NTFRS with Referrals Disabled on all Link Targets - Viable?

I'm cleaning up a configuration from another admin and wanted to see
if anybody knew of any issues with the setup I have planned.

First, the requirements I've been given:
1) Application requires replication of files from 1 source server
to 3 remote destination servers with no replication back to the source
server
2) User access to the data via browsing DFS should be avoided
although we can't currently lock down NTFS and share rights (don't ask
- I'm already boiling on that point)
3) Company only allows one domain-based DFS tree per domain which
is already in use extensively
4) All servers involved are Windows Server 2003 SP2

The previous admin configured a normal NTFRS hub-and-spoke replica set
for a DFS link just off the root of the DFS tree.

My plan:
1) Disable replication links from the spoke servers back to the
hub to enable one-way replication (and yes, we are VERY well aware of
the issues here as we already use two other replica sets in the same
configuration)
2) Disable DFS referrals on all link targets in the replica set
3) Fight like !@#$% to get the shares/NTFS locked down

I know disabling referrals for some link targets in a replica set
isn't a problem, but was more concerned if there are any problems with
having referrals disabled on all link targets in a replica set (other
than the obvious lack of access via DFS that I'm actually looking for
in this case).

DFSR does not use DFS referrals. It replicates the underlying NTFS folders. The
setup wizard offers to create replication as for a pair of referrals as a help.
There is nothing to stop you setting up DFRS replication without and DFS name
space even existing.

On Thu, 31 Jul 2008 22:35:09 -0500, Andy Martin <>
wrote:

>I'm cleaning up a configuration from another admin and wanted to see
>if anybody knew of any issues with the setup I have planned.
>
>First, the requirements I've been given:
>1) Application requires replication of files from 1 source server
>to 3 remote destination servers with no replication back to the source
>server
>2) User access to the data via browsing DFS should be avoided
>although we can't currently lock down NTFS and share rights (don't ask
>- I'm already boiling on that point)
>3) Company only allows one domain-based DFS tree per domain which
>is already in use extensively
>4) All servers involved are Windows Server 2003 SP2
>
>The previous admin configured a normal NTFRS hub-and-spoke replica set
>for a DFS link just off the root of the DFS tree.
>
>My plan:
>1) Disable replication links from the spoke servers back to the
>hub to enable one-way replication (and yes, we are VERY well aware of
>the issues here as we already use two other replica sets in the same
>configuration)
>2) Disable DFS referrals on all link targets in the replica set
>3) Fight like !@#$% to get the shares/NTFS locked down
>
>I know disabling referrals for some link targets in a replica set
>isn't a problem, but was more concerned if there are any problems with
>having referrals disabled on all link targets in a replica set (other
>than the obvious lack of access via DFS that I'm actually looking for
>in this case).
--
Dave Mills
There are 10 type of people, those that understand binary and those that don't.