Profile & User folders permisions

[sLiDeR]

Hi all, ok, I have a question.

 

I run a windows 2003 server with Ranger.

 

I have a seperate profiles folder to the home user folders.

 

so the make up will be:

 

'Profiles' folder. shared with all student profiles in it.

 

'Users' folder which consist of year group folders ie. 'year08', then their user area folders ie. '08BloggsJ'

 

What I need help on is setting the correct permissions, as Im sure ours are all messed up.

 

In the permissions on the root profiles folder for example are the following:

 

Domain Administrators: Full Control

Domain Administrator: Full Control

Everyone: Read & Execute

Creater Owner: Full Control

System: Full Control

Domain Users: Read & Execute

Domain Users: Special

 

What are yours? How should they be.

 

At the mo Im getting users logging off their machines & the Windows msg that the machine cant write profile back to the server.

[maniac]

Normally the root of the profiles share I have Domain Users: read/write. The reason for that is the users profile is automatically generated when the user logs on for the first time, so the user needs write permissions to the root of the profile share to create the directory and save the profile back to the server correctly.

 

Profiles are still safe as windows sets each users folder so only the user (and administrator if you have the right GPO setting) can access them, so if a user did stray across the share the only profile they could access would be their own.

 

Mike.

[CyberNerd]

If you have writable/ non mandatory profiles, why don'y you put them inside the users home directory?

[sLiDeR]

Space mate. Profiles on a different drive.

[teejay]

The special on Domain Users should be set to Create Folder/ Append data set on the root folder only. This enables the folder to be created for their profile and then Creator Owner permissions gives them full access to their folder.

The usual problem is if the owner of the folder or files gets changed, eg an admin user does fiddling and ends up taking ownership. n that case reset the owner on the folder and files to the owner of the profile.