File services: DFS namespace, replication, FSRM and shadow copies

Start DC01, SRV01 and DC02. Work on SRV01 as SAATLAB\Administrator in PowerShell as administrator. You’ll start CL01 in step 5, after shutting down DC02.

1Install the file services

On SRV01, run this:

Install-WindowsFeature FS-DFS-Namespace, FS-DFS-Replication, FS-Resource-Manager -IncludeManagementTools
Install-WindowsFeature FS-DFS-Replication -ComputerName DC02

You should see something like this:

Success Restart Needed Exit Code Feature Result
------- -------------- --------- --------------
True    No             Success   {DFS Namespaces, DFS Replication, File Server Resource Manager, ...}

Success Restart Needed Exit Code Feature Result
------- -------------- --------- --------------
True    No             Success   {DFS Replication}

✅ Checkpoint: Both installs report Success.

2Create the namespace

On SRV01, create the root folder and share, then the namespace and its first folder:

New-Item -ItemType Directory D:\DFSRoots\Files | Out-Null
New-SmbShare -Name Files -Path D:\DFSRoots\Files -ReadAccess 'NT AUTHORITY\Authenticated Users' | Out-Null
New-DfsnRoot -Path \\saatlab.internal\Files -TargetPath \\SRV01\Files -Type DomainV2
New-DfsnFolder -Path \\saatlab.internal\Files\Departments -TargetPath \\SRV01\Departments
Get-DfsnFolderTarget -Path \\saatlab.internal\Files\Departments | Select-Object Path, TargetPath, State

You should see something like this:

Path                                 TargetPath          State
----                                 ----------          -----
\\saatlab.internal\Files\Departments \\SRV01\Departments Online

The root share only needs Read: users never store files in the root, they go through it to the folder targets, where the permissions from Lesson 16 still apply.

✅ Checkpoint: The Departments folder in the namespace points to \\SRV01\Departments and is Online.

3Replicate a Policies folder between SRV01 and DC02

On SRV01, create the folders and a first file, then the replication group:

New-Item -ItemType Directory D:\Policies | Out-Null
'Staff handbook v1' | Set-Content D:\Policies\handbook.txt
Invoke-Command -ComputerName DC02 -ScriptBlock { New-Item -ItemType Directory C:\Policies | Out-Null }

New-DfsReplicationGroup -GroupName Policies | Out-Null
New-DfsReplicatedFolder -GroupName Policies -FolderName Policies | Out-Null
Add-DfsrMember -GroupName Policies -ComputerName SRV01, DC02 | Out-Null
Add-DfsrConnection -GroupName Policies -SourceComputerName SRV01 -DestinationComputerName DC02 | Out-Null
Set-DfsrMembership -GroupName Policies -FolderName Policies -ComputerName SRV01 -ContentPath D:\Policies -PrimaryMember $true -Force | Out-Null
Set-DfsrMembership -GroupName Policies -FolderName Policies -ComputerName DC02 -ContentPath C:\Policies -Force | Out-Null
Update-DfsrConfigurationFromAD -ComputerName SRV01, DC02

The primary member’s copy wins during the first sync, which is why SRV01, the server with the real data, is primary. Update-DfsrConfigurationFromAD makes both servers read the new settings now instead of at their next AD poll.

Wait two or three minutes, then check DC02 got the file:

Get-Content \\DC02\C$\Policies\handbook.txt
Get-WinEvent -ComputerName DC02 -LogName 'DFS Replication' -MaxEvents 5 | Select-Object Id, Message

You should see something like this:

Staff handbook v1

  Id Message
  -- -------
4104 The DFS Replication service successfully finished initial replication on the replicated folder at local path C:\Policies...
4102 The DFS Replication service initialized the replicated folder at local path C:\Policies and is waiting to perform initial...

Share both copies and publish them in the namespace as two targets of one folder:

New-SmbShare -Name Policies -Path D:\Policies -ReadAccess 'NT AUTHORITY\Authenticated Users' -FullAccess 'SAATLAB\Domain Admins' | Out-Null
Invoke-Command -ComputerName DC02 -ScriptBlock { New-SmbShare -Name Policies -Path C:\Policies -ReadAccess 'NT AUTHORITY\Authenticated Users' -FullAccess 'SAATLAB\Domain Admins' | Out-Null }
New-DfsnFolder -Path \\saatlab.internal\Files\Policies -TargetPath \\SRV01\Policies | Out-Null
New-DfsnFolderTarget -Path \\saatlab.internal\Files\Policies -TargetPath \\DC02\Policies | Out-Null
Get-DfsnFolderTarget -Path \\saatlab.internal\Files\Policies | Select-Object TargetPath, State

You should see something like this:

TargetPath       State
----------       -----
\\SRV01\Policies Online
\\DC02\Policies  Online

✅ Checkpoint: handbook.txt exists on DC02, event 4104 appeared, and the Policies folder has two Online targets.

4Set a quota and block executable files with FSRM

On SRV01, run this:

New-FsrmQuota -Path D:\Home\priya.sharma -Size 100MB -Description 'Lab home folder limit' | Out-Null
New-FsrmFileScreen -Path D:\Shares -IncludeGroup 'Executable Files' -Active -Description 'No programs in department shares' | Out-Null
Get-FsrmQuota | Select-Object Path, @{n='LimitMB';e={$_.Size/1MB}}, @{n='UsedMB';e={[math]::Round($_.Usage/1MB,2)}}, SoftLimit
Get-FsrmFileScreen | Select-Object Path, Active, IncludeGroup

You should see something like this:

Path                 LimitMB UsedMB SoftLimit
----                 ------- ------ ---------
D:\Home\priya.sharma     100      0 False

Path      Active IncludeGroup
----      ------ ------------
D:\Shares True   {Executable Files}

SoftLimit False means a hard quota: writes beyond 100 MB are refused. A soft quota only warns and reports. The file screen is active, so FSRM refuses to save files matching the “Executable Files” group (.exe, .bat, .ps1 and more) anywhere under D:\Shares.

✅ Checkpoint: Priya’s folder has a 100 MB hard quota, and D:\Shares has an active file screen.

5Turn on shadow copies and restore a deleted file

On SRV01, give drive D shadow copy storage and take a first copy:

vssadmin add shadowstorage /for=D: /on=D: /maxsize=10%
vssadmin create shadow /for=D:

You should see something like this:

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Successfully added the shadow copy storage association

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.

Successfully created shadow copy for 'D:\'
    Shadow Copy ID: {5d3c2a1e-8b7f-4c6d-9e0a-1f2b3c4d5e6f}
    Shadow Copy Volume Name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1

In File Explorer on SRV01, right-click drive D, choose Configure Shadow Copies, select D and click Settings, Schedule to see the default twice-a-day schedule (7:00 and 12:00 on weekdays). Click Enable to switch it on.

Now shut down DC02 and start CL01. Sign in as SAATLAB\priya.sharma, open \\saatlab.internal\Files\Departments\Finance in File Explorer and delete budget.txt.

Right-click an empty space in the Finance folder, choose Properties, then the Previous Versions tab. Select the version from a few minutes ago, click Open, and copy budget.txt back into Finance.

✅ Checkpoint: Priya restored budget.txt herself from Previous Versions, through the DFS path.

Take snapshots of all four VMs called “File services” when you’re done.

'DC01','DC02','SRV01','CL01' | ForEach-Object { VBoxManage snapshot $_ take "File services" }