Folder Redirection and Permission problem

[ArchersIT]

Hi there,

 

We have just started trying to use Folder Redirection for the students (we do not use roaming profiles). We have read lots on permissions and have setup the permissions as per the various KB articles but am still having a problem with permissions.

 

The main KB article we have followed is Allowing administrators access to redirected folders. This is fine, when students log in they create all the folders and we can see them etc.

 

Unfortunately if we copy a file into that area for them they do not have permission to see it. This is because the folders are auto created with

Full Control - This folder only

Creator/Owner Full Control - Subfolder and files only

 

Now, the problem is clearly ownership - if we copy files into their areas for them they do not own them. Unfortunately we often do this when a file restore is needed and we would rather not have to reset permssions each time.

 

We could get around this by creating the folders manually before they log in with

Full Control (almost!) - This folder, subfolder and files

but we kind of liked not having to do this?

 

So - what does everyone else do - do you

1. Create the directories first

or

2. Fix permissions when having to copy files in?

 

Many thanks

 

Jonathan

[marco84]

maybe i havent understood this, but if you allow inherited permissions then when you copy a folder into a users area there should be no problem with the user being able to access the new folder.

[ajbritton]

If you a distributing copies of a single file to multiple users it might be easier to let the users get their own copy by posting the file in a public read-only area.

 

When files are backed up, the security information should be included in the backup. A restore should put back the same security information. This is possible with NTBACKUP, ROBOCOPY (and I'm fairly sure BackupExec could probably do it as well)

 

If you are putting personalised files into users folders then I can see that it would be a problem. I guess in that case you have to answer the question is to which is more inconvenient; pre-creating folders with particular security on them or changing the security or owner information on files after you copy them in. It would be fairly trivial (but not very elegant) to have a script go through the folders and reset security every night for example.

[ajbritton]

Oops, silly me!

 

I should have said that the other option is to use the 'Grant exclusive use...' option on the redirection policy. This should grant the user (and Administrators) Full Control on the folder! Not much use if you want staff to be able to put files in those folders however!

[ArchersIT]

maybe i havent understood this, but if you allow inherited permissions then when you copy a folder into a users area there should be no problem with the user being able to access the new folder.

 

That is the case - I can *change* the permissions - but the default permissions if you let it be created this way do not give the relevant permissions as inherited.

 

Jonathan

[ajbritton]

@ArchersIT: Have you tried the 'Grant exclusive use...' tick box on the redirection policy?

[ArchersIT]

@ArchersIT: Have you tried the 'Grant exclusive use...' tick box on the redirection policy?

 

Sorry - I did reply to your earlier message, but it did not arrive.

 

Anyway, when I try this tick box, then when the folder is created (when they first log in) it blocks inheritance which stops administrators having access. I can obviously change this, but I am wondering if there is a way of achieving it without having to change the permissions after the event.

 

Cheers

 

Jonathan

[maniac]

Solution to this is not to have the folder created when the first login, but to create the folder for them. There is an easy way of doing this using active directory however.

 

(I'm presuming it's the my documents folder you're redirecting here)

 

1. Set the folder redirection group policy so that my documents is redirected to the 'users home folder' and make sure the 'exclusive rights' and 'move contents' boxes are unticked.

 

2. Set the home directories in ActiveDirectory, you can do them all at once on server 2003. Simply highlight all the users you want to create home directories for, right hand click and select properties. (Make sure you've only selected users, and havn't accidently selected groups or OUs as well or the box won't display corrrectly)

 

3. Select the 'profile' tab and tick the 'home folder' tick box. Then select the connect . . to . . . option and choose a drive letter that will become your users home directory. (We use H:\)

 

4. This is the important bit. type the start of the share you want the users home folder to be connected to, e.g \\SERVERNAME\SHARENAME then when you reach the level where you want to use the users username, type %username% e.g \\servername\sharename\yeargroup\%username%

 

When you OK the box, active directory will write all the values to AD, AND create the home folders for you. The best bit is it will set the ACL on the homefolder as the root folder is set, and add into that the username of the person whos homefolder it is as well.

 

Let me know if that's any help.

 

Mike.

[ArchersIT]

Solution to this is not to have the folder created when the first login, but to create the folder for them. There is an easy way of doing this using active directory however.

 

 

Let me know if that's any help.

 

Mike.

 

Thanks very much - bit of a lightbulb moment there! This should work admirably, although I am a little cross with myself - you see we currently use this method for creating the old directories (before we thought about using folder re-direction) - I never thought to combine them!

 

Thanks very much

 

Jonathan