Folder Redirection - Secure Root/Parent Folder

[AAJ]

Hello,

 

I want to redirect Users folders to a Fileserver, and also prevent them from browsing the root folder share.

 

\\Domain\Share$\HR\UserName

 

According to MS, users only needs (List Folder/Read Data, Create Folders/Append Data) permissions on (HR) for the GPO to work and create their folders dynamically.

 

 

But the problem is, without the (Read Attributes) permission, they can't access the redirected folders (Documents, Music, Pictures ...) through Libraries or their User Folder:

 

 

http://social.technet.microsoft.com/Forums/getfile/383247

 

 

http://social.technet.microsoft.com/Forums/getfile/383248

 

 

 

Even though they have full access on their parent folder (UserName), and they can access it directly by typing the full UNC:

 

 

http://s21.postimg.org/9h2mrqnc7/unc.jpg

 

 

http://s29.postimg.org/aildsbfl3/dir.jpg

 

 

If I give them (Read Attributes) permission, then everything works fine, but they can browse and create folders in the root share (HR) easily.

 

any suggestions?

 

 

Setup:

- Share/NTFS Permissions MS LINK

- Share is located on a FileServer Failover Cluster, accessed through a Domain DFS namespace.

- Roaming profile in a similar share, but works without problems.

- Event viewer show that the Folder redirection applied correctly.

- Enabling/Disabling "Access-Based Enumeration" doesn't change anything.

- Pointing to the Share Directly doesn't fix it.

 

OS:

Server 2012 DC

Windows 7 ENT

[cromertech]

There is a way of preventing access to anything that is typed into the address bar of explorer, unless you need that functionality for something. GPO location user settings/admin templates/start menu and taskbar/remove run from start menu.

 

this also prevents typing unc paths into explorer

[edutech4schools]

have a look at this, might help.

 

How to configure Roaming Profiles and Folder Redirection

[AAJ]

Hello cromertech,

Unfortunately, I can't do that, thanks for the reply.

 

 

Hello edutech4schools,

I've seen that link before, and it doesn't help.

 

Note that I'm not worried about them accessing other users files or even seeing them, since DACL and ABE will stop them.

The problem is that they can create (with ease) as many folders in the root directory as they wish, which will render our Quota Management useless.