OneDrive

[Jackk]

Hi

 

Just a quick question / sanity check.

 

We're wanting to start to test using OneDrive to eventually replace our network storage.

 

Having a look through the GPO's for this, the OneDrive stuff is a computer policy, not user... I'd prefer us to do a phased migration, so just wondering if anyone else has managed to facilitate this, or if I'm being really stupid (it is Friday - go easy on me). I just want to try it on a few users at a time, not on a few machines...

 

Any ideas is greatly appreciated!

 

Jack

[DJ-1701]

Unfortunately a lot of control is only workstation only. When trailing I've basically only set the Run registry command for OneDrive to only be active in the people I want to have the software work on.

[thimon]

Are the staff devices 1:1 or shared? You could apply your OneDrive GPO to just a targeted group of computers. You can have OneDrive running along side having network storage setup for users. The real change would be to push out settings to redirect the Documents, Pictures, Desktop, etc folders to OneDrive, instead of network storage folders. This is all done via user settings, so can be targeted to specific users via Group Policy.

[broadld]

Good afternoon All,

 

So there is no way to do a phased migration to Onedrive. As forcing the known folders setting only seems to be a computer policy.

Why would Microsoft not have a user policy for this so you could target specific user groups.

For instance we are wanting to trial this with our new Year 7 intake. Obviously any pupil can use any PC really so we cannot target this policy at devices.

 

Thanks

David

[Boredguy]

It is possible to have OneDrive running with only a select group of users. It just comes down to not using the Known Folder Redirect aspect.

 

We set all our students to use OneDrive last summer, and in January we set it up for Staff as well, but as an additional duplicate of their account (we left their mapped network drive)

Then in May we updated the staff policy so that the Redirect policies for Documents etc were set to be the OneDrive folder and no the network drive.

Once I've resync'd all the staff areas next month, the network drive itself will be removed from our staff so they are the same as Students.

 

Basically as long as you have OneDrive deployed out with the /allusers switch, and the correct policies in place you can then use 2 AD groups to have your "OneDrive Only Users" and "Local Drive Users" to set the folder redirection that you want (since OneDrive creates a dedicated folder in the C:\Users\ path)

[jmak]

From here: https://docs.microsoft.com/en-gb/onedrive/use-group-policy

 

and as per what @thimon says, my understanding is that you can apply it to specific users

 

Link the Group Policy objects (GPOs) to an Active Directory container (site, domain, or organizational unit). For info, see Link Group Policy objects to Active Directory containers.

 

Use security filtering to narrow the scope of a setting. By default, a setting is applied to all user and computer objects within the container to which it's linked, but you can use security filtering to narrow the scope of the policy's application to a subset of users or computers. For info, see Filtering the scope of a GPO.

[/Quote]

[DaveTheTech]

This thread outlines what I done here:

PS Script to help OneDrive Migration (edugeek.net)

[broadld]

Thanks some really good information. Is everyone using folder redirection into the OneDrive folder then rather than the known folder OneDrive group policy setting?

I also got stuck getting OneDrive to SSO. It turned out we didn't have Single Sign on set in AD Sync. We also didn't have our machines OU synced so they weren't hybrid azure joined. Which I believe is a requirement for SSO to work properly.

[thimon]

We used folder redirection so all the OneDrive Documents, Desktop, etc shortcuts would be in place, with users file share home drive still mapped. We opted to get users to migrate files themselves in parts, worked quite well. When everyone had migrated we unmapped their file share homedrives.

[evasion]

About to migrate students first but tricky part is getting OneDrive gpo to work by syncing desktop folder of users on local profile with restricted access to C: drive.

Basically it only works fine when users have hidden access to C: drive and because they are to be on local profiles they will then have open door to access C: drive. This is security issue itself which renders use of OneDrive useless if C: drive access is to be fully restricted. And it has to be that way, so good bye to this project or else?...

Only got this far after extensive testing with users folders redirected to OneDrive including desktop, which is where it stops to work if C: drive access is restricted.

[thimon]

Why have you restricted access to C drive? As long as all the correct permissions are in place there shouldn’t be a problem allowing access, which will then allow OneDrive to work properly. All our users have access to C drive.

[evasion]

I have been convinced that is is good network practice to restrict access to OS drive (c:) via GPO so that computers are locked and cannot be hacked easily. This applies to student users only. I cannot comment on your network security though.

[KK20]

This is how we phased the migration.

 

1) informed users and ran a few session on what we were doing and WHY.

2) used "cloud drive mapper" to map H: to everyones onedrive (whether they were in the trial OU or not)

3) picked a trial OU of users. Set their "my documents" to read-only.

4) users could use their documents for reading but had to save changes to their H: drive.

5) once all OU were part of the "read only local" restriction, give people 6 months before their documents were switched off.

6) switch off the "my documents" redirect. Set "my documents" to be onedrive. Leave H: because it is ingrained in their usage (but in reality can use both)

7) perform 2x hard offline archive backup of the "my documents" and retire the server.

 

Took just over a year for us and worked fine.

Edited August 2, 2021 by KK20