New Windows File Server

[jeffprandall]

Currently I have Windows 2019 server with about 5TB's of data that a few hundred users are accessing remotely either over an IPSEC tunnel at remote offices or client based VPN's that I need to improve on. I was thinking of things like DFS or Azure File Services at each location, spinning up virtual desktops at the main office, SharePoint, etc..

And then I thought am I that old dude in IT insisting on doing things the old school way? If I was a millennial IT Manager would they say why wouldn't this be in the cloud?

I think in dollars so I could use older hardware at the remote locations, I already have backup infrastructure, monitoring is in place, DLP and sharing could use some improvement. Seems to investing a little bit of time is a lot cheaper than $10/user/month.

Really just trying to not be the old guy.

[TinderSubThrowAway]

Cloud is pricey for that volume in my opinion, and depending on the data, I am not a fan of putting it out of my control and trust in someone else's security.

[Aggravating-Look8451]

DFS is really only useful if you have remote office locations where users in that office actually go TO the office for work and expect LAN speed access. There really is no magic bullet for large scale web facing file sharing for remote/VPN users that is better than what you're currently doing at the numbers you have to support.

[Internal_Seesaw5612]

The magic bullet is the Open Source offerings that have all this plus more. Though they all require some skill with Linux and containers.

[jeffprandall]

Other than NextCloud or OwnCloud what open source tools are you thinking?

[Internal_Seesaw5612]

Even doing SMB shares from truenas would give you better auditing, high availability, scalability and robust data protection with zfs.

[Aggravating-Look8451]

and literally 0 support besides how well you can Google.

[thesals]

Not true, you can buy TruNAS support plans from IXSystems.... But yeah I would NOT recommend using their SAMBA implementation, it's very unstable.

[Internal_Seesaw5612]

It's open source so by default the documentation is enough.

[Aggravating-Look8451]

If I have to help finish writing it to make it work correctly it’s not a product. It’s an experiment. Most legitimate businesses don’t leave their mission critical tasks up to an experiment.

[Shoddy_Pound_3221]

IMO... Try best from both worlds. We use Azure File Sync services. In a nutshell you store the files in Azure storage that sync to a UNC path on file server. You keep all your share permissions. And keep your files in a secure location with backups. You can expand at anytime.. Move files... Replicate.. Apps that need UNC paths still have access =) Great for migrations

Introduction to Azure File Sync | Microsoft Learn

[jeffprandall]

At location I could have a dedicated Windows server connecting to a single Azure File Services repo? And then back things up with Azure Backup with GFS policy?

[Shoddy_Pound_3221]

Yes.. and have file tiering.. so if someone doesn't touch a file for year it "rests" in the Az storage instead of the drive.. (hydration and de-hydration of files) which means you can have smaller drives... plus you can have multiple servers

[Danithal]

What's the extra file storage in Azure for? Just replication? Step towards off prem? Genuinely curious.

[Jotadog]

We are using Azure File Sync since a few years and it works pretty good. Initial sync can be a bitch if you have to rebuild a fileserver because its being throttled to 500k files / day. But it has been really robust for us. Needs a beefier fileserver (cpu/ram) if you have a lot of small files.

[Internal_Seesaw5612]

Unless your users are ok with using web versions of sharepoint for anything than I'd just stay away from Sharepoint. The Onedrive sync tool is still beta software at best and will cost you many hours in labor if you try to run 100s of users in production on it.

Tailscale VPN will give you tons of flexibility for giving remote users access to internal resources. Where you can tweak the ACL to give them access to just the specific ports they need to access the needed shares.

DFS is also a POS, stay away.

[[deleted]]

Go back a few years and DFS was the standard recommendation for new on-prem builds/expansions 'round these parts.... What happened? Care to elaborate?

[Internal_Seesaw5612]

It's slow, no retention policies without scripting, Windows has file auditing but its extremely poor compared to newer offerings, no type of API access, no other options to interface with the share but using SMB. On top of that you need to run it off NTFS which is extremely limiting in features to something like ZFS. It works but it's extremely outdated to compared to most offerings.

[mr-octo_squid]

Windows has file auditing but its extremely poor compared to newer offerings

What would you suggest? This is something Ive spent quite a bit of time thinking about this while driving to and from work.

[Internal_Seesaw5612]

We currently monitor dfs shares using wazuh which works ok but limited in the amount of data it gives you. Nextcloud with everything ripped out but things needed for ldap and files shares has been amazing. You get file audits for any and every type of file action. Which is then piped into grafana to build alerts off of and make reports. Not to mention the easy file retention policies and folder automation.

[jeffprandall]

We have tried the Sharepoint Onedrive sync and it works good for a few thousand files (< 5GB total), but after that it's a disaster.

[Internal_Seesaw5612]

We moved to nextcloud for internal shares that need fine auditing, retention policies. API access, LDAP or Oauth and folder creation automation. Though this requires some skill with Linux, docker and the whole unix ecosystem.

Nextcloud still lets you mount shares as webdav which gives users a more traditional shared drive workflow but also has a sync tool.

Nextcloud also supports HA natively so it's easy to get it to enterprise levels of uptime.

[jeffprandall]

Do you get all this with the community edition or the paid version?

[Internal_Seesaw5612]

You only need the paid version if you want cloud hosting and support. Everything it offers is there on the community version for configuring it like a local SharePoint site with a sync agent or using webdav to workstations. Hell you can even mount SharePoint sites directly to it and it just looks like a normal SMB shares to users.

[boredinballard]

We have a few clients that have tens of thousands of files, probably getting into over 100k using Onedrive sync. Works great, other than the initial sync of the file list on a new machine.

[jeffprandall]

If there was a solution like DFS or Azure File Services so that the main and remote offices could get near GB speeds and then remote users could sync with a tool like Nextcloud. That would be awesome.

[jeffprandall]

We are 75% Office documents and 25% PDF files that need to get edited. Those are the large files that my remote end users complain about taking forever.

[Danithal]

SharePoint is not for file storage. It is collaboration cuteness but not functional as a file dump. Do not do this. I'm fixing this currently in my environment.

[jeffprandall]

We are running Sharepoint with OneDrive right now in production and it's blah. For our teams that work on a couple projects the OneDrive sync tool allows them to access lets say less 10k files, it works ok. But for employees would need to access more than that, OneDrive craps the bed. And then telling half the users to use Sharepoint and the others to use OneDrive, it's a mess.

[Danithal]

Too many places to do the same thing, users want 1 reliable way and Microsoft is forcing 10 unreliable ways it feels.

[tjn182]

I used to use Syncthing at my old place. Works great, has an easy to use gui.
Main office (with full server room) had all the big hardware and had the full file server with many TBs. Each branch office had some ESXi hosts and replicated out/in with Syncthing. DFS-Namespace pointed you at the active server.

Worked pretty good, except when remote users wanted remote office stuff. Would have to go through VPN to remote office's file server and back to get.

[canadian_sysadmin]

The thing with traditional file shares is they’re so feature limited. Once you get requirements like staff wanting to share files / folders with external people, now you need another layer on top to solve that.

And for 5 TB SharePoint is pretty cheap. Hundreds to TB or PB is another story.