Drupal 8 - Migrate from public to private files

# Enable maintanance mode
drush state-set system.maintenance_mode 1

# Backup file field data
drush sql-query "CREATE TABLE media__field_file_bak AS SELECT * FROM media__field_file;"
drush sql-query "CREATE TABLE media_revision__field_file_bak AS SELECT * FROM media_revision__field_file;"

# Truncate file field tables (need to change storage settings)
drush sql-query "TRUNCATE media__field_file;"
drush sql-query "TRUNCATE media_revision__field_file;"

# Set global file system (/admin/config/media/file-system)
drush config-set system.file default_scheme private -y

# Set config for ckeditor embed button (/admin/config/content/embed/settings)
drush config-set embed.settings file_scheme private -y

# Set image plugin for ckeditor (/admin/config/content/formats/manage)
drush config-set editor.editor.basic_html image_upload.scheme private -y
drush config-set editor.editor.basic_html image_upload.directory media/inline-images -y
drush config-set editor.editor.full_html image_upload.scheme private -y
drush config-set editor.editor.full_html image_upload.directory media/inline-images -y

# Set content/media fields
drush config-set field.storage.media.field_file settings.uri_scheme private -y
drush config-set field.field.media.document.field_file settings.file_directory 'media/[date:custom:Y]-[date:custom:m]' -y
drush config-set field.field.media.presentation.field_file settings.file_directory 'media/presentation/[date:custom:Y]-[date:custom:m]' -y

# Set user picture
drush config-set field.storage.user.user_picture settings.uri_scheme private -y
drush config-set field.field.user.user.user_picture settings.file_directory 'media/pictures/[date:custom:Y]-[date:custom:m]' -y

# Set entity browsers widgets (/admin/config/content/entity_browser)
drush config-set entity_browser.browser.browser_for_files_modal widgets.cda30343-dea8-44e0-8548-0c1cd70ccb49.settings.upload_location 'private://media/[date:custom:Y]-[date:custom:m]' -y
drush config-set entity_browser.browser.browse_files widgets.735d146c-a4b2-4327-a057-d109e0905e05.settings.upload_location 'private://media/[date:custom:Y]-[date:custom:m]' -y

# Create the private path
mkdir ../private/media

# Move the files (and enable the !(...) stuff first with)
shopt -s extglob
mv sites/default/files/!(.|..|color|css|js|php|styles|.htaccess) ../private/media/

# Restore the file field tables
drush sql-query "INSERT INTO media__field_file SELECT * FROM media__field_file_bak;"
drush sql-query "INSERT INTO media_revision__field_file SELECT * FROM media_revision__field_file_bak;"

# Update the file paths
drush sql-query "UPDATE file_managed SET uri=REPLACE(uri,'public://','private://media/') WHERE uri LIKE 'public://%';"

# Drop file field table backups
drush sql-query "DROP TABLE media__field_file_bak, media_revision__field_file_bak;"

# Rebuild the cache
drush cr

# Disable maintanance mode
drush state-set system.maintenance_mode 0

https://gist.github.com/jleehr/7ac2a5de785881dfce99f7034547f07b