Windows File Restore and Preserving NTFS permission

[kac_pres]

currently I'm running my veeam backup server on a Windows Server 2008 R2 VM. I am using Veeam B&R v5. After having Veeam running for 8 days, we finally got a ticket that said we needed to restore a file back on our file share server. Ok, no problem. I fire up Veeam B&R, drill down to the file, browse to the folder and replace the deleted file. 2 minutes later I get an angry email about the file being READ-ONLY and how this should never happen, blah blah blah.

I noticed that the permissions from the copy weren't being copied over as well. I did some research and saw this Veeam Forum post http://ow.ly/30snx using the KB article here: http://support.microsoft.com/kb/310316 to fix it.

I did:
# Locate and then click the following registry key:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
# On the Edit menu, click Add Value, and then add the following registry value:
Value name: ForceCopyAclwithFile
Data type: DWORD
Value data: 1

Rebooted the VM, started the process over and tried moving it from the Windows Explorer window. The permissions were still not being kept. This seems to be a problem with Windows Server 2008 because it won't even inherit the folders permissions when copied over.

More importantly, I think this should be a heavy concern on Veeam's development. The whole point of doing a file level restore is being able to quickly restore a file with its original permissions back in it's original place. I still love the product and will continue to evangelize it, but my boss on the other hand just got fed up during this whole process. Our helpdesk team is in charge of doing file restores and this happens a few times per month. Our original software was as simple as drilling down to the file, right clicking on it and checking a box that said restore with original permissions and giving you the option to restore in original spot, over-writing the current file, or changing the file name. The helpdesk team was able to do this without any problems. But if I have to show them how to go into B&R, then open up windows explorer to go into the VMDK because Veeam's file explorer can't do this, then open up a command prompt and \\server\share to open up another explorer window and finally copy the file over, it will be a nightmare. My boss has already created a new backup job for the original software for our file server because file share restores is what we have to worry about the most. I'm a big fan of Veeam, but I believe simple file level recovery with permissions in tact should be a core functionality of any backup software.

[Gostev]

Hi Kendrick, thanks for bringing this to our attention. Indeed, it looks like Microsoft had removed this registry setting in Windows 2008 R2. We will investigate this from our side and see what we can do to address this requirement. Meanwhile, I recommend that you install the software on Windows 2003 for now (this registry key works there). Generally speaking, you will not get any benefits from running it on Windows 2008 R2 (but possible performance issues, unless you disable its new TCP/IP stack features and "optimizations"). Thank you for your feedback!

[Gostev]

Kendrick, this totally escaped my head due to the pre-release rush, but thinking more about this I now remember that I did bring this up with development earlier already, and they did implement the option to preserve permissions for Windows restore. But, because it was implemented very late in the release cycle, we did not have time to add it in UI. So, we decided to put this in the registry instead. I have just searched my emails and found it

Please, try to create FLRPreservePermissions key in Veeam hive of the registry, set it to 1, and let me know if it helps. If you have any issues, let me know and I will check with developers tomorrow (2am our time right now).

[kac_pres]

Thanks Gostev. I'll give the registry setting a go and let you know what i found out.

[kac_pres]

Gostev,
That registry setting worked out perfectly. Fantastic!

[Gostev]

Hi Kendrick, thanks for confirming, I will make sure that we put this into UI as a checkbox with the next update.

[cdickerson]

Has this made it to the gui yet? I see a note in the guide about this option for Linux but nothing about Windows.

[Vitaliy S.]

No, preserving permissions for Windows guests hasn't made it to the GUI yet.

[cdickerson]

Will be in v6?

[howesh]

Can you give more information on where to create FLRPreservePermissions key in Veeam hive of the registry? Is it right under veeam in the Software key or is it the one under Wow6432Node? When you set the value to 1 is it a string value or D-word? Thanks.

[Alexey D.]

Harry, the path is (no need to deal with Wow6432Node)

Code: Select all

HKLM\SOFTWARE\VeeaM\Veeam Backup and Replication\

The value type is REG_DWORD. Thanks!

[Gostev]

Will be in v6?

Yes

[digitlman]

[merged]

Hello,

In my test lab, I have my virtual file server. It is a 2008 R2 box with 2 disks - one for the OS, and one for the user files. I am making a Veeam of the whole thing from the Veeam backup server, which is a physical box running outside the lab environment.

When running a test FLR on the box outside the environment, I have no problems pulling up the vm and looking at all the files. However, when I do a "copy to" the desktop of the Veeam server, it doesn't give the file the original permissions.

Do I need to do a test backup and restore in the lab environment for the correct permissions to be retained?

I am looking for Veeam to replace Backup Exec for file-level restores, and retaining of permissions is critical.

[kratos31]

[merged]

Hi,

I am in the process of doing a file server migration.
I want to shut down the existing file server, back it up and restore the data onto the new one.

Can you tell me if the Veeam will preserve the NTFS permissions etc?

Thanks

[gshaw]

[merged]

Just been testing file restores which are working fine but just a quick query...

When restoring through the wizard the recovery method uses copy, which I'd guess will put permissions on the file as the same as the location of where the file is restored to. Is there any way to keep the original permissions on the files (also not sure how the copy affects ownership of restored files as well?)

[gshaw]

Does the reg key apply straight away or do you have to restart services for it to take effect? I'm guessing it will take effect as a global setting and all Copy actions will retain the original ACLs until the key gets switched back (if I ever needed to do that)

[Gostev]

This one should work right away.