Creating home folder for existing users

[manamaga2512]

I hope I can explain this correctly. We have been an Apple school for the last 8 years or so, now we are in the process of rolling Windows machines out again. Two years ago all of our users still had access to their home drives but the network manager at the time stopped that access as we moved to GAFE (GSuite). And now we are moving back again!! So my situation is this:

 

I have AD accounts for years 9 to 13 who all have home folders which is mapped in the Local path of their profile. I don't want to reinstate this access as I have another area I want to create fresh new home folders. The students don't need access to their old work.

 

I have AD accounts for years 7 and 8 who don't have home folders, as they joined the school when we were GAFE and didn't require network storage.

 

My question(s) is, what would be the best way to create new home folders for all of our students in the new area I have, and what should the sharing permissions be on the drive, parent folder and each home folder. And then, how would I change that location mapping in the Local path of each of their profiles, to the new location?

 

I really hope that all makes sense. The network manager at the time used to deal with all this, as I was just junior techy. Now 10 years on, he has left and I have been lumbered with the job, but not offered any training, so google, youtube and you guys here have been my lifeline!

 

Happy to provide more info / screenshots if required.

 

Many thanks.

[RJohnson91]

Sounds like a pain in the backside!

 

 

 

I would do this for permissions:

 

Parent folder (Year 7) - Just have Domain Admin and System at the modify level.

 

Then when you create your user put \\StudentServer\Year7\%Username% in the Home Folder 'connect' area.

 

This should create the folder with full access to only the authorised user, which is the Username of that user.

 

 

By doing it this way you can create bulk users, or amend bulk users and it will change each Username to their AD username, simples.

 

 

Hope that made sense too

[mjk]

Can you hold out for Google file streaming and keep the data on GAFE with the illusion that they get a home drive ?

[QwertyMash]

Personally if I was in your situation I would just use PowerShell to create all the areas using a loop to go through all the users in the OU.

[psydii]

Use group policy to redirect Documents etc to %homedirectory%\Documents etc.

 

I would caution against putting the current student year group in the path as it changes each year.

 

I would completely whole heartedly recommend investing in SalamanderAD to automate this.

 

Finally - It would be great to see a post on what the problems were with apple / google and why at a time Microsoft Licencing is scheduled to start ramping up 20%+ moving back on prem and to Windows is the best path for you.

[3s-gtech]

IME, that's a pain. If you use a bulk tool to change the home folders in AD, often it just changes the value but doesn't create the folder (as it does if you do them individually). Last time I did this (I changed the server when replacing their home drive storage) I bulk created the home areas with a script, then used ADModify.NET to point the user home areas at these new areas.

 

Permissions wise, I set the share permissions to Authenticated Users - Full Control. NTFS wise, I then set Authenticated Users to read the root (otherwise our Macs don't map their home drives properly), turn off Inheritance on the sub folders, and use NTFSFix to set each student to have Modify permissions on their home area (I also set SYSTEM and admins to have full control, and give teachers write access).

[ADMaster]

The quick way is to select all users and go to properties > profile tab

tick the box for home folder and fill in the details.

\\server\share\%username%

 

%username% will expand to each users username.

 

I think the default permissions are administrators and the user with full control.

[RJohnson91]

The quick way is to select all users and go to properties > profile tab

tick the box for home folder and fill in the details.

\\server\share\%username%

 

%username% will expand to each users username.

 

I think the default permissions are administrators and the user with full control.

 

That's what I was getting at earlier, it's the easiest way.

[manamaga2512]

That's what I was getting at earlier, it's the easiest way.

 

Sounds like the easiest way to me. I didn't realise you could just select all users. I'll give it a bash thanks.

[manamaga2512]

Use group policy to redirect Documents etc to %homedirectory%\Documents etc.

Finally - It would be great to see a post on what the problems were with apple / google and why at a time Microsoft Licencing is scheduled to start ramping up 20%+ moving back on prem and to Windows is the best path for you.

 

Tell me about it! We use Jamf / Casper to manage iMacs and MacBooks, and GAFE is the dogs bo**ocks if you ask me. Google is free for education with unlimited storage and, in the instances where I have had to use it, outstanding customer support. Sadly, we are in the process of due diligence......another Academy (a very big group) is taking us over and it will be a case of "This is what we use and this is what you WILL be using" All Apple kit will go, to be replaced with Windows. So I'm using the value we have in the apple kit to trade in for credit with a supplier, from which we can then purchase PC's. If I don't do it now, we will just loose all the apple kit.

I'm essentially doing a whole IT refresh and it's not costing the school anything.

[manamaga2512]

The quick way is to select all users and go to properties > profile tab

tick the box for home folder and fill in the details.

\\server\share\%username%

 

%username% will expand to each users username.

 

I think the default permissions are administrators and the user with full control.

 

Hahaha! Perfect! Thanks for that, so easy. Why does it never come up with these easy solutions when you search the net? LOL

[psydii]

Hahaha! Perfect! Thanks for that, so easy. Why does it never come up with these easy solutions when you search the net? LOL

 

Because this stuff was figured out 15-18 years ago, and the details passed into 'common knowledge' from websites that documented it. Time passed the website rotted away, and as almost nobody is creating on premises domains from scratch these days the information gets forgotten.

 

If you know what to look for and exactly how to phrase it, many a great article from 1997-2003 about this sort of thing is available on techrepublic. Also in the last month or two docs.microsoft.com seems to have surfaced and updated much of the fundamental documentation the lack thereof I have been lamenting for

most of this decade.

Edited June 28, 2017 by psydii

[jthompson]

use NTFSFix to set each student to have Modify permissions on their home area

 

I'd second this. We don't give students Full Control on their user areas as they can tamper with permissions and break things. To make that change after the folders are automatically created (and at the same time give teachers read access, admins full control on each user area) we use NTFSFix. It's pretty old, needs .NET 1.1 on Win7 iirc and needs to be run as admin to not crash.

[ADMaster]

That's what I was getting at earlier, it's the easiest way.

I have no idea how my post came in 15 minutes later then yours, I thought sure I was the first reply.

I open multiple posts in tabs then read and reply, I guess it didn't refresh before I got to replying.

 

 

For an ongoing management I recommend powershell. I have a scrip that creates the users and their home drives with the correct permissions.

I'd also suggest setting of DFS name spaces.

DFS will allow you to setup share like \\domain\share\students but point it to \\fs01\students

Then when fs01 gets retired and you setup fs02 just change the target in DFS after you copy the data.

This means no messing with AD home paths again, and the users don't see a difference in the name of their drive.

[RJohnson91]

I have no idea how my post came in 15 minutes later then yours, I thought sure I was the first reply.

I open multiple posts in tabs then read and reply, I guess it didn't refresh before I got to replying.

 

 

For an ongoing management I recommend powershell. I have a scrip that creates the users and their home drives with the correct permissions.

I'd also suggest setting of DFS name spaces.

DFS will allow you to setup share like \\domain\share\students but point it to \\fs01\students

Then when fs01 gets retired and you setup fs02 just change the target in DFS after you copy the data.

This means no messing with AD home paths again, and the users don't see a difference in the name of their drive.

 

 

No worries!

 

That's a good idea with the DFS name spaces!

[manamaga2512]

OK, next part of this question, now that I have created home folders for each user. I need to create a folder within each users home folder and dump some files into it, if possible in bulk rather than one user at a time. Would this be as easy as creating the home folder I wonder?

[markwilfan]

I have no idea how my post came in 15 minutes later then yours, I thought sure I was the first reply.

I open multiple posts in tabs then read and reply, I guess it didn't refresh before I got to replying.

 

 

For an ongoing management I recommend powershell. I have a scrip that creates the users and their home drives with the correct permissions.

I'd also suggest setting of DFS name spaces.

DFS will allow you to setup share like \\domain\share\students but point it to \\fs01\students

Then when fs01 gets retired and you setup fs02 just change the target in DFS after you copy the data.

This means no messing with AD home paths again, and the users don't see a difference in the name of their drive.

You can do this with a simple dns entry rather than dfs. We do this for \\software

[mavhc]

While I'm a big fan of DFS, it does break server side indexing.

 

I modified https://gallery.technet.microsoft.com/scriptcenter/ab1e9f5a-a9e4-47d7-8afd-3a9ea19aa587

to add creation of subfolders, it was to create folders on a staff drive for pupils, with subfolders for different kinds of records.

 

Sheet 1 column F contains full pathnames, eg \\server\share\folder\name:

'######################################################################## 
'  Script name:        XLS_FolderCreator.vbs 
'  Created on:        8/2/2010 
'  Author:      Dennis Hemken 
'  Modified by: Mark Scholes, 2015
'  Purpose:  Opens an existing Microsoft Excel Document with 
'            many parent-folders (in Sheet 1, column F) and a lot of 
'            child-folder names (in Sheet 2, column A) for a batch. 
'            This VBS creates automatically parent and child folders. 
'######################################################################## 


Dim objFSO 
Dim objExcel 
Dim objWorkbook 
Dim WshShell 
Dim BtnCode 
Dim lngRow 
Dim strFolderTarget 
Dim strFolderTargetToCreate
Dim subFolders() 

Set objFSO = CreateObject("Scripting.FileSystemObject") 
Set objExcel = CreateObject("Excel.Application") 
Set objWorkbook = objExcel.Workbooks.Open ("C:\Users\blahblah\blah.xls") 

Set WshShell = WScript.CreateObject("WScript.Shell") 

objExcel.Visible = True 

objWorkbook.Worksheets("Sheet2").Activate
row = 1
col = 1
   Do Until objExcel.Cells(row,col).Value = "" 
       subFolders(row) = objExcel.Cells(row,col).Value 
       row = row + 1 
   Loop 

objWorkbook.Worksheets("Sheet1").Activate

col = 6
row = 2

   Wscript.Echo "Folder creation begins: "
   Do Until objExcel.Cells(row,col).Value = "" 
       strFolderTargetToCreate = objExcel.Cells(row,col).Value 
       objFSO.CreateFolder strFolderTargetToCreate 
	For each item in subFolders
	   objFSO.CreateFolder strFolderTargetToCreate + "\" + item
	Next   
	   
       row = row + 1 
   Loop 
   Wscript.Echo "Folder creation finished: " & strFolderTarget 

objExcel.Quit 
Set objFSO = Nothing 
Set objWorkbook = Nothing 
Set objExcel = Nothing