Home Folder Shares

[Gatt]

In the process of creating new AD structure for next year, and reviewing the home folder structure we have at present

currently it is \\file-server\pupils\year xx\%username%
where pupils is the share name

But this is causing some problems with permissions (some kids have found they can hit this directory and view its contents)

Is it possible to stop them viewing the contents of pupils and also the year xx folders, but still have the appropriate rights to their own folder?

Or would it be easier to share their actual home folder itself?

[pete]

We do it as \\server\users\year\username$, where username$ is the share name.

The blind share can lead to issues with scripting if you don't escape the "$" properly, but apart from that - not a problem.

[plexer]

We share the users actual folder as well as a hidden share.

Prevents the problems you've seen I have

users\students\00\%username%$

I also share the 00 folder so that staff can have a shortcut to it to navigate down to a students home folder.

Ben

[ChrisH]

Putting a "$" on the root share seems to sort this problem for me. The only permissions they have are for their own folders so if they tried \\fileserver\pupil$ they would get access denied.

[Geoff]

Putting a "$" on the root share seems to sort this problem for me. The only permissions they have are for their own folders so if they tried \\fileserver\pupil$ they would get access denied.

This is the best solution. IIRC it's even the recommended method as per the MS documentation/courses.

As an aside, it also makes using pam_mount dead easy on Linux if you want to use Linux desktops and keep the file areas seamless.

Yep same here.

\\Servername\users$ root share

\\Servername\username$ users home folder

[Gatt]

Cheers folks, that's pretty much how im gonna go now

[Ric_]

@Gatt: I use the same folder structure. I have a script that you can run over the same folders and it will sort the permissions and ownership. If they do browse the share, they can only see a list of folders and they cannot get into them.

If you want the script, PM me next week - I will definately forget about it by Tuesday!

[ChrisH]

If forgot about this as well which I posted a while back.

http://edugeek.net/index.php?name=Do...details&lid=16

[PiqueABoo]

Doesn't really matter if your NTFS permission are right, but I don't really see much point in making share hidden when their names are predictable.

[Ric_]

@PiqueABoo: Hence the script that I use

[ITWombat]

Doesn't really matter if your NTFS permission are right, but I don't really see much point in making share hidden when their names are predictable.

and *nix browsers (MacOS X and Linux) ignore the $ anway .

Does having a share per folder have performance hit?

[Frazer]

I set ours up like this for last years 'year 7':

\\server\users\2005intake\%username%

Users shares permissions are: everyone full access
Users folder permissions are: domain admins full access only
2005intake folder permissions: domain admins full access only
%username% is autocreated when you make the account, giving the user full access and permissions filterting down from users\intake to give domain admins full access.

This stops them snooping around your user folders and also stops them saving random files to the users\intake folder instead of their homedir.

[Quackers]

I set ours up like this for last years 'year 7':

\\server\users\2005intake\%username%

Users shares permissions are: everyone full access
Users folder permissions are: domain admins full access only
2005intake folder permissions: domain admins full access only
%username% is autocreated when you make the account, giving the user full access and permissions filterting down from users\intake to give domain admins full access.

This stops them snooping around your user folders and also stops them saving random files to the users\intake folder instead of their homedir.

Thats how i do my Home Directorys, i do not see the point in having a share for each user. Its very clean and quick doing this way.

[Gatt]

I set ours up like this for last years 'year 7':

\\server\users\2005intake\%username%

Users shares permissions are: everyone full access
Users folder permissions are: domain admins full access only
2005intake folder permissions: domain admins full access only
%username% is autocreated when you make the account, giving the user full access and permissions filterting down from users\intake to give domain admins full access.

This stops them snooping around your user folders and also stops them saving random files to the users\intake folder instead of their homedir.

Thats how i do my Home Directorys, i do not see the point in having a share for each user. Its very clean and quick doing this way.

Think i'll give this a go as my File Server is overworked as it is - last thing i need is 1200+ shares running off it

just need to setup LimitLogon too so the little darlings cant log in multiple times