Student Home Areas - I'm Failing...

[Miscbrah]

Afternoon all - ok this admittedly I've not done in years and always found it extremely fiddly whenever I've had to. It's beating me a bit today.

 

On this network my predecessor never used the AD profile tab for home folders, was all done through a nest of scripts and GP settings. Took (what I thought would be) a leisurely Saturday to un-pick this, wish I hadn't started tbh!

 

We also map a drive here to \\fileserver\pupilmydocuments$ to allow staff to browse student home areas, which we'd like to keep.

 

 

So, in AD for a Y5 student I'm testing things on I've set the following:

 

Connect H: to \\fileserver\pupilmydocuments$\Y5\%username%

 

This works fine AS FAR AS the user's folder gets created in that Y5 folder as soon as AD is OK-ed.

 

Permissions on it (that newly-created home directory folder) are:

 

 

Should be ok I'd think. A few more admins in there than I'd probably like to tidy up but that's for another time.

 

To folder redirection in GP, which is set as this:

 

Log into a PC as a student, nothing's redirected and nothing is saved nor created in that user folder.

 

Can anyone see anything obvious I'm doing wrong/silly?

 

Thanks everyone.

 

[3s-gtech]

I don’t know your network, but your Root Path does not look right to me, at all. You’re missing a backslash between homedrive and homeshare variables, but do you need both anyway?

 

Don’t use the Move contents of Documents tick box.

[Miscbrah]

Thanks for that - happy Saturday btw!

 

Ok, got nowhere so set up a brand new share/location for these home directories. Did the tickboxes as you recommend there, looks ok and is now making the subfolders for those known folders/libraries (Pictures, Videos etc.) Set to this:

 

I think the permissions in the other one were just a bit too much of a mess to work with here.

 

At the moment all seems ok! As a kid I can browse other student home folders but can't save there/delete anything at least. Just a case now of trying to lock those down a bit.

 

It seems like every 6-7 years I'll be somewhere or move somewhere I'll have to rebuild this nonsense and I always hate it SO bad lol!

 

Thanks for helping me out there.

[Bedders]

Unrelated, but possible food for thought:

I've never seen people use the academic year in folder paths, so it has to be updated for every user each year when they move up.

I've always seen it done with the year they started at the school e.g. intake year 2014. 

 

You can always share the folders under a different name that you change, but sticking with an absolute path for that particular student seems a better way to my eyes.

 

 

[Steve21]

First issue I'd check is that you shouldn't be using the extra \
 

%HOMESHARE%%HOMEPATH%Documents

Will resolve to the full path e.g. \\fileserver\Students\25\25JSmith\Documents


Secondly it's the permissions on that folder, you shouldn't be having everyone with modify rights etc, that'd be a no no

Permissions wise I'd always advise using this (then any additional like your Staff having read permissions etc):

CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
System - Full Control (Apply onto: This Folder, Subfolders, and Files)
Domain Admins - Full Control (Apply onto: This Folder, Subfolders, and Files)
Everyone - Create Folder/Append Data (Apply onto: This Folder Only)
Everyone - List Folder/Read Data (Apply onto: This Folder Only)
Everyone - Read Attributes (Apply onto: This Folder Only)
Everyone - Traverse Folder/Execute File (Apply onto: This Folder Only)

 

Everyone only needs to be able to transverse/list/create folders at the folder level, nothing below that should be needed. Then if you're doing it via AD the Creator Owner rights will go to their own user

Then finally, they'd just need to ensure that share permissions are high enough for all users (You "can" default to Everyone at Full Control if your NTFS permissions are correct)

Steve
 

 

 

Edited October 4, 2025 by Steve21

[supportman]

Much better to move to onedrive for students. We haven't used homedrives for a few years now.

[Davit2005]

Jus one thing, why use hidden shares? If permissions are right you should not need them.

Edited October 7, 2025 by Davit2005

[Hoyt]

On 07/10/2025 at 06:59, Davit2005 said:

Jus one thing, why use hidden shares? If permissions are right you should not need them.

 

Just one less thing to worry about if someone gains access to network browsing.  It's easy to forget to remove the "Everyone" group when setting up a new share.  Also if you do need shares visible keeping most of them hidden reduces browse time a good bit.