How do you do user shares?

[sidewinder]

Basic question, do you have one share for each user (as we do currently), or one share per staff type/year group etc and then map to a subdirectory of the share?

And does it make any difference?

Im thinking of going the single share way due to the fact its a hassle to remember to unshare folders if they're going to be moved to another location or deleted

[ajbritton]

I have one share for all staff and one for all students.. unless I have to cope with any Win9X/ME PCs. The only problem I've noticed is that Office (might be certain versions only, I have not checked) likes to have explicit traverse access to the folders above the user folder but below the share. So if D:\User\Staff was shared as 'staff' and subfolders were individual user folders, then you would need to make sure 'Authenticated Users' have 'traverse' rights on D:\User\Staff (this folder only).

[mark]

One share - hidden - on curriculum server fo kids, another set up the same for staff on a child domain.

The advantage is like ajb says - users have no rights to browse the underlying share if you share their home folders explicitly - tho' they shouldn't be able to access any folders anyway.

[plexer]

I use one share per user.

i.e \\server\username$

Ben

[ChrisH]

With a Server 2003 system you can enable access based enumeration if you download the tool from MS to enable it. This will mean that users cant see folders they dont have permission to access so it doesnt matter if they manage to go up a lovel from their folder etc.

[Ric_]

I use the same method as AJ... in my case though, my files reside on a SAN with a virtual drive for Y7 to y11 connected to one server and a second server with staff and y12 to y13 (2 virtual drives). This way some of the load is shared when serving files.

[ajbritton]

With a Server 2003 system you can enable access based enumeration if you download the tool from MS to enable it. This will mean that users cant see folders they dont have permission to access so it doesnt matter if they manage to go up a lovel from their folder etc.

I think that's 'sot of nice', but probably more confusing than anything else. When you get a support call from a user unable to access a file/folder and they are getting 'access denied', then you know what you need to do. If you get a support call from someone saying 'I can't find....', then first of all you have to establish that they are in the right place and only then do you twig that it's a permissions issue.

Any examples of when this feature would actually benefit anyone? (bearing in mind that if all you want to do is hide a folder, it needs to be a sub-folder of a folder that those you wish to hide it from cannot read).

[ChrisH]

Its good for the example you gave in your previous post of home folders. It isnt a universal setting and can be set per volume maybe even more granular now but I can remember without looking it up.

[Ric_]

... but I can remember without looking it up.

Perhaps in the Mark Minasi book that I am now denied access to

[sidewinder]

With a Server 2003 system you can enable access based enumeration if you download the tool from MS to enable it. This will mean that users cant see folders they dont have permission to access so it doesnt matter if they manage to go up a lovel from their folder etc.

I was actually thinking of trying this as I was reading my R2 book earlier

Thought I could possibly map everyone to the same share but they'd only see their own folder

I think ABE is quite useful in that respect, but I wouldnt use it for the common area or anything or it will lead to calls like aj describes

AJ - You talk about having to set traverse rights - surely this could lead to problems as users would be able to navigate up to the root of the share and see everyones folders?

[Ric_]

AJ - You talk about having to set traverse rights - surely this could lead to problems as users would be able to navigate up to the root of the share and see everyones folders?

Surely seeing and being able to do anything with the folders are two entirely different things

[sidewinder]

AJ - You talk about having to set traverse rights - surely this could lead to problems as users would be able to navigate up to the root of the share and see everyones folders?

Surely seeing and being able to do anything with the folders are two entirely different things

Of course
They cant do anything with them but ideally Id still prefer they couldnt see them
I suppose though that would be where Id use access based enumeration

[sreiach]

I have a slightly modified approach.

My Home folder structure mirrors my AD structure.
So in AD its like this:

Students
->2005
->2006
->2007

Each year (OU) based on the students graduation year. Their user areas are the same:

\\server\Students$\2005\firstinitiallastname

So each student gets there own user area which is directly mapped to u: So students never even see another students user area.

This structure makes it easy so that at the end of the year I just delete the OU and the year folder containing the individual student folders. Easy cleanup.

I have some kids who leave before graduating but thats easy to take care of by hand or with a script.

[thom]

I also use the approach of mirroring my AD structure.
It keeps it simple for managing the access as it is all laid out the same.
I don't map drives though. I use folder redirection in group policy to create a user folder in the appropriate share.
For example, i have a server \\0Files with one share on it called \Home
In group policy i set it up like so...
if user is in STAFF group link "my documents" to \\0Files\Home\Staff\%USERNAME%\My Documents
If user is in the 2002 INTAKE group link "my documents" to \\0Files\Home\Students\2002Intake\%USERNAME%\My Documents.

The bonus of doing it this way is that it creates the folder with the correct permissions the first time a user logs in.
It was a bit buggy in 2000 but seems to work great with 2003 and XP.

[k-strider]

Doesn't having one share per user put a lot of extra work on the server? and a lot of work on you if you start moving things around...

it used to be like that when i came and it was NT4...

now everything is mapped through the DFS name space so i can move things around the servers without people noticing..

so for example
Students:
\\dfsnamespace\dfssharename\home\Yearofstudent\%us ername%
and say staff are:
\\dfsnamespace\dfssharename\home\staff\%username%
and no teaching:
\\dfsnamespace\dfssharename\officestaff\%username%

And the non teaching staff are on a different server to the students and staff

We do folder redirection using the DFS name space too.