No – I don’t think it does

The NDMP data format is not part of the standard – its vendor specific

Isi_vol_copy was specifically written to “translate” between the NetApp and the Isilon NDMP data format

Emcopy should be able to cope with insufficient rights on the source files/dirs IF if is run as Domain Administrator with Backup privileges and the proper options.

Check the forum here – there were a number of posts about it

BTW there is also an Isilon support forum here at ECN

What you can do is run your process as a domain administrator.  If you have more than one CIFS server on the celerra (ie it's in more than one AD domain) you may need to use a domain administrator for each server.  It should get you most everything you need doing it that way. 

Also,  I have some tools i've written on my blog which may help you our a bit as part of the migration.  I have a script to export your celerra filesystems and create the folder and quota on isilon,  create your nfs and cifs shares, and one which will generate your emcopy commands for you.

All can be found at http://blog.virtualstoragezone.com

Even with domain admin removed from the ACL’s a program using Backup Operator privilege can still copy the files

Just like a (good) Backup application can backup/restore files that aren’t normally accessible to the user running the backup

Not that it’s not a “free pass” – the privilege needs to specifically invoked by the program using a special API.

If you just think that you can give BO priv to a user and then use explorer to copy/open files – that won’t work.

Backup files and directories (SeBackupPrivilege)

Allows the user to circumvent file and directory permissions to backup the system.

The privilege is selected only when the application attempts to access through the NTFS backup application interface.

Otherwise normal file and directory permissions apply.

This privilege causes the system to grant all read access control to any file, regardless of the access control list (ACL) specified for the file.

Any access request other than read is still evaluated with the ACL.

The following access rights are granted if this privilege is held:

·        READ_CONTROL

·        ACCESS_SYSTEM_SECURITY

·        FILE_GENERIC_READ

·        FILE_TRAVERSE

Emcopy and robocopy in backup mode can do this – of course sometime there are bugs

See for example http://support.microsoft.com/kb/979808/en-us

Interesting - never thought about that.  I think i'd just use nfs to copy the permissions and make sure to maintain the ACLs... I like to use cpio for these types of copies

we have customers who manage their own permissions and domain admin is removed from ACLs.

If you use NFS to copy the data off of Celerra, you will lose the Windows extended ACLs, as NFS does not support these.  You will need to use a copy tool like EMCOPY in order to retain all of the extended ACLs on each of the files in Celerra.

Don't forget about the other tools that go along with EMCOPY, like LGDUP and EMCACL, which can also help you retain ACLs and permissions as you copy.

you can use lgdup with Isilon ?

Well – in order for lgdup to work the CIFS server has to have implemented the Microsoft API to manage localgroups

It doesn’t run towards a mapped drive – it really needs a CIFS server name to talk to

lgdup mentions that source and target should be netbios name ..is that what you mean by "mapped drive" ? If that's the case, what do i specify for Isilon: SmartConnect Name, Cluster netbios name ?

Thanks

You're probably right, I'm not sure I have the right privs to test it in the lab, so I don't know whether or not you can modify Isilon LGs from the command line.  If you can only do so from the Admin console, then lgdup won't work.