Home Folder Shares

[Gatt]

In the process of creating new AD structure for next year, and reviewing the home folder structure we have at present

 

currently it is \\file-server\pupils\year xx\%username%

where pupils is the share name

 

But this is causing some problems with permissions (some kids have found they can hit this directory and view its contents)

 

Is it possible to stop them viewing the contents of pupils and also the year xx folders, but still have the appropriate rights to their own folder?

 

Or would it be easier to share their actual home folder itself?

[pete]

We do it as \\server\users\year\username$, where username$ is the share name.

 

The blind share can lead to issues with scripting if you don't escape the "$" properly, but apart from that - not a problem.

[plexer]

We share the users actual folder as well as a hidden share.

 

Prevents the problems you've seen I have

 

users\students\00\%username%$

 

I also share the 00 folder so that staff can have a shortcut to it to navigate down to a students home folder.

 

Ben

[ChrisH]

Putting a "$" on the root share seems to sort this problem for me. The only permissions they have are for their own folders so if they tried \\fileserver\pupil$ they would get access denied.

[Geoff]

Putting a "$" on the root share seems to sort this problem for me. The only permissions they have are for their own folders so if they tried \\fileserver\pupil$ they would get access denied.

 

This is the best solution. IIRC it's even the recommended method as per the MS documentation/courses.

 

As an aside, it also makes using pam_mount dead easy on Linux if you want to use Linux desktops and keep the file areas seamless.

[Guest]

Yep same here.

 

\\Servername\users$ root share

 

\\Servername\username$ users home folder

[Gatt]

Cheers folks, that's pretty much how im gonna go now

[Ric_]

@Gatt: I use the same folder structure. I have a script that you can run over the same folders and it will sort the permissions and ownership. If they do browse the share, they can only see a list of folders and they cannot get into them.

 

If you want the script, PM me next week - I will definately forget about it by Tuesday!

[ChrisH]

If forgot about this as well which I posted a while back.

 

http://edugeek.net/index.php?name=Downloads&d_op=viewdownloaddetails&lid=16

[PiqueABoo]

Doesn't really matter if your NTFS permission are right, but I don't really see much point in making share hidden when their names are predictable.

[Ric_]

@PiqueABoo: Hence the script that I use

[ITWombat]

Doesn't really matter if your NTFS permission are right, but I don't really see much point in making share hidden when their names are predictable.

 

and *nix browsers (MacOS X and Linux) ignore the $ anway .

 

Does having a share per folder have performance hit?

[Frazer]

I set ours up like this for last years 'year 7':

 

\\server\users\2005intake\%username%

 

Users shares permissions are: everyone full access

Users folder permissions are: domain admins full access only

2005intake folder permissions: domain admins full access only

%username% is autocreated when you make the account, giving the user full access and permissions filterting down from users\intake to give domain admins full access.

 

This stops them snooping around your user folders and also stops them saving random files to the users\intake folder instead of their homedir.

[Quackers]

I set ours up like this for last years 'year 7':

 

\\server\users\2005intake\%username%

 

Users shares permissions are: everyone full access

Users folder permissions are: domain admins full access only

2005intake folder permissions: domain admins full access only

%username% is autocreated when you make the account, giving the user full access and permissions filterting down from users\intake to give domain admins full access.

 

This stops them snooping around your user folders and also stops them saving random files to the users\intake folder instead of their homedir.

 

Thats how i do my Home Directorys, i do not see the point in having a share for each user. Its very clean and quick doing this way.

[Gatt]

I set ours up like this for last years 'year 7':

 

\\server\users\2005intake\%username%

 

Users shares permissions are: everyone full access

Users folder permissions are: domain admins full access only

2005intake folder permissions: domain admins full access only

%username% is autocreated when you make the account, giving the user full access and permissions filterting down from users\intake to give domain admins full access.

 

This stops them snooping around your user folders and also stops them saving random files to the users\intake folder instead of their homedir.

 

Thats how i do my Home Directorys, i do not see the point in having a share for each user. Its very clean and quick doing this way.

 

Think i'll give this a go as my File Server is overworked as it is - last thing i need is 1200+ shares running off it

 

just need to setup LimitLogon too so the little darlings cant log in multiple times

[NetworkGeezer]

LimitLogon? Who, what, where, gimee!!!

[Dos_Box]

More here.

http://www.thincomputing.net/newsitem296.html

[Ric_]

IIRC ChrisH was developing his own version of LimitLogon which was a little (read much) better. Chris?

[Benji1]

we use maxlogons by flocs. It only costs £80 for a site licence and you'll have in running in no time at all. You add your users into groups depending on the number of times you want them to be able to log on. Say you want a year 11 Art student to be able to logon to to any two machines you just put them in the maxlogon2 group.

 

Anyone want to demo it go here :-

http://www.flocs.com/products/maxlogons/default.htm

[ChrisH]

IIRC ChrisH was developing his own version of LimitLogon which was a little (read much) better. Chris?

 

Yes but its still at the drawing board really and that microsoft one would be better in alot of ways with the AD integration. Maybe I should stop doing 90 % of a project and starting something else *Note to self: finish of the AD bulk user script as it's nearly done .

 

There is a series of scripts here that deals with tracking user logins that could be used as a basis for such a script as well.