[ms office - 2013] Network Shortcuts

[trivers1982]

Hey

 

I am trying to configure Win7 with Office 2013 and have come across a sticky issue that is annoying and has me pulling my hair out!

 

I am trying to use a roaming profile and opening files in office works great! However when it comes to Save as... I get two folders as a default options.

 

Desktop

My Documents

 

Clicking on either one of these takes me to their profile folder \Windows\network Shortcuts.

 

Ideally I would like to remove the desktop folder and just have My Documents. going to browse works just fine, it takes them to the setting I have configured in the GPO (Their my docs area). I am assuming it is a GPO/Appdata issue but just not sure. Anyone come across this or have a fix?

 

T

[cstreet]

Hi,

 

I had the same issue with Folder Redirection and Profiles on Server 2012 and I've got some answers for you!

I've been tearing my hair out trying to work this one out for two days now but here we go...

 

The default "Recent Folders" in Office 2013's Save As menu contains the two options as you explained, Desktop and Documents.

When you are clicking these they take you to the "Network Shortcuts" folder in the local roaming profile.

 

The reason it is doing this seems to be user permissions. I realised this because our Technician users work properly and the staff do not.

Giving staff our "Technicians" Security Group made Office work again (obviously not the solution we want)!

 

OUR SETUP...

 

We've Redirected the user profiles using the Active Directory ("Profile" tab on the user object) and pointed them at a hidden server share.

\\Server\Profiles$\%USERNAME%

When the user logs for the first time it creates a folder for the user (%USERNAME%.V2).

\\Server\Profiles$\aUser.V2

 

The local computer has got Registry entries in the "User Shell Folders" Key within .DEFAULT that point to %USERPROFILE%/Roaming/.

The user gets a copy of this and one of the entries is "Nethood" which directs to the "Network Shortcuts" folder in the profile.

When the user logs off it synchronises the local profile up to the user's profile Share on the server (normal Windows process).

 

Our GPO for Staff restricts access to local drives and folders.

The user is logged on to the computer with a LOCAL COPY of the server profile.

C:\Users\%USERNAME%\AppData\Roaming\

Thus the user's LIVE profile is restricted by Domain Policy.

 

Because the user's profile is restricted in whatever way it fails to validate/make a network shortcut to the "Desktop" and so Office 2013 fails to open the folder and ends up presenting the "Network Shortcuts" folder instead (this folder is writable by our users it seems).

 

THE SOLUTION...

 

As you requested that you don't want the Desktop option I'll share this finding with you first.

I don't know how to hide the desktop option but we had some accidental success when our Network Manager tried deleting the "Network Shortcuts" folder from a user's profile.

After deleting the folder, Office 2013 directs the users to "Documents" for whichever Recent Folders option they choose.

 

The better solution is to use your Folder Redirection GPO to redirect the AppData folder to the same server share as Active Directory does.

Basic - Redirect everyone to this folder - \\Server\Profiles$\%USERNAME%.V2\AppData

 

Note the ".V2" after %USERNAME%. This is important. After you save the setting go back into it and you will see it has changed to "Create a subfolder within" and shows an example of \\SERVER\Profiles$\Claire.V2\AppData. If you choose this option straight off you don't get the .V2!

 

Also go to the "Settings" tab on the Folder redirection and be sure to CLEAR the "Grant user full permission" tick box. Otherwise you won't be able to browse the folders as an administrator (it'll prompt for "Get Access to this folder").

I've also cleared the "Move contents to new location" too.

 

The Active directory profile thing will create the folder on first log in and the GPO Folder redirection of AppData will direct the computer directly to the server copy making it LIVE.

This fixes any permission problems as the user has explicit "Full" permissions and ownership of the profile folder, and therefore the LIVE profile as well.

 

Now our Office 2013 behaves properly when Saving new files (or Save As).

 

We've also got a HomeDrives$ share for the User's Documents, Pictures, and all of the other personal data containers.

It's also set on the "Profile" tab in AD.

Map Home Drive H: to \\Server\HomeDrives$\%USERNAME%

 

We also has a GPO for the folder redirections to this UNC path (don't use the Drive Mapping anywhere in case you decide to change the Drive letter later on).

Same things apply to Folder redirection "Settings" Tab, CLEAR the "Grant user Full Perms" tick box or you won't be able to browse it as an Administrator.

 

Choose to Direct everyone's folder to the following paths...

\\Server\HomeDrives$\%USERNAME%\Documents (for Documents redirection)

\\Server\HomeDrives$\%USERNAME%\Pictures (for Pictures redirection)

...and again notice that going back into it shows "Create a folder for each user" option with an example for Claire.

 

When you set up your Profiles$ and HomeDrives$ shares be careful what permissions you have (Security Tab). You shouldn't give your Staff Security Group Full access to this, they only need Special Perms to Create a Folder, and only within "This Folder Only" not sub folders or files (have a google for other permissions on profile folders such as adding Creator Owner).

I found that giving Ownership of the Profiles folder to "Creator Owner" meant that when AD creates a new User's profile it gives Full Ownership to that particular User on the .V2 folder which is what we wanted.

 

I wrote a PowerShell script that is for the Personal Data shares that grants each user's home folder the correct permissions and ownership. This is possible with the HomeDrives because Active Directory creates these folders immediately when you update the setting.

We also used PowerShell to pull the Old user data from our Old server as part of the big Migration.

Please ask if you would like help making such scripts!

 

Hope all of that info helps you understand what's going on with your Office 2013, Profile Redirection and Folder Redirection too.

Sorry I didn't figure it out sooner to give you more time to implement it before Start of Term

Edited September 1, 2013 by cstreet

[CHiLL]

I know this is an old thread, sorry, but I'm, pulling my hair out over here with the exact same issue. I'd rather not create a new thread given the good work @cstreet has done in the above post.

 

The only difference I have compared to the above users, is that we do not use redirected profiles, though we do have redirected home folders.

 

This appears to be affecting all of our Microsoft Office applications that are used regularly (Word, Excel, PowerPoint). We have tried using Microsoft Office 2013 ProPlus, Office 365 ProPlus (2013), Microsoft Office 2016 ProPlus and Office 365 ProPlus (2016)...all have the same symptoms. (We only use the 32-bit version of Office)

 

I'll use Microsoft Office 2013 ProPlus as an example, specifically using Word 2013, if you press File > Save As and then hover over the 'Documents' folder, it shows you the path of the home folder (in our case it shows: "\\staff\staffhome\teststaff\Documents"). However, when you press 'Documents', it brings up the file explorer with the path "C:\Users\teststaff\AppData\Microsoft\Windows\Network Shortcuts".

 

This is causing us a major headache as a lot of our users are saving documents this way, meaning that the data is not saving on the network. Users are starting to learn how to work around it, but it isn't shining a great light on us as a department at the moment.

 

What I have noticed, is that if we use a domain administrator account, it works correctly. Pressing 'Documents' browses to the home folder like it should, not the 'Network Shortcuts' folder. Suggesting a permissions issue like @cstreet suggested. However I'm stumpted at this present time. I've even spent the entire afternoon on the phone to Microsoft's Office 365 support team, which got me no-where and ended with them saying they don't support this type of issue.

 

Help!

[cstreet]

CHiLL, Microsoft uses the network shortcuts folder as a default when it can't bring up the expected path. This path might be coming from the registry in a bad default local profile.

 

We redirect profiles using only Active Directory "Profile Path" (not GPO) in the user object on the profile tab.

The GPO for Folder Redirect on AppData we set to "not configured".

 

Windows 7 loads the user's profile from the path we set in AD. If the profile isn't on the server it copies the default user profile first attempt from the domain NETLOGON folder, and if not then the local machine.

We created and copied a Default User profile to our Domain here...

"\\\NETLOGON\Default User.V2"

...and have made no changes to the local Windows 7 default user profile at all (straight off the install disk

 

In our "Default User.V2" folder is a set of default AppData folders as well as an NTUSER.dat registry hive in which we've tweaked the "User Shell Folders" to point to sensible places.

Have a look on a client computer registry here...

HLCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

 

Some important ones for profiles to work with Office are below...

 

Name: AppData

Type: REG_EXPAND_SZ

Data: %USERPROFILE%\AppData\Roaming

 

Name: NetHood

Type: REG_EXPAND_SZ

Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Network Shortcuts

 

Name: Personal

Type: REG_EXPAND_SZ

Data: %HOMEDRIVE%\Documents

 

Name: Recent

Type: REG_EXPAND_SZ

Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent

 

Name: Templates

Type: REG_EXPAND_SZ

Data: %HOMEDRIVE%\Documents\Custom Office Templates

 

If you would like to see the full list we have let me know and I'll PM it you. I'm not saying I've done it perfectly right though it seems to work for Office! haha

 

When Windows 7 logs off the user it copies the local profile to the server and next time it logs on again the user's profile is available from it's server location.

Permission for the User's data and profile network locations need to be perfect or it won't work!

 

You need to make sure that the user can traverse the entire path on the server, not just access the SMB share.

I added "CREATOR OWNER" to the root of my profiles path with Full perms.

I then made sure our users group (e.g. Staff) can "create folder" in the root folder only.

Similar set up for the data folders/home drives.

 

If you need anything more let me know! I can PM you a phone number if it's easier for you.

Edited March 9, 2016 by cstreet

[CHiLL]

CHiLL, Microsoft uses the network shortcuts folder as a default when it can't bring up the expected path. This path might be coming from the registry in a bad default local profile.

 

We redirect profiles using only Active Directory "Profile Path" (not GPO) in the user object on the profile tab.

The GPO for Folder Redirect on AppData we set to "not configured".

 

Windows 7 loads the user's profile from the path we set in AD. If the profile isn't on the server it copies the default user profile first attempt from the domain NETLOGON folder, and if not then the local machine.

We created and copied a Default User profile to our Domain here...

"\\\NETLOGON\Default User.V2"

...and have made no changes to the local Windows 7 default user profile at all (straight off the install disk

 

In our "Default User.V2" folder is a set of default AppData folders as well as an NTUSER.dat registry hive in which we've tweaked the "User Shell Folders" to point to sensible places.

Have a look on a client computer registry here...

HLCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

 

Some important ones for profiles to work with Office are below...

 

Name: AppData

Type: REG_EXPAND_SZ

Data: %USERPROFILE%\AppData\Roaming

 

Name: NetHood

Type: REG_EXPAND_SZ

Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Network Shortcuts

 

Name: Personal

Type: REG_EXPAND_SZ

Data: %HOMEDRIVE%\Documents

 

Name: Recent

Type: REG_EXPAND_SZ

Data: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent

 

Name: Templates

Type: REG_EXPAND_SZ

Data: %HOMEDRIVE%\Documents\Custom Office Templates

 

If you would like to see the full list we have let me know and I'll PM it you. I'm not saying I've done it perfectly right though it seems to work for Office! haha

 

When Windows 7 logs off the user it copies the local profile to the server and next time it logs on again the user's profile is available from it's server location.

Permission for the User's data and profile network locations need to be perfect or it won't work!

 

You need to make sure that the user can traverse the entire path on the server, not just access the SMB share.

I added "CREATOR OWNER" to the root of my profiles path with Full perms.

I then made sure our users group (e.g. Staff) can "create folder" in the root folder only.

Similar set up for the data folders/home drives.

 

If you need anything more let me know! I can PM you a phone number if it's easier for you.

 

Thanks for the swift response. At this moment of time, we aren't going to go down the profile redirection route. We replaced our entire server, desktop, network and wireless infrastructure last summer. Being such a large job, we contracted the work out to a third party (with experience in many schools) who planned and implemented everything. They set it up without roaming profiles on purpose, as they've always encountered issues with it apparently. At this point, we haven't had a lot of time to actually do much in the way of testing, which is why we've only just got round to this problem with Office. It certainly is something I'd like to look into, as the last place I worked had it all set up and working nicely.

 

We are deploying images to machines via SCCM using three different Windows 8.1 images. (One 64-bit created by our contractor, one 32-bit I created from a clean ISO from MSDN and one 64-bit I created from a clean ISO from MSDN) This issue is affecting the machines regardless of the image we use, so I'm not sure if it's the default profile causing issues on all three images.

[cstreet]

OK, we were in the same boat in 2013! A 3rd party contractor delivered a shitty config and we basically educated ourselves using Google and started again with the profile mechanism redirected in AD.

In fact, every single server that the company deployed had bad configs which we slowly had to re-build.

That aside, we were grateful for something to start with.

 

If you had Windows 7 clients I could share our Default Profile folder with you so you could use them or at least have a starting point.

I'd happily allow you some time to walk you through some tricks of how to manipulate the Default Registry Hive and things like that.

 

You really should be giving Staff users a profile it makes life easy when it's done right.

Some more tips for you then...

 

Tip #1

Once configured correctly, if a staff profile does goes wrong (blame Microsoft!) you can simply log them off, delete or rename the server copy and the next time they log on they've get a new shiny default one.

Don't forget the local profile copy on their computer.

 

Tip #2

Local copies of user profiles are a bind, even if windows is configured to delete them after 1 days or whatever (it just doesn't work!).

In order for the roaming profiles to get deleted efficiently we use a free utility called delprof2.exe.

Simply run this as a start up script every time the computers boot and it deletes all local user profiles, for sure this time!

E.g. [TABLE=class: info]

 

 

[TR]

[TD]"DelProf2.exe[/TD]

 

[TD] /q"[/TD]

[/TR]

[/TABLE]

If you need to "reset" a user profile get them to reboot which clears the local copy

 

Tip #3

Buy Salamander Active Directory!

By far the best £999 we every did spend. It provisions your users for you directly out of SIMS (other MIS are available overnight. S

So HR puts someone new on SIMS and the next day they programmatically get an Active Directory account, Email address (O365 compatible) and a whole host of other benefits such as putting all your SIMS groups and timetables into O365 so everyone can use them in Outlook address and calendar.

[CHiLL]

I think I've cracked it for our environment!

 

After a lot of trial and error, I was able to isolate our issue down to a single GPO causing the issues, one of the GPOs created by the contractors who set it all up. This GPO served one purpose - to redirect user folders, such as Desktop, Documents, etc to other shares on a server. The specific issue was to do with the Documents redirection (User Configuration > Policies > Windows Settings > Folder Redirection > Documents. Within the settings tab for Documents folder redirection, the check box for 'Grant the user exclusive rights to Documents' was unchecked. As soon as I checked this setting, it started working. When I removed the check and tried again, it stopped working, and checking it again made it start working again.

 

I've been doing this in our testing environment. Will checking this option on a live account have any knock-on effects that anybody knows about?

 

I have also noticed that 'Move the contents of Documents to the new location' is also unchecked. Is this required? If so, what knock-on effects may this have?

[CHiLL]

I think I've cracked it for our environment!

 

After a lot of trial and error, I was able to isolate our issue down to a single GPO causing the issues, one of the GPOs created by the contractors who set it all up. This GPO served one purpose - to redirect user folders, such as Desktop, Documents, etc to other shares on a server. The specific issue was to do with the Documents redirection (User Configuration > Policies > Windows Settings > Folder Redirection > Documents. Within the settings tab for Documents folder redirection, the check box for 'Grant the user exclusive rights to Documents' was unchecked. As soon as I checked this setting, it started working. When I removed the check and tried again, it stopped working, and checking it again made it start working again.

 

I've been doing this in our testing environment. Will checking this option on a live account have any knock-on effects that anybody knows about?

 

I have also noticed that 'Move the contents of Documents to the new location' is also unchecked. Is this required? If so, what knock-on effects may this have?

I have found one problem with this.

We have another group policy specifically for one of our student year groups. This policy works without issues, yet the check box for 'Grant the user exclusive rights to Documents' is NOT checked!

 

Now I'm not sure!

[Oaktech]

I've been having this issue with 2013 and worse with 2016. Just found this blog and it's fixed it!

 

https://emtunc.org/blog/09/2016/office-2016-network-shortcuts-save-issue/