Teachers seeing pupil documents

[MattDLEA]

Sorry but I'm failing at everything today.

 

We have a share created F:students

Inside there is the homedrive for every student. The idea is that any teacher can see inside each students home drive so my documents ect to get there work. I have tried it as a teacher I can see the students home drive but once inside its empty.

As an Admin I can see there My documents folders but again am denied access to them.

Any ideas how to do this safely?

[Grey-gear]

Do you have the correct permissions?

 

Check that you have read permission on the files and then you should be able to get in, just try it on one at first.

[MattDLEA]

So if I go into students studata student name as an admin I can see

Documents

Downloads

Favorites

Music

Pictures

Videos

 

Clicking on Documents I get a You currently don't have permission to access this folder

 

If i right click properties then security I get You must have read permission to view the properties of this object click advance to continue ....

then it wants me to take ownership of it?/

[LeMarchand]

Is inheritance turned off?

[NB9457]

Do you have folder redirects in place and did you tick "Grant user exclusive rights to the documents folder"

[Joanne]

Do you have folder redirects in place and did you tick "Grant user exclusive rights to the documents folder"

 

THIS^^

 

I had this issue and had to go through all folders changing permissions and re-granting ownership. Probably a better way of doing it like, but ball... ache!

[NB9457]

THIS^^

 

I had this issue and had to go through all folders changing permissions and re-granting ownership. Probably a better way of doing it like, but ball... ache!

 

I imagine there'd be some way to do it by Powershell, but how I'm not too sure

[Grey-gear]

THIS^^

 

I had this issue and had to go through all folders changing permissions and re-granting ownership. Probably a better way of doing it like, but ball... ache!

 

Though it will be a pain at least this way @MattDLEA will be able to be sure that the Admin and teachers can read the documents and that the students can get to each of there own work. But yes a lot of work sorry

[Oaktech]

When I took over this network, one of my first things was to untick the grant exclusive rights. I've then set inheritance and set modify rights for the teachers and TAs group whilst the owner in my domain admin account.

 

I put a link to the top level folder which has student folders under it on the staff redirected desktop.

[MattDLEA]

Right thanks all Just had a look at the GP all them folders are redirected and all have the Grant user Exclusive rights to folder.

 

So what do I need to do

[Joanne]

What I did was:

 

uncheck the grant user exclusive rights.

Make administrator owner of folder which contains user directories, include sub-folders etcs.

Add administrator to permissions with full control.

On each user area, give user ownership of folder and include sub-directories.

 

PLEASE TEST THIS ON JUST 1 USER BEFORE YOU DO IT FOR EVERYONE! It was like a year ago when I did it... so I might have got some of it wrong, but it makes sense in my head. I'm sure others can chime in.

 

Also I'm assuming you have the traverse folder permission on the folders which hold the user areas. Remember to not propagate that particular setting to the other folders.... otherwise everyone can see everything!

Edited October 20, 2015 by Joanne

[MattDLEA]

Thanks Joanne,

 

Few questions I have been in to GP and unticked Grant user exclusive rights.

 

I have a folder called studentdata then inside there is all the students . Is the studentdata the one I make Administrator the owner of?

I would then click on each student name and give them ownership of there top folder?

 

I got lost at the transverse folder permission can you explane that please?

 

Also if i do this above will it break all students until i redo the permissions?

[Joanne]

Yes it will break all permissions and users will not be able to save. Also it will come up with an error message on logon saying it couldn't redirect folders.

 

OK so here are my permissions:

 

studentdata folder:

 

Intake folder:

 

then a pupil folder:

 

Traverse folder allows a security group access to folders within folders, but doesn't give them any permissions... so they in effect 'traverse' it to get to their home drive.

[PyROm]

A quick and nasty batch file script I used when I hit this problem, to set the ownership and grant rights to the user for their home drive. I run this in the same folder as the students folders. It assumes the folders are named the same as the students login.

 

for /D %%i in (*) do (
  icacls %%i /SETOWNER domain\%%i /T 
  cacls %%i /T /E /P domain\%%i:c
  cacls %%i /T /E /G domain\%%i:c
)

 

you will need to change domain\ to your domain name.