Staff shared drive structure & permissions – how are you managing yours?

[MattGibson]

Hi all,

I’m doing a bit of fact-finding and would really appreciate hearing how other schools are managing their staff shared drives.

In particular, I’m interested in how you handle structure and permissions. For example:

• Do you allow staff to create folders at the root of the shared drive, or is that locked down?
• Do you enforce a standard folder structure (e.g. by department like Science, English, Maths), or let departments/staff organise things themselves?
• Who typically manages the content and structure within departments – IT, HoDs, or someone else?
• How are you handling permissions – open access within departments, or more granular (read/write/restricted areas)?
• Have you found a good balance between keeping things tidy vs giving staff flexibility?
   

I’m reviewing our current setup and trying to decide whether to move towards a more controlled, structured approach or keep things a bit more flexible.
 

Would be great to hear what’s working well for you (and equally anything you’ve tried that didn’t go so well!).

Thanks in advance 👍

[synaesthesia]

It can differ a bit depending on the tech you're using - as a Google school, we have limited root drives for each department where only IT and the curriculum leader(s) for that dept have manager access and can create folders, view files internally etc. Google is limited with permissions, so you can't give everyone view permission at the root but lock down further folders like you can with on site or Sharepoint. Once that's done, each department is pretty much left to it with this in mind so if they have a HoD folder noone else should have access to, they know to store that in the root and add permissions accordingly.

We give guidance and it would be nice to keep it as a standard, but we always ended up with so many exceptions "X needs it for Y" that the "standard" in fact became the outlier - mostly as one size never actually fits all, no matter what the government/DfE would like schools to believe

[Sylv3r]

We've moved all our departmental shares to either MS Teams or Sharepoint so don't have anything local anymore, but to answer your other questions:

• Do you allow staff to create folders at the root of the shared drive, or is that locked down? It's not locked down as such, but staff shouldn't be creating anything in the root
• Do you enforce a standard folder structure (e.g. by department like Science, English, Maths), or let departments/staff organise things themselves? There would have been a folder per subject initially, now it's a sharepoint site / team per subject
• Who typically manages the content and structure within departments – IT, HoDs, or someone else? I would say it's a departmental effort, however overall responsibilities lies with the HOD
• How are you handling permissions – open access within departments, or more granular (read/write/restricted areas)? Only the staff in each department can view the department resources, supply staff can see all departments.
• Have you found a good balance between keeping things tidy vs giving staff flexibility? I wouldn't think it's tidy, but it does appear to work and departments just get on with it now. It required a bit of training initially to explain that OneDrive belongs to you and the Team / Sharepoint is the department collaboration area. We had initially too many sharing folders from within their personal OneDrive areas.

 

 

[psydii]

 

[psydii]

54 minutes ago, MattGibson said:

 

Hi all,

 

I’m doing a bit of fact-finding and would really appreciate hearing how other schools are managing their staff shared drives.

In particular, I’m interested in how you handle structure and permissions. For example:

• Do you allow staff to create folders at the root of the shared drive, or is that locked down? No, its locked down. (role_allstaff_members is a member of fs_staffshare_readonly, and fs_staffshare_readonly has (you guessed it_) read only access to the top level folder, everyone/authenticated users are removed from the acl)
• Do you enforce a standard folder structure (e.g. by department like Science, English, Maths), or let departments/staff organise things themselves? Yes each group of roles that might be considered a "team" has a role_rolename_members group, and a folder in the staffshare where only members of that group (well, its fs_ equivelant) have full control
• Who typically manages the content and structure within departments – IT, HoDs, or someone else? Within departments - up to them. I encourage new depts to check in with other teams to see how they do it.
• How are you handling permissions – open access within departments, or more granular (read/write/restricted areas)? Details in the links above. access is granted through resource groups: resouretype_asset[e.g. foldername]_accesslevel and the only members of these are the role_ groups who need to access that resource.  admins get access by adding themselves to the group,  as needed with the SOP to remove themselves when done. Everything syncs to 365 so we get a great audit trail too.
• Have you found a good balance between keeping things tidy vs giving staff flexibility? works fine. we create a a handful of new folders/teams/groups each year. we have a script we customise for each one that acts as a record on how we did it, and DR for if we need to recreate everything. Staff flexibility is maintained the all work in their dept areas, or team areas. There is a central area for cross team sharing that it managed by the PA for resorces that need it. Woe betide anybody who drops stuff there without permission.
  
  Of course all this is now done via Teams so we (mostly) don't use the resourcetype_asset_accesslevel groups, as sharepoint/365groups handles this for us.  However in the central area or for some edge cases (e.g. SEN with 'alternative' document libraries for some data) they are still used. That said, we sync the role_ group members to the Teams equivelants.

 

[itskdog]

We try to keep it simple, staff have read & write access to the main staff shared drive (on request, not by default unless they're a teacher), and for anyone such as the SEN department or SLT that need restrictions, they get their own drive.

[Rob_D]

Each department/CA has their own Team/SharePoint site with preset folders for teaching resources (broken up by year group and shared with students) and staff only resources, within those folders we let them do what they want. Teachers in the department/CA have full access, other staff have read only access.

 

For more centralised stuff, we try to do permissions at the library level rather than having folder permissions.