Home Drives & VPN

[ataylor]

I've currently looking at shifting our users from their existing file server to new ones.

 

essentially the file servers look like this

 

\\FileServer1\home\%USERNAME%

\\FileServer2\home\%USERNAME%

 

and we are looking at moving it to

 

\\FileServerOrg1\home\%USERNAME%

\\FileServerOrg2\home\%USERNAME%

\\FileServerOrg3\home\%USERNAME%

 

Most of our users are currently working remotely, this means the normal way of mapping the home drive fails as the VPN is not available before the user has logged in.

 

I have been looking at making a GPO preferences drive map to %HOMESHARE%, my current predicament is that %HOMESHARE% gets updated at login and not when on a VPN connection, so If I update the value from \\FileServer1\home\%USERNAME% to \\FileServerOrg1\home\%USERNAME% the user will still map to their old drive.

 

To resolve this I'm looking a running a scheduled task against the VPN connection event to pull the current value of the users home share from AD and update the cached copy on the local machine, then run a gpupdate /force to connect drive mappings.

 

The config for this is stored in HKEY_CURRENT_USER\Volatile Environment\HOMESHARE, now I can update this manually but it does not load into current configuration without logging the user out and back in again - Anyone have any idea how to update this live?

 

---

 

Alternatively I can map the users directly with \\FileServerOrg1\home\%USERNAME% instead of %HOMESHARE% but it adds a lot of complication in terms of security group for each organization & only applying when migrated to the new server, plus training help desk users that make user accounts to add correct security groups, make sure samaccountname is same as folder name etc.

[ITGURU]

Use DFS file shares - path stays the same just change the target.

[ataylor]

We have multiple organizations that we need to split out from existing file servers so unfortunately I can't do that.

[ITGURU]

We have multiple organizations that we need to split out from existing file servers so unfortunately I can't do that.

 

No site-to-site connectivity then between organisations?

[ataylor]

All interconnected but I need to split the data out to their own separate servers, which means different share paths.

[Steve21]

Wouldn't it be easier to put the VPN connection on the login screen via a system wide VPN and then just do the file servers normally? Then as long as they connect to it before logging in (via policy/do it email) it'll update and no hassle

 

Steve

[ataylor]

Agreed, although changing the current VPN configuration isn't really an option for us.

[ataylor]

Still a work in progress but the following VB script run alongside the vpn connection event seems to be working, just having a little trouble with gpupdate hanging when i launch it so quickly after logging in.

 

On Error Resume Next

Dim objSysInfo, objUser

 

Set objSysInfo = CreateObject("ADSystemInfo")

Set objUser = GetObject("LDAP://" & objSysInfo.UserName)

Set wshShell = CreateObject("WScript.Shell")

Set wshSystemEnv = wshShell.Environment("VOLATILE")

wshSystemEnv("HOMESHARE") = objUser.homeDirectory

 

'Refresh the USER policies and also answer no to logoff if asked.

Result = WshShell.Run("cmd /c echo n | gpupdate /target:user /force /wait:0",0,true)