Administrator access to user folders

[ReverentCreature]

On a 2016 server that I manage I have some generic accounts and have been asked to purge the home folders via script when users are logged off for data protection reasons. a message comes up at logon warning users not to save anything to home folders after log off because of this.

 

The issue I have is that as an administrator on the server I do not have permissions to look in those redirected home folders. It says in order to do so I need to take ownership of each folder.

 

I have found this issue mentioned here for server 2000 and 2003. Is this article still valid? I dont see anything newer

https://support.microsoft.com/en-gb/help/288991/enabling-the-administrator-to-have-access-to-redirected-folders

 

To make the redirected folders secure, the Folder Redirection feature performs the following actions:

• Gives ownership of the folder to the user.
  
• Sets the following ACLs on the folder:
  
• User: Full Control
  
• Local System: Full Control
  
• Prevents inheritance of ACLs from the parent folder.
  

 

It says to:

1. Locate the top-level folder that can hold the user's redirected documents (for example, D:\Redirected, which is shared as \\Server\Redirected\) by using Windows Explorer. Right-click the folder, and then click Properties. Click to clear the Allow inheritable permissions from the parent to propagate to this object and all child objects. Include these with entries explicitly defined here. check box.
   
2. When you are prompted to copy or remove permissions, click Remove. If the Administrators group is not present, click Add, type Administrators, and then click OK.
   Select the Administrators group, and then click Edit. Verify that the Full Control permission is set to Allow, and then click OK. Click Add, and add System and Creator Owner to the Permissions entries. Verify that the System and Creator Owner objects have the Full Control / Allow permission.
   
3. Click Add, add Authenticated Users, and then set the following permissions to Allow: Create Folders / Append Data Read Permissions Read Attributes Read Extended Attributes
   

[Katy]

We have folder redirection set up and "admin" (actually a group containing IT staff accounts) access works - it sounds like you have "Grant the user exclusive rights to Documents" ticked which is the one that messes with permissions.

 

On ours we have this on the second tab: