OneDrive Migration - Read Only Home Directories

[Bankesy]

Good morning all,

 

We've had a migration of user home directories from the on-prem file server to OneDrive this week (at last).

 

It's all gone fine and I've got auto log-in\redirection working with GPOs which I know is the old way but I haven't done it via Intune before so I didn't want to risk it.

 

My question now though is how to cleanly remove the user home directories on the server, I wanted to put them in read-only for a couple of weeks but can't seem to find anything online that works. I know the infrastructure engineer I worked with at my last place did this somehow.

 

Any thoughts?

 

Thanks

[munkey]

If the users are already redirected to OD rather then onprem storage is there a need to share the onprem profiles still? - You could set NTFS permissions to read only but no-one should be accessing it if redirection is working correctly unless I'm misunderstanding it

 

After our OD migration we just kept the file server spinning but only un-shared the user profiles location. If there was anything that failed to migrate they got in contact with IT but there wasn't a single ticket raised in the end. After a couple of terms this was captured to tape backup anyway so could be wiped from the server

[Bankesy]

@munkey

 

It turns out redirection isn't working properly, that was just an illusion because the user for testing had already replaced their 'My Documents' shortcut with one that points straight to OneDrive because that's all they were using but that only came to light in the last few minutes. So I need to review why that's not working but yes I take your point, what was your method for un-sharing the user profiles location?

 

Thanks

[Bankesy]

Update:

 

When users log into Windows they get auto-signed-in to OneDrive with Documents, Pictures etc. all redirecting correctly.

 

But the 'Documents' link under Quick Access doesn't point anywhere, it's not showing the directory on the file server nor the OneDrive redirection.

 

Anybody any clues as to what might be happening there? I'm going to check the Event Log...just typing and thinking is making me feel better

[Davit2005]

Personally I'd Either remove the share or make the share RO. That way you can leave NTFS permissions alone till you know that it will not be needed anymore.

[munkey]

I un shared it from the file server, so run fsmgmt.msc on the file server, under shares find the one right click and stop sharing

 

Have a ganders as to what's under the registry location "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" to see if there are any blanks as that's where known folder locations are defined, although not sure why it's removed the path all together as I've not seen folder redirection do this. If it is blank and is happening to every machine a workaround could be a login script to set the missing registry value

[DaveTheTech]

PS Script to help OneDrive Migration (edugeek.net)

The above post might help.

TLDR:

Home drive marked as read only

windows library / folder redirection in place

mapped drive for home drive kept in place

remove drive mapping after a period of time

[Bankesy]

Thanks, everyone, I've fixed my redirection issue. Me being silly and only applying redirection on the user side of things but not on the device side although I realise now one thing I didn't account for was how long the redirection policy takes to apply at logon for those users with a huge amount of data.

@Davit2005 @munkey appreciate the info regarding the shares, I was focusing too much on users not being able to edit their folders and forgetting that I could do something at the level above.

@DaveTheTech cool script

[Bankesy]

If anybody is still following this I have a new issue, students can't access 'Documents' or OneDrive "Due to restrictions in effect on this computer" which I gather is due to them not having access to the C:\ drive

 

Does anybody have any advice on this beyond allowing access to the C:\ drive?

 

Thanks

[thimon]

Just grant users access to the C drive. Never understood why people disabled access. As long as permissions are correct there shouldn’t be an issue.

[DrCheese]

Just grant users access to the C drive. Never understood why people disabled access. As long as permissions are correct there shouldn’t be an issue.

 

Yup - If you have your systems setup correctly (eg Students aren't admins) they can't do any damage or launch dodgy stuff anyway.

[Bankesy]

Well I've changed the setting in a GPO for "Prevent access to drives from My Computer' to 'Do not restrict drives' and this appears to have fixed it while keeping the C:\ drive hidden