edutech4schools Posted June 24, 2013 Posted June 24, 2013 (edited) Which would be best practice for creating a users home folder in AD. The directory tree to the home folders is D:\home\user Should I make 'user' folder a share$ and then create my documents in that folder so d:\home\user$\My Documents (AD would be \\server\user$\Mydocs) or should I make 'home' the share$ so I end up with d:\home$\user\My Documents (AD would be \\server\home$\user\My docs) Both methods seem to work and both stop the folder being renamed to 'mydocuments' if folder redirection is enabled. Does it make a difference from a security point of view? Edited June 24, 2013 by edutech4schools
edutech4schools Posted June 24, 2013 Author Posted June 24, 2013 I have realised the above post only works if you already have a user and home folder setup on the server. I have just tried to create a new user. If I use \\server\staff$\user\My Docs I get an error that the folder was not created as the path was not found. I have worked out that it does work if I remove the My Docs part. But then I will get the redirected folder issue where it renames the users folder to My docs. How is everyone else creating home folders from AD. Are you physically creating a users folder in the home folder area first and then creating the user in AD.
CyberNerd Posted June 24, 2013 Posted June 24, 2013 How is everyone else creating home folders from AD. Are you physically creating a users folder in the home folder area first and then creating the user in AD. Samba shares create themselves with a shell script! #!/bin/bash if [ "$2" = "09" -o "$2" = "10" -o "$2" = "08" -o "$2" = "07" -o "$2" = "06" -o "$2" = "05" -o "$2" = "12" -o "$2" = "11" -o "$2" = "12" -o "$2" = "staff" -o "$2" = "adulted" -o "$2" = "exams" ]; then if [ ! -e /home/CURRIC/$2/$1 ]; then mkdir -p /home/CURRIC/$2/$1 chown $1:"domain admins" /home/CURRIC/$2/$1 chmod o-rwx /home/CURRIC/$2/$1 chmod g+rwxs /home/CURRIC/$2/$1 setfacl -m user:$1:rwx /home/CURRIC/$2/$1 setfacl -m group:"domain admins":rwx /home/CURRIC/$2/$1 if [ "$2" = "05" -o "$2" = "07" -o "$2" = "06" ]; then setquota -u $1 2097152 2306867 0 0 /home/CURRIC/ setfacl -m group:teachers:r-x /home/CURRIC/$2/$1 elif [ "$2" = "08" ]; then setquota -u $1 1048576 1153433 0 0 /home/CURRIC/ setfacl -m group:teachers:r-x /home/CURRIC/$2/$1 elif [ "$2" = "12" ]; then setquota -u $1 1048576 1153433 0 0 /home/CURRIC/ setfacl -m group:teachers:r-x /home/CURRIC/$2/$1 elif [ "$2" = "11" ]; then setquota -u $1 1048576 1153433 0 0 /home/CURRIC/ setfacl -m group:teachers:r-x /home/CURRIC/$2/$1 elif [ "$2" = "09" ]; then setquota -u $1 1048576 1153433 0 0 /home/CURRIC/ setfacl -m group:teachers:r-x /home/CURRIC/$2/$1 elif [ "$2" = "10" ]; then setquota -u $1 1048576 1153433 0 0 /home/CURRIC/ setfacl -m group:teachers:r-x /home/CURRIC/$2/$1 elif [ "$2" = "adulted" ]; then setquota -u $1 1048576 1153433 0 0 /home/CURRIC/ elif [ "$2" = "exams" ]; then setfacl -m group:teachers:rwx /home/CURRIC/$2/$1 elif [ "$2" = "examslibre" ]; then setfacl -m group:teachers:rwx /home/CURRIC/$2/$1 elif [ "$2" = "Staff" -o "$2" = "staff" ]; then setquota -u $1 20971520 26214400 0 0 /home/CURRIC/ setfacl -m group:teachers:--- /home/CURRIC/$2/$1 setfacl -m group:staff:--- /home/CURRIC/$2/$1 else setquota -u $1 1048576 1153433 0 0 /home/CURRIC/ fi fi fi exit 0
plexer Posted June 24, 2013 Posted June 24, 2013 How to configure Roaming Profiles and Folder Redirection Ben
ADMaster Posted June 24, 2013 Posted June 24, 2013 I changed the way folders are redirected, not how home folders are created. Home dirs. \\server\staff\user\ My docs are then redirected to a subfolder of the home dir. The GPO option is “Create a folder for each user under the root path” My docs becomes \\server\staff\user\my docs Hope this helps.
edutech4schools Posted June 24, 2013 Author Posted June 24, 2013 Sorry but I had a very busy day and did not word my original posts correctly. I think ADMaster has understood my ramblings and I will look at creating the extra folder using gpo redirection tomorrow and check if that works.
DMcCoy Posted June 24, 2013 Posted June 24, 2013 I have realised the above post only works if you already have a user and home folder setup on the server. I have just tried to create a new user. If I use \\server\staff$\user\My Docs I get an error that the folder was not created as the path was not found. I have worked out that it does work if I remove the My Docs part. But then I will get the redirected folder issue where it renames the users folder to My docs. How is everyone else creating home folders from AD. Are you physically creating a users folder in the home folder area first and then creating the user in AD. AD users and computers creates folders for you if you set it as the home folder, with the correct permissions. Also use the share as the level above the home folder and set read for *this folder only* for the relevant group who needs to traverse it. \\server\share\user\Documents If you are using only Vista/7/8 clients you can use folder redirection to the following path %HOMESHARE%%HOMEPATH%Documents (and the other folders %HOMESHARE%%HOMEPATH%Music etc). The path in this instance would be "\\server\share\user" + "\" so "\\server\share\user\" plus the redirected folder as a subfolder of the users home folder (avoiding the desktop.ini issues). Redirected folders get created automatically if missing, because the user folder was created by AD already (with %username% if you want to do multiple). One thing to note, DO NOT mix fqdn and short server names for the redirection paths, there is a 7 bug that means changing between the two deletes the contents). 1
edutech4schools Posted June 25, 2013 Author Posted June 25, 2013 In folder redirection policies do I use 'Create a folder for each user under the root path' or 'redirect to the following location' both options have a root path box.
edutech4schools Posted June 25, 2013 Author Posted June 25, 2013 OK think I have set this up correctly, please advise if not. I worked out that I needed 'redirect to the following location' The issue I have with doing it this way is the user still sees the My Documents folder inside the home folder, is this not an issue???. If I created the entire path in AD (\\server\share\user\mydocs) they are already inside the my documents folder when they click on the home folder but doing it this way means manually creating the folder. If I do user the redirected policies methode I presume I will need to manually move all home folder contents into the automatically created My Documents folder?
edutech4schools Posted June 25, 2013 Author Posted June 25, 2013 Found a work-around. When creating a new user in AD if you use home folder connect as - \\server\share\user\docs you get some error about the path not being correct, but if you do \\server\share\user click apply but then go back and add \docs separately at the end AD will create the extra folder So when a user opens their home folder it is actually opening \\server\share\user\docs. I have then been able to use basic redirection to automatically redirect everyone's My Documents to this same folder.
edutech4schools Posted June 26, 2013 Author Posted June 26, 2013 Just wanted to check what share permissions and security permissions you all have on the shared folder in \\server\share\user\docs.
TechMonkey Posted June 26, 2013 Posted June 26, 2013 The link Plexer posted was the one I used for security settings and how to set up my home folders.
edutech4schools Posted June 26, 2013 Author Posted June 26, 2013 Shows you the type of week I have been having, totally missed Plexer's link.
ADMaster Posted June 26, 2013 Posted June 26, 2013 Edutech, If I understand your latest work around, I think you’ll be right back where you started. You are mapping the home folder to \\server\share\user\docs, and also redirecting my documents to the same location correct? This will take you back to the desktop.ini renaming folders on you. Here is a screenshot of group policy I mentioned. Notice all I need to do is add \\srv\share and it fills in the username \ my docs This screen shot is to specify different locations for staff and students. You can do this or just create separate policies. Hope this helps,
sted Posted June 26, 2013 Posted June 26, 2013 how i have it setup is that in the users profile tab under home drive is has connect U: to \\server\user share\group\username then i use folder redirection to set my docs to \\server\user share\group\username\my documents pics to \\server\user share\group\username\pictures and so on (assuming its a win7 only if not its tends to be a bit of a mix) security wise ive found that office can get a bit shirty if it cant read all the path so i have \\server\user share set to allow users to read this folder only, \\server\user share\group\ set so the group can read this folder only and \\server\user share\group\username set to modify access (unless ad auto creates it then its full control)
kaphc Posted June 26, 2013 Posted June 26, 2013 Just wanted to check what share permissions and security permissions you all have on the shared folder in \\server\share\user\docs. I found Automatic creation of user folders for home, roaming profile and redirected folders. - Ask the Directory Services Team - Site Home - TechNet Blogs to be brilliant for this when I've been working on a similar thing on a Windows 2003 server this morning.
edutech4schools Posted June 26, 2013 Author Posted June 26, 2013 Thanks for the info and screen shots. Firstly, did you end up with a user seeing the actual my documents folder listed inside the users home folder? Is this how it should be? Oddly trying my fix works a treat but I am still testing. So if in AD I create a home folder \\server\share\%username% hit apply then add \%username% to the end hit apply When I browse root I see d:\users\username\My Documents This is the important bit - the second %username% has been changed to My Documents by folder redirection but if I open My computer logged in as a teacher ,the home folder displays H:username but when they open this they are actually opening username\My documents. So the are only ever working inside the My documents folder. It will probably screw something up but is an interesting find and is working for my test user. I think the important question for me is, if I set this up following posts above, do I end up with a home folder that the user then sees the my documents folder listed with other folders within the home folder or does the home folder map directly to the My Documents folder?
sted Posted June 26, 2013 Posted June 26, 2013 the way have it set up as above when the user goes to their user area direct they see my documents pictures links desktop ... but if they save to my documents it goes to the documents folder in their home drive and as an admin i see d:\users\staff\fred\documents d:\users\staff\fred\pictures etc
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now