"Grant user exclusive rights" in GPO folder redirection - retrospectively disable?

[taz]

Hi

 

"Grant user exclusive rights to Contacts" (also Downloads and Searches) in Folder Redirection is enabled via GPO on our Server 2016. I need to move the home folders to a new folder on the same server. I can't open the folders for a manual copy - owner is the AD user, and system is the only other account allowed to access. I have tried DATSOU switches on a robocopy job, run as a domain administrator, but still got access denied errors.

 

I'm considering disabling "Grant user exclusive rights" in GPO Folder Redirection but am hesitant as I've read horror stories of permissions being stripped from folders lower down if done retrospectively. Has anyone successfully overcome this issue please?

 

FYI, this setting is disabled on all other folder redirection, e.g. Documents. It's only set for Contacts, Searches and Downloads.

 

thanks in advance,

Taz

[azureusnation]

From experience 'Grant user exclusive rights' is just the most annoying setting i can think of causing admins nothing but trouble.

 

If i were you, I'd take a full backup of the file server and then create a powershell script to go through and add Domain administrators to all the folders. You will also need to change the owner to Domain admins or Administrators. From there you have gotten rid of exclusive rights and also can easily move the folders at will.

 

Always always always, take a backup first. If it goes wrong, revert back.

[taz]

Thanks for the advice @azureusnation, but am keen to go for a GPO based option if possible, as I have new accounts to create, and don't want them to inherit the same issues. Have you had any success disabling this option retrospectively?

[3s-gtech]

If you disable the option and anything goes wrong with ownership and permissions, this can easily be fixed afterwards with NTFSFix and chown. You need to turn that option off in GP though, it really is a massive pain.

[azureusnation]

I've never had anything go 'wrong' before. It doesn't change any of the permissions if you uncheck the box. The folders keep all of their permissions, it just stops future folders getting the exclusive rights.

[FishCustard]

I can't imagine what use case they dreamed this 'feature' up for...

[azureusnation]

I can't imagine what use case they dreamed this 'feature' up for...

 

I believe this was an Internal thing Microsoft originally wanted for their higher ups to have complete privacy.

[FishCustard]

I believe this was an Internal thing Microsoft originally wanted for their higher ups to have complete privacy.

So set ACLs on those specific directories!