Moving files between servers shouldn’t feel like walking through a minefield. Yet many IT professionals face this challenge daily when migrating data while keeping permissions intact. This guide shows you exactly how to use Robocopy to copy files with all their permissions and attributes preserved.

What Is Robocopy and Why Use It for File Copying?

Robocopy stands for “Robust File Copy.” It’s a powerful command-line tool built into Windows that goes far beyond what regular copy and paste can do. Unlike basic file copying methods, Robocopy can preserve every detail about your files, including who has access to them and how they’re configured.

Think of Robocopy as a professional moving company for your data. Where regular copying is like throwing everything in boxes, Robocopy carefully documents and preserves every permission, timestamp, and attribute attached to your files.

The Essential Robocopy Command for Copying Files with Permissions

Here’s the command that solves most permission copying needs:

robocopy "C:\source\path" "C:\destination\path" /E /COPYALL /R:5 /W:5

Let me break down what each part does:

Understanding the Basic Switches

/E copies all subdirectories, including empty ones. This ensures your entire folder structure moves exactly as it is.

/COPYALL is your permission powerhouse. It copies everything about your files: the data itself, attributes, timestamps, NTFS security permissions, owner information, and auditing details.

/R:5 sets retry attempts to 5 times instead of the default one million attempts. This keeps your copying process moving instead of getting stuck on locked files.

/W:5 makes Robocopy wait only 5 seconds between retries instead of the default 30 seconds.

The Complete Permission Copying Command Explained

When you need to copy files with full permissions during a server migration, use this enhanced command:

robocopy "C:\source" "\\server\destination" /E /Z /COPY:DATSOU /R:5 /W:5 /MT:8 /LOG:"C:\robocopy-log.txt"

What Each Switch Does for Your Data

/Z enables restartable mode. If your network connection drops or the copy process gets interrupted, Robocopy can pick up where it left off instead of starting over.

/COPY:DATSOU specifies exactly what to copy:

• D = Data (the actual file content)
• A = Attributes (hidden, read-only, system flags)
• T = Timestamps (when files were created and modified)
• S = Security (NTFS permissions and ACLs)
• O = Owner information (who owns the file)
• U = Auditing information (security audit settings)

/MT:8 uses 8 threads to copy multiple files simultaneously, dramatically speeding up the process for large data sets.

/LOG creates a detailed log file showing exactly what was copied, what failed, and why.

Copying Only Security Permissions Without File Data

Sometimes you don’t need to copy files again. You just need to update their permissions. This happens when you’ve already copied the data but permissions have changed on the source.

Use this two-step approach:

Step 1: Copy changed files with their security

robocopy C:\source D:\destination /MIR /SEC

Step 2: Update security on unchanged files

robocopy C:\source D:\destination /E /COPY:S /IS /IT

The /IS switch includes files that are the same on both sides, and /IT includes tweaked files that normally get skipped.

The SECFIX Switch: Your Permission Update Tool

For Windows Vista and later systems, Microsoft added a simpler way to keep permissions synchronized:

robocopy C:\source D:\destination /MIR /SEC /SECFIX

The /SECFIX switch tells Robocopy to update security information on files that already exist but haven’t changed. This means you can run one command instead of two when keeping folder trees synchronized.

Copying Directory Permissions with DCOPY

Files aren’t the only things with permissions. Folders have them too. The /DCOPY switch handles directory security:

robocopy C:\source D:\destination /E /COPYALL /DCOPY:DATS

/DCOPY:DATS copies directory data, attributes, timestamps, and security. Without this, your folders might inherit permissions from their new parent directory instead of keeping their original settings.

Common Robocopy Permission Problems and Solutions

Problem 1: Access Denied Errors

When you see “Access is denied” messages, Robocopy doesn’t have sufficient rights to copy the files or their security information.

Solution: Run your command prompt as administrator. Right-click Command Prompt and select “Run as administrator.” For backup scenarios, add the /B switch to enable backup mode, which bypasses some permission restrictions.

Problem 2: Inherited Permissions Not Copying

Robocopy sometimes struggles with inherited permissions versus explicit permissions on files.

Solution: Check whether permissions are set directly on files or inherited from parent folders. You may need to first remove the destination files completely so permissions can be copied fresh, rather than trying to overwrite existing permissions.

Problem 3: Folder Permissions Update But File Permissions Don’t

This happens with older versions of Robocopy because it was designed to skip unchanged files for performance reasons.

Solution: Use the /SECFIX switch if you’re on Windows Vista or later. For older systems, run the two-step command shown earlier to update file permissions separately.

Speed Optimization Tips for Large File Copies

Copying terabytes of data takes time. Here’s how to make it faster:

Use Multiple Threads

Add /MT:16 or /MT:32 to use more simultaneous copy threads. Modern servers can handle 16-32 threads effectively.

Run Robocopy Locally

Never run Robocopy from your desktop computer while pointing to two network shares. Instead, remote desktop into one of the servers and run Robocopy there. This eliminates one network hop and can triple your speed.

Use the Mirror Strategy

The first copy will take hours. But subsequent copies will be much faster because Robocopy only copies what changed. Run your Robocopy command multiple times before the final cutover:

robocopy C:\source D:\destination /MIR /SEC /SECFIX

Each run after the first will be progressively faster, making your final cutover window much smaller.

Essential Robocopy Switches Reference Guide

Here’s a quick reference for the most important switches:

For copying everything:

• /E = All subdirectories including empty ones
• /COPYALL = All file information (equivalent to /COPY:DATSOU)
• /DCOPY:DATS = Directory data, attributes, timestamps, and security

For permissions:

• /SEC = Copy files with security (NTFS ACLs)
• /SECFIX = Fix security on existing destination files
• /COPY:DATSOU = Specify exactly what to copy

For reliability:

• /R:5 = Retry 5 times on failures
• /W:5 = Wait 5 seconds between retries
• /Z = Restartable mode for interrupted copies
• /B = Backup mode to override some permission restrictions

For performance:

• /MT:8 = Use 8 threads (adjust based on your hardware)
• /NFL = No file listing (reduces log size)
• /NDL = No directory listing

For mirroring:

• /MIR = Mirror source to destination (copies and deletes)
• /XO = Exclude older files (useful for incremental backups)

Real-World Migration Example: File Server to File Server

Here’s a complete example for migrating from an old Windows Server 2012 to a new Windows Server 2022:

robocopy "\\OldServer\ShareName" "\\NewServer\ShareName" /E /Z /COPYALL /DCOPY:DATS /R:3 /W:5 /MT:16 /LOG:"C:\Migration-Log.txt" /TEE

The /TEE switch displays output to the console while also writing to the log file, so you can monitor progress in real-time.

Verifying Your Copied Permissions

After copying, verify that permissions transferred correctly. Use PowerShell to compare:

Get-ACL "C:\source\folder" | Format-List
Get-ACL "D:\destination\folder" | Format-List

Compare the outputs to ensure security descriptors match.

When Robocopy Isn’t Enough

Robocopy has limitations in certain scenarios:

Local accounts in permissions: If your source files have permissions for local user accounts, those won’t translate properly to the destination server. You’ll need to use Active Directory groups instead.

Open and locked files: Robocopy cannot copy files that are currently in use. For this, you need Volume Shadow Copy service or third-party tools.

Cross-forest migrations: Moving files between different Active Directory forests requires special handling because security identifiers (SIDs) differ.

Best Practices for Using Robocopy with Permissions

Follow these practices to avoid common pitfalls:

Always test first. Run your Robocopy command on a small test folder before attempting your full migration.

Create logs. Always use the /LOG switch so you can review what happened, especially if something goes wrong.

Run multiple passes. Don’t try to do everything in one shot. Run Robocopy several times to get most of the data copied, then do a final pass during your maintenance window.

Document your command. Save your Robocopy command to a text file with notes about what each switch does. You’ll thank yourself later.

Check for errors. Review the log file after completion. Look for “Access denied” or “Error” messages that indicate files weren’t copied properly.

Conclusion: Mastering Robocopy for Permission Preservation

Robocopy transforms complex file migrations from nightmare scenarios into manageable tasks. The key is understanding which switches preserve what information and combining them appropriately for your specific needs.

Start with /E /COPYALL /DCOPY:DATS as your foundation. Add /SECFIX for permission updates, /MT for speed, and /Z for reliability on network copies. Test your command on small data sets first, then scale up with confidence.

Remember that Robocopy is a tool that rewards patience and planning. Multiple smaller runs beat one massive attempt, and a good log file is your best friend when troubleshooting.

With these techniques in your toolkit, you can migrate file servers, maintain backup archives, and synchronize data across systems while keeping every permission and attribute exactly where it belongs.