Home / AWS

AWSRunbookIntermediate

Transformation: Windows file servers to Amazon FSx for Windows File Server with DataSync

Migrate SMB file shares to Amazon FSx for Windows File Server. Size and join FSx to Active Directory, copy data with DataSync while preserving NTFS permissions, cut over with DFS Namespaces and set up backups and shadow copies.

Deepak Bhardwaj3 min read

Applies toAmazon FSx for Windows File Server, AWS DataSync, AWS Managed Microsoft AD or self-managed AD, Windows file servers 2012 R2+

Why FSx for Windows

Fully managed Windows file servers: SMB, NTFS ACLs, DFS, shadow copies and Multi-AZ, without patching Windows Server yourself.

1. Design

Decision Options
Deployment Multi-AZ for production (automatic failover), Single-AZ for dev or secondary copies
Storage SSD for general use and small files; HDD for large, throughput-oriented shares
Throughput capacity Size for peak; it can be changed later
Active Directory AWS Managed Microsoft AD, or join your self-managed AD (needs DNS and ports to DCs)

Self-managed AD needs: a service account with rights to join computers in a target OU, DNS servers reachable from the FSx subnets, and the documented AD ports open.

2. Create the file system

aws fsx create-file-system --file-system-type WINDOWS --storage-capacity 2048 --storage-type SSD \
  --subnet-ids subnet-a subnet-b --security-group-ids sg-fsx \
  --windows-configuration '{
    "DeploymentType":"MULTI_AZ_1","PreferredSubnetId":"subnet-a","ThroughputCapacity":128,
    "SelfManagedActiveDirectoryConfiguration":{
      "DomainName":"corp.contoso.com","OrganizationalUnitDistinguishedName":"OU=FSx,DC=corp,DC=contoso,DC=com",
      "FileSystemAdministratorsGroup":"FSx Admins","UserName":"svc-fsx-join","Password":"<from-secrets-manager>",
      "DnsIps":["10.0.0.10","10.0.1.10"]},
    "AutomaticBackupRetentionDays":14}'

Create shares with the remote FSx PowerShell endpoint (New-FSxSmbShare) or Windows tools against the FSx DNS name.

3. Copy with DataSync

  1. Deploy a DataSync agent near the source (VMware/Hyper-V/EC2), or use an agentless option where available.
  2. Create an SMB location for the source share (account with backup operator rights so it can read everything) and an FSx for Windows location for the target.
  3. Create a task preserving metadata: ownership, DACLs and (if needed) SACLs.
aws datasync create-task --source-location-arn <smb-loc> --destination-location-arn <fsx-loc> \
  --name finance-share \
  --options "VerifyMode=ONLY_FILES_TRANSFERRED,SecurityDescriptorCopyFlags=OWNER_DACL,PreserveDeletedFiles=REMOVE,OverwriteMode=ALWAYS" \
  --cloud-watch-log-group-arn <log-group-arn>
aws datasync start-task-execution --task-arn <task-arn>

Run the full copy early, then incremental runs (only changes move) daily up to cutover.

Tip

Throttle DataSync bandwidth during business hours so the copy doesn't saturate the office link.

4. Cut over

  1. Announce a short freeze; set the source share read-only.
  2. Run a final incremental DataSync execution and check its verification result.
  3. Switch the DFS Namespace folder target to the FSx share (or update drive-mapping GPOs). With DFS-N, users don't change anything.
  4. Spot-check permissions with a few user accounts from different groups.

5. Operate

  • Daily automatic backups plus AWS Backup for longer retention / cross-region copies.
  • Enable shadow copies so users restore their own files (Set-FsxShadowStorage, Set-FsxShadowCopySchedule on the remote PowerShell endpoint).
  • Monitor FreeStorageCapacity and throughput utilisation; enable storage scaling before you run out.

Checklist

  • AD join prerequisites (OU, service account, DNS, ports) tested
  • Multi-AZ FSx with right throughput
  • DataSync full + incremental copies with ACLs preserved
  • DFS-N switched, source read-only for rollback window
  • Backups and shadow copies on; old servers retired

Related fixes