Introduction to File Server with DFS Namespaces on Windows Server 2019

Configuring a File Server with DFS Namespaces (DFSN) on Windows Server 2019 combines a traditional SMB file server with a virtualised namespace layer that gives users a single consistent UNC path regardless of where the files physically reside. This is particularly powerful in multi-site organisations where files may live on different servers in different locations, but users access them through a single path like \contoso.comfilesDepartment.

DFS Namespaces make it easy to migrate data between servers, add storage capacity transparently, and provide redundancy by pointing a single folder target to multiple server shares simultaneously. When combined with DFS Replication, namespace targets stay synchronised, giving users automatic failover if one server becomes unavailable.

Installing File Server and DFS Namespaces

Install the File Server role service and DFS Namespaces on the server that will host the namespace:

Install-WindowsFeature -Name FS-FileServer, FS-DFS-Namespace -IncludeManagementTools

Verify the services are running:

Get-Service -Name "DFS"

The DFS Namespace service (Dfs) should be running. Also ensure the Server service is running for SMB shares:

Get-Service -Name LanmanServer

Creating the SMB Shares

Before creating DFS namespace folders, create the underlying SMB shares that the DFS targets will point to. Create the folders and shares on the file server:

$departments = @("Finance","HR","IT","Marketing","Operations")
foreach ($dept in $departments) {
    New-Item -Path "D:FileServer$dept" -ItemType Directory -Force
    New-SmbShare -Name $dept -Path "D:FileServer$dept" -FullAccess "Everyone" -Description "$dept Department Files"
}

Apply appropriate NTFS permissions to each department folder. For example, for the Finance folder:

$acl = Get-Acl "D:FileServerFinance"
$acl.SetAccessRuleProtection($true, $false)
$adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule("BUILTINAdministrators","FullControl","ContainerInherit,ObjectInherit","None","Allow")
$financeRule = New-Object System.Security.AccessControl.FileSystemAccessRule("CONTOSOFinance Staff","Modify","ContainerInherit,ObjectInherit","None","Allow")
$acl.SetAccessRule($adminRule)
$acl.SetAccessRule($financeRule)
Set-Acl "D:FileServerFinance" $acl

Creating a Domain-Based DFS Namespace

Create the domain-based namespace root. The namespace root is the top-level DFS path. The share name specified here will be the namespace name:

# Create the physical share for the namespace root
New-Item -Path "D:DFSRootsFiles" -ItemType Directory -Force
New-SmbShare -Name "DFSRoot" -Path "D:DFSRootsFiles" -FullAccess "Everyone"

# Create the DFS namespace
New-DfsnRoot -Path "\contoso.comfiles" -TargetPath "\FileServer01DFSRoot" -Type DomainV2 -Description "Corporate File Namespace"

This creates the namespace \contoso.comfiles that clients will use to access all files.

Adding DFS Folder Targets

Add each department’s share as a folder under the namespace:

$departments = @("Finance","HR","IT","Marketing","Operations")
foreach ($dept in $departments) {
    New-DfsnFolder -Path "\contoso.comfiles$dept" -TargetPath "\FileServer01$dept" -Description "$dept Department"
}

Users can now access \contoso.comfilesFinance and be transparently redirected to \FileServer01Finance. To add a second target for the Finance folder on another server (for redundancy or load distribution):

New-DfsnFolderTarget -Path "\contoso.comfilesFinance" -TargetPath "\FileServer02Finance"

Configuring Target Referral Ordering

Control which target users are directed to first. The ReferralPriorityClass determines ordering:

# Set FileServer01 as the lowest-cost (preferred) target for Finance
Set-DfsnFolderTarget -Path "\contoso.comfilesFinance" -TargetPath "\FileServer01Finance" -ReferralPriorityClass SiteCostLow

# Set FileServer02 as a fallback
Set-DfsnFolderTarget -Path "\contoso.comfilesFinance" -TargetPath "\FileServer02Finance" -ReferralPriorityClass SiteCostHigh

DFS uses Active Directory Sites to determine which target is closest to a client. Ensure your AD Sites and Subnets are configured correctly for site-costing to work properly.

Enabling Access-Based Enumeration

Enable Access-Based Enumeration (ABE) on the namespace so users only see folders they have permission to access:

Set-DfsnRoot -Path "\contoso.comfiles" -EnableAccessBasedEnumeration $true

Also enable ABE on individual SMB shares:

Set-SmbShare -Name "Finance" -FolderEnumerationMode AccessBased

Verifying and Testing the Namespace

List all folders in the namespace:

Get-DfsnFolder -Path "\contoso.comfiles*"

View all targets for a specific folder:

Get-DfsnFolderTarget -Path "\contoso.comfilesFinance"

Test namespace resolution from a client or from the server:

dfsutil /pktinfo
dfsutil /root:\contoso.comfiles /view

From a client, test access via the namespace path:

Test-Path "\contoso.comfilesFinance"
Get-ChildItem "\contoso.comfilesFinance"

DFS Namespaces provide a resilient, scalable, and user-friendly access layer for file shares in Windows Server 2019 environments, simplifying server migrations and storage expansion with no impact to users.