How do you do user shares?

[sidewinder]

Basic question, do you have one share for each user (as we do currently), or one share per staff type/year group etc and then map to a subdirectory of the share?

 

And does it make any difference?

 

Im thinking of going the single share way due to the fact its a hassle to remember to unshare folders if they're going to be moved to another location or deleted

[ajbritton]

I have one share for all staff and one for all students.. unless I have to cope with any Win9X/ME PCs. The only problem I've noticed is that Office (might be certain versions only, I have not checked) likes to have explicit traverse access to the folders above the user folder but below the share. So if D:\User\Staff was shared as 'staff' and subfolders were individual user folders, then you would need to make sure 'Authenticated Users' have 'traverse' rights on D:\User\Staff (this folder only).

[MkII]

One share - hidden - on curriculum server fo kids, another set up the same for staff on a child domain.

 

The advantage is like ajb says - users have no rights to browse the underlying share if you share their home folders explicitly - tho' they shouldn't be able to access any folders anyway.

[plexer]

I use one share per user.

 

i.e \\server\username$

 

Ben

[ChrisH]

With a Server 2003 system you can enable access based enumeration if you download the tool from MS to enable it. This will mean that users cant see folders they dont have permission to access so it doesnt matter if they manage to go up a lovel from their folder etc.

[Ric_]

I use the same method as AJ... in my case though, my files reside on a SAN with a virtual drive for Y7 to y11 connected to one server and a second server with staff and y12 to y13 (2 virtual drives). This way some of the load is shared when serving files.

[ajbritton]

With a Server 2003 system you can enable access based enumeration if you download the tool from MS to enable it. This will mean that users cant see folders they dont have permission to access so it doesnt matter if they manage to go up a lovel from their folder etc.

 

I think that's 'sot of nice', but probably more confusing than anything else. When you get a support call from a user unable to access a file/folder and they are getting 'access denied', then you know what you need to do. If you get a support call from someone saying 'I can't find....', then first of all you have to establish that they are in the right place and only then do you twig that it's a permissions issue.

 

Any examples of when this feature would actually benefit anyone? (bearing in mind that if all you want to do is hide a folder, it needs to be a sub-folder of a folder that those you wish to hide it from cannot read).

[ChrisH]

Its good for the example you gave in your previous post of home folders. It isnt a universal setting and can be set per volume maybe even more granular now but I can remember without looking it up.

[Ric_]

... but I can remember without looking it up.

 

Perhaps in the Mark Minasi book that I am now denied access to

[sidewinder]

With a Server 2003 system you can enable access based enumeration if you download the tool from MS to enable it. This will mean that users cant see folders they dont have permission to access so it doesnt matter if they manage to go up a lovel from their folder etc.

 

I was actually thinking of trying this as I was reading my R2 book earlier

 

Thought I could possibly map everyone to the same share but they'd only see their own folder

 

I think ABE is quite useful in that respect, but I wouldnt use it for the common area or anything or it will lead to calls like aj describes

 

AJ - You talk about having to set traverse rights - surely this could lead to problems as users would be able to navigate up to the root of the share and see everyones folders?

[Ric_]

AJ - You talk about having to set traverse rights - surely this could lead to problems as users would be able to navigate up to the root of the share and see everyones folders?

 

Surely seeing and being able to do anything with the folders are two entirely different things

[sidewinder]

AJ - You talk about having to set traverse rights - surely this could lead to problems as users would be able to navigate up to the root of the share and see everyones folders?

 

Surely seeing and being able to do anything with the folders are two entirely different things

 

Of course

They cant do anything with them but ideally Id still prefer they couldnt see them

I suppose though that would be where Id use access based enumeration

[sreiach]

I have a slightly modified approach.

 

My Home folder structure mirrors my AD structure.

So in AD its like this:

 

Students

->2005

->2006

->2007

 

Each year (OU) based on the students graduation year. Their user areas are the same:

 

\\server\Students$\2005\firstinitiallastname

 

So each student gets there own user area which is directly mapped to u: So students never even see another students user area.

 

This structure makes it easy so that at the end of the year I just delete the OU and the year folder containing the individual student folders. Easy cleanup.

 

I have some kids who leave before graduating but thats easy to take care of by hand or with a script.

[thom]

I also use the approach of mirroring my AD structure.

It keeps it simple for managing the access as it is all laid out the same.

I don't map drives though. I use folder redirection in group policy to create a user folder in the appropriate share.

For example, i have a server \\0Files with one share on it called \Home

In group policy i set it up like so...

if user is in STAFF group link "my documents" to \\0Files\Home\Staff\%USERNAME%\My Documents

If user is in the 2002 INTAKE group link "my documents" to \\0Files\Home\Students\2002Intake\%USERNAME%\My Documents.

 

The bonus of doing it this way is that it creates the folder with the correct permissions the first time a user logs in.

It was a bit buggy in 2000 but seems to work great with 2003 and XP.

[k-strider]

Doesn't having one share per user put a lot of extra work on the server? and a lot of work on you if you start moving things around...

 

it used to be like that when i came and it was NT4...

 

now everything is mapped through the DFS name space so i can move things around the servers without people noticing..

 

so for example

Students:

\\dfsnamespace\dfssharename\home\Yearofstudent\%username%

and say staff are:

\\dfsnamespace\dfssharename\home\staff\%username%

and no teaching:

\\dfsnamespace\dfssharename\officestaff\%username%

 

And the non teaching staff are on a different server to the students and staff

 

We do folder redirection using the DFS name space too.

[woody]

One share for each year. Group Polcy set to redirect 'My Documents' to user folder. Also creates user folder if one not already in existence. There is a KB on Microsoft's site on how to set up the security settings on the share to stop pupils seeing other's folders, but to keep Administrator access open:

 

http://support.microsoft.com/kb/288991/en-us

 

I know setting up home folders is the traditional way with a windows server, but I prefer this way and I've never had any problems with it. I would be interested to know the benefits of using home folders over this method though.

[dbrown]

Are there any costs/benefits in performance, from having many shares like 1 per user for home dirs compared with having few shares on a server and using subdirs of a share for users' homes?

 

In a similar vein, are there any reasons not to have many security groups to facilitate tailoring users' environments?

 

I remember in earlier times being given dire warnings against having too many or too long ACLs in NT and against having large numbers of subdirs especialy in the root directory. I guess these worries have long since disappeared in the enormous increases in RAM and processing speed. But network response times still seem to be an issue, so I like to know the price I am paying for any changes I make.

[gshaw]

With the one share per user is the share creation automated via a script of some sort?

[dbrown]

Here, Ranger does this for me (option tick box.)

Previously I used a script, but did not have individual shares, so I'm not sure how I would do this. I guess adding a Net Share line to the script would do the necessary, but I've never used the Net Share command.

[Michael]

For pupils I create a root folder called Students or Pupils, then create subdirectories. Year 3, Year 4, Year 5, Year 6 etc... I then have a small utility which creates folders from a text folder (very handy) and I then use Autoshare to share the folders:

 

\\servername\username$