Lgdup was what I looking at, because when we Replicated only the filesystem, the view of the share on the new CIFS server, only shows the ACLs for the directories, but not the underlying file ACLs. And yes, they are using Domain groups and Users, which I guess now, accounts for the loss of them.

CIFS virtualization will be the last fallback, as I can't absorb the impact of all the rest of the NFS exports, from Tree Quotas under all my parent filesystems using that CIFS server.

Lgdup doesnt copy ACLs

Sharedup would – but only the ACLs – not the ACLs for dir/files

The ACLs for dir/files are part of the file system and will automatically retained by Replicator

Of course the devil is in the details – behavior is a bit different if your ACLs refer to domain users or local users/groups

Safest and easiest way is to move the CIFS server to a VDM and replicate that VDM

No – CIFS based copy tools wont be able to copy Unix permissions

You could easily move the fs and CIFS server to a VDM and have the NFS mount paths stay the same – that’s what VDM NFS exports or (if needed) NFS export aliasing is for

Its the other way round

ACL’s on files and dirs are stored inside the file system – so if you use a block-based copy tool like Replicator the very same ACLs will be present on the destination.

Of course in order to properly evaluate them the CIFS server on the destination needs to be able to resolve them – i.e. be a member of the same domain or a trusted one.

ACLs on disk reference SID’s – not user names

So you should be good there for any ACLs that reference domain based SIDS or well-known SIDS’s

For ACLs that reference the local users or local groups – that’s a different matter – they use SID’s that are only valid on that CIFS server and NOT on the destination CIFS server

You would need to re-write them after duplicating the local users/groups

That’s why just “moving” the CIFS server by just replicating it is so much easier – your destination CIFS server will be the very same with the same SIDs and not just a different CIFS server that happens to have the same name but different ID

Migrating the file system using client based copy tools like emcopy or robocopy is a different matter

There you use lgdup to create the local users and groups with the same name on the destination CIFS server

Then sharedup to copy the shares and share ACLs

Finally emcopy with lg/lu will copy the ACLs using the user names so that ACLs will be recreated on the dst so that they work (will reference dst SID)

Share ACLs are something very different from file/dir ACLs – they are stored in the Windows registry or the CIFS server config – but NOT on the data file system.

That’s why they aren’t copied unless you also replicate the CIFS server or use sharedup