Server 2003 shadow copy access denied due to insufficient file permissions

3400

I had a situation today where I needed to restore some files via shadow copy from a server that had already been demoted from its domain.

The folder in question was only accessible by a handful of domain users, and because it was no longer joined to the domain, I could not access the folder from shadow copy at all and was receiving a shadow copy access denied error.

I then found out that you cannot take ownership of a file from within previous versions tab – as it is all read only.

Neither can you copy the data and then take ownership of it, because windows will not copy folders that it does not have permissions for.

I eventually came across a great post where someone had previously got around this issue:

http://blog.shiraj.com/2014/01/959/

Basically the steps to take were as follows:

1.Install robocopy which is available as part of the 2003 resource kit, available here:

http://www.microsoft.com/en-gb/download/details.aspx?id=17657

Then download DosDev from here:

http://vscsc.sourceforge.net/

DosDev allows you to mount a volume shadow copy as follows (From CMD):

vssadmin list shadows (this lists available shadow copies – find the Shadow Copy Volume of the one you want to restore from.

dosdev v: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy59

This mounts the shadow copy to V: (replace the above with the correct shadow copy volume name in your situation). Note that the mounted V drive is only available from Dos prompt, not from windows GUI.

Now you can copy the folder from within that mount, to a place of your choosing, using robocopy and the following command:

robocopy.exe “v:\path\to\data” c:\localcopypath\ /S /E /COPYALL /ZB /NP /R:1 /W:1 /LOG:”c:\logfile.txt”

Note that I also had to be in the resource kit folder before hand (C:\Program Files\Windows Resource Kits\Tools\).

The above copied the folder over that I needed, although I could not access it still. Then it was simply a case of taking full ownership of the folder, and then assigning the correct permissions, using the security tab in teh folder properties.

· · ·

Comments are closed.