topic Re: Copying local groups between filers in ONTAP Hardware

Copying local groups between filers

mattmusgrove1 — Thu, 05 Jun 2025 07:05:22 GMT

We have a new FAS2020 and need to migrate all the data from a FAS250 on to it. There are hundreds of local groups on this FAS250 (because originally an old windows server was migrated to the FAS250 using SecureCopy which copies all the local groups and shares over as well as the files).

If I SnapMirror to the FAS2020 of course the local groups won't transfer. How can I copy the local groups to the new FAS and keep all my permissions intact? If I were to use SecureCopy (or other product) would the new RID's on the new FAS2020 be different to those on the FAS250? I don't really understand the role the RID's play in all this?

Any advice gratefully received

Re: Copying local groups between filers

ekashpureff — Thu, 18 Nov 2010 02:44:31 GMT

I'm not sure I understand how you would have so many local groups ?

There's a distinct difference between local groups/users and domain users/goups.

Local groups for CIFS are defined in the /etc/lclgroups.cfg file.

They can contain domain and local users.

Domain groups are defined in AD.

In most cases Robo or other tools will sync your ACLs for you.

I hope this response has been helpful to you.

At your service,

Eugene E. Kashpureff
ekashp@kashpureff.org
Fastlane NetApp Instructor and Independent Consultant
http://www.fastlaneus.com/ http://www.linkedin.com/in/eugenekashpureff

(P.S. I appreciate points for helpful or correct answers.)

Re: Copying local groups between filers

mattmusgrove1 — Thu, 18 Nov 2010 09:43:22 GMT

No, I don't understand why there are so many local groups either! About 700

Can I copy the /etc/lclgroups.cfg between filers?

Re: Copying local groups between filers

aborzenkov — Thu, 18 Nov 2010 09:55:16 GMT

Most likely not.

Windows SID is built from (at least) two parts – computer/domain SID and RID (Relative ID) that, to put is simple, is just consecutive numbering of objects, e.g. users or groups.

Lclgroups.cfg contains just RID for each group; but your file ACLs store full SIDs that include filer SID.

New filer most likely will get new SID when you run cifs setup, which means those new groups won’t match ACEs. It is the same as deleting and creating user with the same name – it is still different user from Windows point of view.

Re: Copying local groups between filers

mattmusgrove1 — Thu, 18 Nov 2010 10:08:30 GMT

This is bad news. So does this mean that I would have to use a tool (like SecureCopy) to migrate from filer to filer in order to preserve the association between the local groups and the ACLs?

Re: Copying local groups between filers

aborzenkov — Thu, 18 Nov 2010 10:10:16 GMT

How would you do it in case of “normal” Windows servers?

Re: Copying local groups between filers

mattmusgrove1 — Thu, 18 Nov 2010 10:13:20 GMT

Good point

Re: Copying local groups between filers

mattmusgrove1 — Wed, 09 Oct 2013 13:44:56 GMT

Updating after a few years as I needed to do this again and found my own question.

Yes, you can copy local groups. You need to copy /etc/filersid.cfg and /etc/lclgroups.cfg to your new filer.

cp /etc/lclgroups.cfg /etc/lclgroups.tmp

On Netapp:

useradmin domainuser load /etc/lclgroups.tmp