7

I have a target within my DFS namespace that was originally created with an incorrect spelling in the name, the underlying share is correct. It didn't get noticed for a couple years though. I have created a new target with the corrected name, and I believe I have updated most of the GPOs, scripts and such to use the new corrected target.

The setup looks approximately like this.

  • namespace server/share: \\dc-[1-12].example.org\dfs
  • namespace: \\example.org\dfs
  • old target: \\example.org\dfs\missmelled -> \\srv01\staff
  • new target: \\example.org\dfs\correct -> \\srv01\staff

I want to delete that old invalid target with minimal interruption. How can I monitor and see if and where the old target is still being used.

Filesystem auditing on the destination of the DFS target doesn't seem like it would be useful, since both the old and new targets get sent to that location.

I haven't tried it, but I am guessing enabling auditing on the namespace share might be useful? This seems like it would be a big pain since I have to check the logs of each namespace servers? There are 12 of those since I have lots of small sites across slow links, and this particular target might be accessed at any of the sites.

All the namespace servers are Server 2012 or 2012r2. The actual target is 2008r2 host.

To restate, I want to find who/what is using a particular DFS target within my namespace because I want to remove it with minimal interruptions of service. Search engines are not giving me good answers, maybe I am asking the wrong question?

Zoredache
  • 133,737

1 Answers1

4

You may consider something like this:

1 - Reconfigure the "staff" directory to be shared twice, as both "staff" and "staffBad"
2 - Reconfigure the "missmelled" link in DFS so that its only target is "\srv01\staffBad". User access will not be interrupted, they'll still get to it, just through a different share.
3 - Run a powershell script (loop on some kind of interval for an entire day/week) to query who is connected through the "staffBad" share and log the results to a file

gwmi -comp srv01 Win32_ServerConnection | where {$_.sharename -eq "staffBad" } | select username, sharename, computername | out-file -append staffBad.txt

The powershell could be more complex... Log as csv or xml. Log only connections that were not found in the previous run. Or SELECT UNIQUE from the full results upon review.

Clayton
  • 4,653