Windows File Server NTFS Permissions

[san_narula]

I am migrating staff file servers and want to make sure that I get the NTFS permissions right first time as I have experienced in the past that it can be very messy and difficult to fix it later.

 

The file server will host Home folders, shared folders, profiles, desktops, downloads and settings(for redirected favorites, links, searches and start menu) and will be located in the main folder ‘Staff’. These are shared and mapped via active directory using DFS paths.

 

So the UNCs look like this:

\\Domain\Staff\HomeFolders\%username%\

\\Domain\Staff\DesktopFolders\%username%\

\\Domain\Staff\DownloadsFolders\%username%\

\\Domain\Staff\Settings\%username%\

\\Domain\Staff\Profiles\%username%\

\\Domain\Staff\SharedFolders\

 

This is what I am trying to achieve:

 

First of all, I would like to make the desktop folder read only so no one can save to the desktop.

 

I would like to prevent all the users from changing the permissions and sharing the folders if folders if possible. The users should not be able to take ownership either. Not sure if there is any way to do this but I would also like to prevent them from putting the files directly in their home folders.

 

I have created folders under SharedFolders for different departments and would like to prevent users from modifying the names of these or creating new folders in SharedFolders.

 

The documents folder and settings will be redirected so I need to know the permissions for these parent folders.

I have created a spreadsheet detailing all the folders, groups and permissions which I am sharing here.

 

https://docs.google.com/spreadsheets/d/1K4PrCLboDcVKhnfKiWbvypExGQVcgjT6K9EBRAv6gHc/edit?usp=sharing

 

Also, do I need to go to advanced permissions to achieve this or the six standard permissions will work fine? Moreover, should I be creating new ACL groups as per MS recommendations or the existing groups should serve the purpose?

 

I am having hard time trying to work out what NTFS permissions I need to assign to which groups for different types of folders. I will really appreciate if people can assist me with these.

 

I am open to all suggestions and would like to know if there are any other recommendations to avoid any problems later.

Edited December 18, 2014 by san_narula
Formatting

[dblight]

You say your are migrating? If your current permissions are ok and your migrating talk data you can use the windows server migration tools and that will move everything, keeping the permissions and the shares.

 

I only mention as it can save you a lot of manual work and it's widely overlooked

 

[san_narula]

You say your are migrating? If your current permissions are ok and your migrating talk data you can use the windows server migration tools and that will move everything, keeping the permissions and the shares.

 

I only mention as it can save you a lot of manual work and it's widely overlooked

 

 

I think I used the wrong term but its not just a new server but I am moving the folders to the new domain so the permissions have to be reset. The old file server is a mess.

Edited December 19, 2014 by san_narula

[tmcd35]

Folder permissions should be set using security groups, users should be members of the group with the access level you want that user to have. Users can be members of multiple groups allowing different access rights for different folders/shares. These security groups should be new, fresh, unique security groups you have created yourself specifically for this purpose rather than using any pre-existing or built-in security groups.

 

An AllUsers group might be handy for things like the Desktop so you can set Read Only for the AllUsers group, make all user accounts a member of that group, and the desktop is read only for everyone.

 

Personally I prefer to set the permissions using the advanced tab, I like having fine control. Here you can give them read only access to permissions and prevent them from taking ownership, ect.

 

There's also a number of built in groups that you need to think about setting access rights for - SYSTEM, INTERACTIVE, CREATER OWNER, EVERYONE.

 

Wisesofts's NTFSfix is a great program for helping with this task: NTFSFix

[3s-gtech]

Couple of things.

 

Full Control is the permission that allows users to change the permissions themselves. AD grants users full control of their home folder, but using NTFSFix you can change this in bulk pretty quickly.

 

It will be very tricky stopping users from putting files into their root home directory, it will be better if you just make sure that their home folder is redirected and you hide their home drive letter from Computer.

 

Don't over think this job - it'll become too complex to fathom. Try building a single test directory and tweak it to do what you want. Then roll those permissions out using NTFSFix, and don't forget to use chown.exe to set Ownership once you're all done (for FSRM to work, amongst other things).

[san_narula]

Thanks everyone for the suggestions.

I did not know something like NTFSFix exists so I will give it a try and hopefully it will work for me.

[Davit2005]

One thing I have done in quite a few places for students is to redirect the users Desktop to a central folder and make this read only. This way you can put any icons on the desktop if you need but you do not need a separate desktop folder for each user. The users then cannot save to the desktop.

 

For Staff we redirect the Desktop to there home directory on the server.

[san_narula]

Hi Davit2005 I have tried to do the same in many different ways but haven't been successful. Are you able to give more details about it. Every time I make it read only, folder redirection breaks.

[Davit2005]

Hi Davit2005 I have tried to do the same in many different ways but haven't been successful. Are you able to give more details about it. Every time I make it read only, folder redirection breaks.

 

When you redirect make sure that you go into options and un-select 'Grant user exclusive rights to desktop'

 

I normally use an account to create the folder in the location of choice. Create the policy and adjust the Security filtering the account, test with another user before roll out.

[san_narula]

So which option do I select when redirecting- basic or the other one?

[san_narula]

Hi Davit2005, I have tried it again using your suggestions and it appears to be working fine.

Also, do you suggest using Everyone group or Users group for the home folders root folder?

Edited January 7, 2015 by san_narula

[3s-gtech]

Personally, I use Authenticated Users for that. I try to avoid Everyone permissions where possible.