GP Targeting users that are not targeted

[TerencePIT]

We use GP to map exam drives to users that need access to these after the exam is completed.

On the general tab we have location set as the stored area on the network where the exams are held and to the particular folder they are wanting.

Then on the common tab we tick 'Run in logged-on user's security context (user policy option) & Item-Level targeting.

---------------

For targeting we do the following:

the folder exists "Network file path from the location in the general tab"

AND this collection is true

user.1

OR user.2

---------------

 

The users are the ones that are need access to that specific folder.

 

What we have noticed in event viewer on other users is that the drive is trying to be mapped to them but they are not targeted. Why is this?

I have attached pictures of how we set up our Folder Mapping for the specified users and an example of the error we are seeing for the ones that are not in the targeting but still have the drive attempting to be mapped to them.

[psydii]

Filter by user, then by access to drive? Otherwise it has to try to access the share/folder for all users in order to evaluate this condition.

 

(I'd have thought. Never actually tried this combo of filtering rules)

[psydii]

Filter by user, then by access to drive? Otherwise it has to try to access the share/folder for all users in order to evaluate this condition.

 

(I'd have thought. Never actually tried this combo of filtering rules)

 

Addendum, applying policy/security/ACEs really should be done to groups rather than individual users, even when there is only one (or two) user to which the policy applies. I tend to align group names with policy names (and settings if we need to get that specific).

[DavR]

You could just drop the "if folder exists" condition to simplify that mapping. If the folder doesn't exist, it won't map, and will fail silently.

 

I'd second using a group. You'd then only need one condition, if user is member of group, and that will map the drive to the targeted user.

 

For what it's worth, we don't use "Run in logged-on user's security context".

[TerencePIT]

Thanks all,

 

Tested the dropping and it removed it. Side note: we have a read only security group and adding this to the user with the error stopped this happening. So NTFS issues in the end

 

Thanks