Change OU of fsx for windows file server

Hello there,

I understand that you want to change the OU of your Fsx for windows file server which is associated with the self-managed AD.

➜ It's mentioned in our documentation that "Do not move computer objects that Amazon FSx creates in the OU after your file system is created. Doing so will cause your file system to become misconfigured". Please refer the below document.

[+] Best practices for joining FSx for Windows File Server file systems to a self-managed Microsoft Active Directory domain - Delegating privileges to your Amazon FSx service account - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-managed-AD-best-practices.html#connect_delegate_privileges

➜ Unfortunately changing the OU is not directly supported, but there are ways you can look into to migrate/move to a new OU. I have given more context around this below along with links to documentation, which you may be already aware of -

1. You can only perform limited amount of direct AD-related modifications on the existing FSx, which is service account credentials and DNS servers. These are documented here - [+] https://docs.aws.amazon.com/fsx/latest/WindowsGuide/update-self-ad-config.html

Based on the AD configuration you provide for the FSx and the service account you have setup, FSx creates objects and configurations in the AD to ensure proper functionality. Performing direct modifications to FSx and its objects hence cannot be done due to the many dependencies, and doing so may cause the FSx to be permanently be misconfigured. There is no guarantee on our ability to recover a file system should you delete, rename, or move a computer object that Amazon FSx created in an OU. The file system will continue to work if the computer object is moved to another OU, however, when Amazon FSx applied maintenance on the file system, it will transition into a Misconfigured state and you will not be able to access your file systems until the objects are moved back to the correct OU. Amazon FSx only looks into the OU that was specified on file system create as we do not scan your entire Active Directory.

2. If you wish to move the FSx to a new OU, the recommended and fastest way is to restore a backup of the existing FSx into a new FSx. Then you can provide the new AD configuration for the new FSx. This is also a way to fix misconfigured FSx file systems.

To restore a manual or automatic backup into a new FSx, you can use this FSx documentation section - [+] Restoring backups - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/using-backups.html#restoring-backups

You can also use the AD validation process to ensure your new FSx will be joined properly to AD - [+] Validating your Active Directory configuration - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/validate-ad-config.html

3. Another manual workaround in this situation would be to create a fresh new FSx in the correct new OU, and migrate the data - [+] Migrating existing file storage to FSx for Windows File Server - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/migrate-files-fsx.html

Here are some other relevant aspects :

• As I mentioned before, it is also extremely important that you do not move computer objects that Amazon FSx creates in the OU after your file system is created. Doing so will cause your file system to become misconfigured.

• Please also note that the FSx service account also needs to, at a minimum, be delegated the following permissions in the OU that you're joining the file system to. To learn more about creating a service account with the correct permissions, see this section - [+] Delegating privileges to your Amazon FSx service account - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-managed-AD-best-practices.html#connect_delegate_privileges

• For detailed guidance and recommendations on use of FSx with self-managed AD, please refer the topics in this FSx guide - [+] Using Amazon FSx with your self-managed Microsoft Active Directory - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/self-managed-AD.html

• Troubleshooting common reasons for misconfigured FSx could also be useful, in case you run into any issues - [+] File system is in a misconfigured state - https://docs.aws.amazon.com/fsx/latest/WindowsGuide/misconfigured-ad-config.html

I hope you find the above information helpful.

Have a great day further!