Are you sure it is not your client ?

I think (not sure) that if you are displaying CIFS file security from a Windows client the VNX sends the SID and the client does the resolution to a Windows name

The unresolvable SID's on the target folders belong to local groups. I think they are showing up as unresolvable because the local groups were not present on the target file server prior to starting replicator. (I used lgdup after the replication was synced with the target)

I will restart replicator now that the local groups are on the target, to see if that resolves the unresolvable SID issue.

Thanks!

If using Replicator to migrate data, then the ACLs will contain same SIDs as on the source

When using LGdup to copy the local groups, they will get a new SID on destination (same as if you manually created those LG), then when looking at ACLs you will still see unresolved SIDs

If you copy files using EMCopy or Robocopy (file based utilities) and use a switch to specify that you have local groups (it’s /LG with EMCopy) then the program will “translate” ACEs so that they apply to the local group name on the target and in that case you should no longer see unresolved SIDs

Claude

IP Replicator is block based, so it has no way to translate SIDs

SIDs for local groups are local to the CIFS server and as you said there are no VDMs on VNXe

You could as well take the opportunity of this migration to get rid of those LG and recreate permissions using groups from the domain (the LGs were probably created when the CIFS server was a member of an NT4 domain)

Claude

Thank you Bergec

Thank you Bergec for this explanation - very helpful.

So I should not use replicator for the replication as this will always produce unresolved SIDs? as there is no "translate" option when copying NTFS permissions?  The source file server has over 300 local groups that I need to move to the target.  Not sure if this can be resolved with replicator?

I moved the source local groups to the target using lgdup, and I included the /lg switch in my emcopy command to "translate” ACEs so that they apply to the local group name on the target.  I still see unresolved SIDs.  Any ideas?

Here is the emcopy command:

emcopy.exe \\10.10.10.1\dir\ \\10.10.10.2\dir\ *.* /o /lg /s /c /r:1 /f /sdd /log+:C:\EMCopy\log1.txt

Thanks!

SIDs for local users/groups or domain ?

Check which ones they are – lookup their names on the src

Check if the list of localgroups on the dst is at least a subset of the localgroups on the src

What lgdup does is that it reads the source CIFS servers local grousps and it creates local groups with the same name but different SID on the destination.

Emcopy then (for localgroups) translates the SIDs in owner and ACLs – i.e. it gets the source’s SID, looks up the name, looks us the new SID for the dest and uses that.

If for some reason the SID was already unresolvable on the src or the localgroup couldn’t be created on the dst you would still get unresolvable SIDs

SIDs for local users/groups - The unresolvable SIDs that I see belongs to local groups from the source file server.

I thought by copying the local groups databse and using the /lg switch with emcopy would fix this?