in my own time but it's very hard to find the time at present! :c
 
Back
Top Bottom