Production-oriented PowerShell 4.0 toolkit for migrating a Windows file server by detaching data disks from the source server and attaching them to the destination server.
The exporter captures the source configuration. The comparer validates the destination and is read-only by default. Every system-changing repair is explicit and scoped through -Fix.
Export-FileServer-BeforeMigration.ps1: source-server export.Compare-FileServer-AfterMigration.ps1: destination validation and opt-in repairs.PRODTEST-ProdSafety.Tests.ps1: non-admin end-to-end safety harness using isolated test artifacts and command shims.
The export covers:
- SMB shares, sensitive share properties and share permissions.
- Folder NTFS DACLs, owners, inheritance state and normalized hashes.
- DFS namespaces when the DFS tools are available;
-DfsNamespaceServeris optional. - Volumes, partitions and disks, including stable identifiers, drive letters, exact sizes and health state.
- Local users and membership of the local Administrators group, located by SID so the Windows display language does not matter.
- Active Directory computer-account SPNs, with post-migration checks for missing values, unexpected values, duplicate ownership and SPNs registered on another AD object.
- Scheduled tasks with full XML definitions.
- FSRM file groups, templates, screens and quotas, including native XML exports when supported.
- LanmanServer share registry values and the optional Enterprise Vault KVS registry branch.
- A SHA256 manifest covering every exported artifact.
Passwords and password hashes are never exported. Local accounts and Administrators memberships are audit-only and are never changed automatically.
- Source: Windows Server 2012 R2 or later, Windows PowerShell 4.0 or later.
- Destination: Windows Server 2022 or another supported server with the required roles/modules installed.
- Run from an elevated Windows PowerShell session.
- The SPN step requires domain connectivity and permission to read the computer account and
servicePrincipalName; the Active Directory module is optional because an LDAP fallback is included. - Use UTF-8 CSV files generated by the exporter; do not edit the export folder after the manifest is created.
| Goal | Command |
|---|---|
| Full source export, depth 5 | .\Export-FileServer-BeforeMigration.ps1 -FolderAclDepth 5 -InheritanceCheckDepth 5 |
| Source export with selected domains | .\Export-FileServer-BeforeMigration.ps1 -Steps Shares,ACLs,Inheritance,Volumes,LocalAccounts,SPNs,Tasks,FSRM |
| Destination full read-only validation | .\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS |
| Destination selected read-only checks | .\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS -Checks Manifest,Volumes,Shares,SharePerms |
| AD computer account and SPN ownership | .\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS -Checks Manifest,SPNs |
| Interactive check/fix selection | .\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS -Interactive |
Running the comparer without -Fix never changes destination server configuration. -Interactive also remains read-only unless one or more fixes are selected and the exact confirmation text is entered.
On the source server, before shutdown:
.\Export-FileServer-BeforeMigration.ps1 -FolderAclDepth 5 -InheritanceCheckDepth 5The export directory is created automatically under C:\Migration_Export_<timestamp>. To return to depth 3:
.\Export-FileServer-BeforeMigration.ps1 -FolderAclDepth 3 -InheritanceCheckDepth 30 means the share root only and -1 means unlimited depth. The normal ACL mode captures folders only, not file ACLs. It includes each share root and folders with broken inheritance or explicit ACEs. Use -AllFolderAcls to record every folder or -FullACLBackup for the slower recursive icacls mode.
After the data disks are attached to the destination, run a complete read-only comparison:
.\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSSReview the console output, HTML report and adjacent _findings.csv. Exit code 0 means no blocking error; exit code 1 means at least one error.
Run repairs only after the read-only report is understood:
# Recreate missing shares and add missing share permissions.
.\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS -Fix Shares,SharePerms
# Restore exported FSRM objects without deleting destination-only objects.
.\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS -Fix Fsrm
# Import selected custom tasks.
.\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS -Fix Tasks -TaskInclude '\CUSTOM\*'
# Import every eligible non-Microsoft task.
.\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS -Fix Tasks -AllEligibleTasksFolder DACL repair is also opt-in:
.\Compare-FileServer-AfterMigration.ps1 -ExportFolder C:\Migration_Export_YYYYMMDD_HHMMSS -Fix FolderAclsAll fixes require a fully valid manifest. Additional permissions, FSRM objects, tasks, users or Administrators members are reported and never removed automatically.
SPN validation is always read-only. It uses the Active Directory module when available and otherwise falls back to LDAP. Ownership is checked across the forest through the AD module or Global Catalog when possible; if only domain-level lookup is available, the report includes an explicit warning. Missing SPNs, duplicate ownership and ownership by another AD object are blocking errors. Additional destination SPNs are warnings and are never removed automatically. Review remediation with setspn -L, setspn -Q and setspn -X; only use setspn -S after confirming the intended account owner.
Older exports remain usable. For legacy volumes.csv files without stable storage identifiers, the comparer falls back to drive-letter matching and emits a warning. Exports created before schema 2.5 do not contain the local-account baselines, and exports before schema 2.6 do not contain SPN baselines; those checks are skipped with warnings instead of invalidating the older export.
Run from a normal PowerShell session:
.\PRODTEST-ProdSafety.Tests.ps1The harness creates only PRODTEST_* artifacts under its own guarded runtime folder, exercises clean and sabotaged scenarios, and removes the runtime folder in finally. It does not replace validation in a representative lab server with the same Windows roles as production.
- Review the scripts and the generated report before enabling any fix.
- Keep a tested backup and rollback plan for the server migration.
- A successful comparison validates the exported scope; it cannot prove the absence of configuration that was never exported.
- Long paths beyond the legacy Windows PowerShell/.NET limits are logged but are not fully handled on PowerShell 4.0.
Licensed under the MIT License. The scripts are provided without warranty. Review and test them against a representative environment, and keep a verified backup and rollback plan before any production migration.