Home folders have Everybody > Deny Delete permission set

[iSteve]

Hi folks,

 

We've been integrating Macs / Windows for nearly 10 years now, but are recently experiencing some trouble with user home folders.

 

Clients are 10.9.5, AD is server 2008R2, home folders are stored on Server 2008R2 over SMB. This is all vanilla Mac OS and Windows - no 3rd party integration tools.

 

When a user logs in to a Mac, and their home folder is mounted, it seems that the Windows server adds an Everybody entry to the ACL with special permissions, which are Deny for Delete operations. This causes problems as it will lock a user out of their Library folder so that applications do not run etc. If we remove the 'Everyone' entry, they can work as normal.

 

There have been no changes to clients or servers in the last 18 months. This behaviour has been happening for a couple of weeks.

 

Interestingly, at the same time, we are setting up and testing a new AD domain (with a trust relationship between current and new), using Server 2012 R2 for AD and file server. If I log in one of the Macs to the new AD, with a home folder on the new file server, the same thing happens - an 'Everyone' entry appears in the ACL with Deny Delete set. If I attempt to create a new folder on my desktop it will vanish. If I check on the server it's there, but with these deny permissions. If I remove the entry from the ACL they ping back up on the Mac.

 

Has anyone seen this behaviour, or have a way to prevent this ACL entry happening on the Windows server?

[manxdan]

To work around this problem, we pre-stage the OSX Home directories with a user template, and edit the permissions before the user logs in.

The permissions on the Home folders have to be edited thus:

take off Allow Full control

take off Allow Change permissions

take off Allow Take ownership

Once the Deny Delete is in place, it can be a PITA to fix.!

 

this can be scripted.