I'm migrating my Web site from one Windows NT 4.0 member server to another. I have about 500 users—some based on the PDC and some local—and complex NTFS permissions. I know I can't move the metabase because it's machine specific, so how can I move my content and Web server structure to the new server?
Such a migration has a lot of considerations. Ideally, you can just image your source server and load it onto the new server. However, when changing servers, the hardware is often so different that imaging isn't an option—particularly with NT 4.0, which isn't really Plug and Play (PnP). So as you say, you're left with migrating to another server.
Unfortunately, moving from member server to member server isn't that easy. The domain-based users aren't a problem: The new servers can just join the domain, and NTFS permissions will still apply for those users. Local users are another matter.
Let's say, for example, that you have default.htm and a user called George who has NTFS Read permission on the source server. You create a local user account on server B, then use a tool such as Robocopy or Scopy from the Microsoft Windows NT Server 4.0 Resource Kit to copy default.htm along with NTFS permissions. George starts to use the new server but is denied access. Why? Because the accounts named George each have a unique SID, and NTFS permissions only marginally consider the username. The NTFS permissions, which are stored in the ACL, contain the SID of the George account. Thus, when you migrate the NTFS permissions that refer to SIDs from the source server to the target server, the SIDs used in the migrated NTFS permissions don't exist on the target server and so are basically worthless.
Sunbelt Software's Secure Copy is the only tool I know that can migrate NTFS permissions based on username and not SID. If a user has NTFS permissions on the source server, Secure Copy locates or creates that user on the target server, then uses the new SID to assign the NTFS permissions.
I recommend that you use MetaEdit 2.1 (not MetaEdit 2.0—see the Microsoft article "Second Hex Character Overwrites First When You Modify a Binary Value with MetaEdit 2.0" at http://support.microsoft.com/support/kb/articles/q258/1/37.asp for why you need MetaEdit 2.1) to export the IIS metabase to the new server. (To download the most recent version of MetaEdit, go to http://download.microsoft.com/download/iis40/other/4.0/win98/en-us/mtaedt21.exe.) The IIS Export Utility is another excellent tool that is quite useful in these scenarios. You can download the IIS Export Utility from http://www.adsonline.co.uk/iisexport.
