Permissions on Staff Home drives

[Joanne]

Got an issue where I can't access Staff Home drives. Not a massive issue, but it would be easier if I could get access for printing stuff for people and whatnot.

 

Basically I have the following security groups in AD:

 

CF G Pupils

CF G Staff

 

I am an administrator and I am also a member of the CF G Staff group.

 

I have the following permissions set on the Staff Home folder (where home drives are)

 

CF G Pupils - full control - deny

CF G Staff - Traverse Folder - This Folder Only

Administrators - full control - All sub folders, files etcs.

 

Staff users are owners of their folders. Issues arise when I try and access the 'My Documents' or 'Desktop' folders within the %username% folder.

 

When I try and look at permissions on Staff Home\%username%\desktop (for example) it says 'You do not have permission to view or edit this object's permission settings'.

 

I have a feeling I need to check the 'apply settings to all child objects' checkbox on the Staff Home folder, but I am scared to do this.

 

Anyone know for sure where I am going wrong?

 

Thanks.

[win]

Those seem to be folder permissions. You could try checking the share permissions, although normally the administrator has access by default.

[Joanne]

Advanced Sharing permissions are set to everyone allow. It is definitely folder permission issue.

 

COULD it be that I copied these folders from a different share? Thing is, I can't access the permissions on them!! #fail

Edited October 6, 2014 by Joanne

[Joanne]

oh no wait... this is important. I'm concerned that my backups aren't happening because I may not have access to the folders...

 

I'm starting to think the SYSTEM group needs to be on there....

Edited October 6, 2014 by Joanne

[Davit2005]

Are you using re-direction on Documents and Desktop.

 

Is it this, you may want to test on one user if possible.

 

Edited October 6, 2014 by Davit2005

[Joanne]

Could be it. They were all checked in my group policy. I've unchecked it. I'm assuming it will take a bit of time to change everything?

[Davit2005]

Could be it. They were all checked in my group policy. I've unchecked it. I'm assuming it will take a bit of time to change everything?

 

By default Microsoft gives user exclusive rights, create a brand new user in a test OU with a test policy and give it a test with the box exclusive rights un-ticked with the home area in the same location see what happens.

[Joanne]

Yeah, everything works fine with the new user. I can access all the folders from my logon on the server.

 

How do I now get that filtering down through existing users?

 

I've got an existing test user and I'm logging on and off, but it isn't changing anything for me on the server. Tried redoing the user area path...

Edited October 6, 2014 by Joanne

[cscc]

NTFSFix is a great tool for bulk permission changes:

 

NTFSFix

 

Works well providing your usernames match the folder names. You can either update the ACL by choosing "Add" or reset and replace the lot.

[Joanne]

Looks like I'm going to have to take back ownership and then re-do the user area again...

 

Enabling the administrator to have access to redirected folders

 

Reverse effects of "Grant user exclusive rights to My Documents" GPO - Spiceworks

 

I'm thinking this is probably best done when peeps are not logged on?

[Joanne]

OK, fixed it on my test user.

 

Step 1 - Take ownership of user folder and all subcontainers.

Step 2 - Give back ownership.

Step 3 - On user folder, check the 'replace all child objects' box and uncheck inherited ones.

 

I can access them now, as can the user for re-direction.

[Joanne]

NTFSFix is a great tool for bulk permission changes:

 

NTFSFix

 

Works well providing your usernames match the folder names. You can either update the ACL by choosing "Add" or reset and replace the lot.

 

I'm a little scared to use this incase I do it wrong and it mucks up all user areas!! Might just do one at a time!!!

[Davit2005]

Yeah, everything works fine with the new user. I can access all the folders from my logon on the server.

 

How do I now get that filtering down through existing users?

 

I've got an existing test user and I'm logging on and off, but it isn't changing anything for me on the server. Tried redoing the user area path...

 

Thankyou to Microsoft again. Not too sure how to fix I'm afraid

[3s-gtech]

NTFSFix is awesome. Afterwards, run chown.exe with:

 

for /D %%i in (*) do (
chown -r %%i "%%i\*.*"
)

 

In a batch file, placed in the root directory of your home areas together. This will run through and set the owners to be the same as the folder names. This will get your quotas etc working again.

 

That GP setting is a curse, I long ago hunted it down and exterminated it on our domain - also did it again recently on a new trusted domain.

[seustice]

Are you also a member of the pupils group? The deny permission will take precedence over any 'allow' permission you have.

[Joanne]

oh god that frightens the bejesus out of me!!!

 

I'm going to remote on tonight to make the changes... I'm sure I could get it bossed in <20mins with the scripts and NTFSfix.... argh. I need to have some confidence in myself!

 

- - - Updated - - -

 

Are you also a member of the pupils group? The deny permission will take precedence over any 'allow' permission you have.

 

No, not a member of pupils.