Student Home Folders - best practice

[kennysarmy]

Looking to move from our "it's always been done like that" method of creating/sharing home drives to something more standard.

 

The current system is:

 

Student accounts are created in AD, with the logon name being their 4 digit SIMS admissions number. eg:

 

7333

7334

 

In the Profile tab, Home folder section we set:

 

Connect H: To: \\FS\7333$

 

 

On the file server FS a folder is created for each year group, by year of entry. eg:

 

D:\users\PupilDrives\2019 (current year 7)

D:\users\PupilDrives\2018 (current year 8)

 

these are then populated with the user's folders. eg:

 

D:\users\PupilDrives\2018\7333

D:\users\PupilDrives\2018\7334

 

 

D:\users\PupilDrives\2018\7333 will be shared as 7333$

 

The share 7333$ will have a limit of 5 simultaneous users

The share 7333$ will have permissions set of Everyone : Full Control

 

The folder D:\users\PupilDrives\2018\7333 will have the following security set:

 

Creator Owner : Full

Staff : Read

7333 : Modify

Domain Admins : Full

FS\Administrators : Full

 

A Documents folder is created in the user's folder:

 

D:\users\PupilDrives\2018\7333\Documents

 

 

A Group Policy Object applied at the Pupils branch in AD and has the following settings:

 

User Configuration -> Policies -> Windows Settings -> Folder Redirection

 

Documents : Setting: Basic (Redirect everyone's folder to the same location)

Path: %HOMESHARE%%HOMEPATH%\Documents

 

Downloads : Setting: Basic (Redirect everyone's folder to the same location)

Path: \\fp5\%username%$

 

Music : Setting: Follow the Documents folder

Pictures : Setting: Follow the Documents folder

Videos : Setting: Follow the Documents folder

 

 

I'm looking for best practice, everything works well using the setup above APART from having to educate teachers to add the "Filename" column in to Explorer as the pupils folders can all show up as "Downloads" with a blue downward arrow. I do run a script to remove the desktop.ini file every hour !

[Joanne]

If you redirect the downloads to the path: \\fp5\%username%$\Downloads wouldn't that then create a downloads folder in the user area and stop all the folders from appearing as downloads?

[kennysarmy]

If you redirect the downloads to the path: \\fp5\%username%$\Downloads wouldn't that then create a downloads folder in the user area and stop all the folders from appearing as downloads?

 

I'll investigate...

[Chaniel]

One thing I've always questioned (seen it in multiple schools now) is why the individual shares? Why not just have it as \\domain\students\2019\%USERNAME% for the homedirectory for all year 7's? Only one share for the root "Students" folder and NTFS permissions lock down the other folders so they can only see what they have access to (aka their own drive)

 

For folder redirection, we redirect all the individual subfolders like follows;

 

Documents: %HOMESHARE%%HOMEPATH%Documents

Music: %HOMESHARE%%HOMEPATH%My Music

Downloads: %HOMESHARE%%HOMEPATH%Downloads

 

etc. We don't have any issue then with Desktop.ini files then as deleting them/denying them (using FSRM) slows down logins in W10. We cut like a minute off our login time by allowing Desktop.ini files. Makes it easier for staff too!

Edited November 6, 2019 by Chaniel

[kennysarmy]

One thing I've always questioned (seen it in multiple schools now) is why the individual shares? Why not just have it as \\domain\students\2019\%USERNAME% for the homedirectory for all year 7's? Only one share for the root "Students" folder and NTFS permissions lock down the other folders so they can only see what they have access to (aka their own drive)

 

For folder redirection, we redirect all the individual subfolders like follows;

 

Documents: %HOMESHARE%%HOMEPATH%Documents

Music: %HOMESHARE%%HOMEPATH%My Music

Downloads: %HOMESHARE%%HOMEPATH%Downloads

 

etc. We don't have any issue then with Desktop.ini files then as deleting them/denying them (using FSRM) slows down logins in W10. We cut like a minute off our login time by allowing Desktop.ini files. Makes it easier for staff too!

 

If that way is the "standard" I'll move towards it, just need to get my head around how I move from one method to another seamlessly without affecting the users and if it can be done during term-time or if it's best done over a holiday period.

[ITGURU]

One thing I've always questioned (seen it in multiple schools now) is why the individual shares? Why not just have it as \\domain\students\2019\%USERNAME% for the homedirectory for all year 7's? Only one share for the root "Students" folder and NTFS permissions lock down the other folders so they can only see what they have access to (aka their own drive)

 

For folder redirection, we redirect all the individual subfolders like follows;

 

Documents: %HOMESHARE%%HOMEPATH%Documents

Music: %HOMESHARE%%HOMEPATH%My Music

Downloads: %HOMESHARE%%HOMEPATH%Downloads

 

etc. We don't have any issue then with Desktop.ini files then as deleting them/denying them (using FSRM) slows down logins in W10. We cut like a minute off our login time by allowing Desktop.ini files. Makes it easier for staff too!

 

We use a similar format for home drives \\domain\students\2019\%USERNAME%

However have to block desktop.ini because when users access the year folder, all the folders appear as 'my documents' How did you get around this? blocking desktop.ini allows the folders to the individual user names correctly.

[Boredguy]

We moved away from the separate shares to just a single one with the student folders below and map to them as posted above as it cut down on a lot of the overhead when creating new accounts.

 

If you just share pupildrives folder, you can update the homedrive in bulk using the %username% in the path field (\\FS\PupilDrives$\2019\%username%\documents)

[kennysarmy]

We moved away from the separate shares to just a single one with the student folders below and map to them as posted above as it cut down on a lot of the overhead when creating new accounts.

 

If you just share pupildrives folder, you can update the homedrive in bulk using the %username% in the path field (\\FS\PupilDrives$\2019\%username%\documents)

 

On my test user I get the following:

 

 

 

The folder location definitely exists!

 

[kennysarmy]

Connected to another DC and it worked

[Boredguy]

On the initial message, select no and carry on, as it does not need to update the NTFS permissions

[Chaniel]

We use a similar format for home drives \\domain\students\2019\%USERNAME%

However have to block desktop.ini because when users access the year folder, all the folders appear as 'my documents' How did you get around this? blocking desktop.ini allows the folders to the individual user names correctly.

By changing the folder redirection for Documents from %HOMESHARE%%HOMEPATH% to %HOMESHARE%%HOMEPATH%Documents

 

This then makes a subdirectory for Documents within their home directory and the desktop.ini file isn't made in the root, so the folder name is displayed correctly in the full directory. Hope that makes sense...

 

 

[kennysarmy]

Test user now has the H:\ drive mapping as follows:

 

[Boredguy]

In each of our Student folders, we have a Documents folder which contains their work, and also a Profile.V2 for their W7 mandatory profile

For the Folder Redirection in GPO, we just set it as which then just shows as the Drive letter and not the UNC path

 

Not really much need to use homeshare and homedrive, as long as homedrive is configured in AD.

Edited November 6, 2019 by Boredguy

[kennysarmy]

For all my student folders such as :

 

D:\users\PupilDrives\2018\7333

 

Should the permissions be set specifically on the folder or should it inherit everything PLUS the users:Full permission?

[Boredguy]

Our root folder has basic permission, such as a AD group that has read access in case we need to allow a member of staff access to a students folder.

Then on each students "root" folder we have special permissions assigned for their account, basically to ensure that anything within documents they have full control off, but no ability to delete the document folder just in case they somehow manage to see it.