adamf Posted February 22, 2011 Posted February 22, 2011 We've just rebuilt our fileserver (having upgrdaed it to 2008 R2), restored all of the documents and everything appeared to be working fine with my documents redirection... or so I thought. When a member of staff logs in they are able to access their my documents through Windows Explorer without any problems. When they go into an application (say Word or Excel) and click File->Open, they get accessed denied because Word is trying to access the root of the share, \\servername\staff instead of \\servername\staff\%username% Any ideas why? Server is 2008 R2 Std, Clients are XP SP3, Office 2003
Ric_ Posted February 22, 2011 Posted February 22, 2011 Chances are that the file permissions haven't copied properly. Make sure the users have sufficient rights to list the folder contents of \\server\share
3s-gtech Posted February 22, 2011 Posted February 22, 2011 Remember that there are two settings that relate to My Documents, the Group Policy one and the Active Directory one. For example, I have the AD setting as \\server\directory\%username% and the GP setting as 'Redirect to the user's home directory'. You may encounter problems if using the GP setting 'Create a folder for each user under the root path'. When setting this GP up, make absolutely sure that under Settings, 'Grant the user exclusive rights to documents' is unticked!
SYNACK Posted February 22, 2011 Posted February 22, 2011 When setting this GP up, make absolutely sure that under Settings, 'Grant the user exclusive rights to documents' is unticked! As far as I know this setting leaves it with everyone having full permission which is not great for file security. Are you running a script afterwards to lock down the permissions?
3s-gtech Posted February 22, 2011 Posted February 22, 2011 (edited) Yeah, using a chown/cacls script afterwards. Edited February 22, 2011 by 3s-gtech
Slartibartfast Posted February 22, 2011 Posted February 22, 2011 If your permissions are set correctly on the root no scripts are required. The whole point of folder redirection is that the folders are correctly permissioned when created on first logon.
3s-gtech Posted February 22, 2011 Posted February 22, 2011 I found that having this setting checked in GP meant that I couldn't access the home areas without grabbing ownership, meaning that tools like Treesize didn't work, and a load of unwanted files started turning up in home folders as I couldn't check.
adamf Posted February 22, 2011 Author Posted February 22, 2011 I don't think it's down to permissions..... I've set this up on a W2K8 R2 share and a W2K3 R2 share - W2K3 works, W2K8 does not: Share Permissions: Everyone: Full Control NTFS Permissions on root share: All Staff: Traverse folder, Create Folder In terms of group policy.... Target Folder Location: Redirect to the user's home directory Settings: All 3 options are ticked I found that having this setting checked in GP meant that I couldn't access the home areas without grabbing ownership, meaning that tools like Treesize didn't work, and a load of unwanted files started turning up in home folders as I couldn't check. It's not case of the user not being able to access their home folder, it works as expected in Windows Explorer, but not from the Open dialogs in Word, Excel etc...
psydii Posted February 23, 2011 Posted February 23, 2011 (edited) Try adding the NTFS permission "List Folder/Read Data"/"This Folder only" on the root of the shared folder. The Office2003 File dialogue is not the standard one built into windows, so it's behaviour can sometimes differ to that of Explorer's. If that doesn't work, add in order: Read Attributes Read Extended Attributes Read Permissions (This folder only) By the time you've done that you've basically assigned 'Read and Execute' (this folder only). I'm not sure if you have a good reason not to want this level of access to that folder? If you can live with it, great, if not you could then try itterating through removing a Read permission at a time until it stops working again. Edited February 23, 2011 by psydii 1
adamf Posted February 24, 2011 Author Posted February 24, 2011 Try adding the NTFS permission "List Folder/Read Data"/"This Folder only" on the root of the shared folder. The Office2003 File dialogue is not the standard one built into windows, so it's behaviour can sometimes differ to that of Explorer's. If that doesn't work, add in order: Read Attributes Read Extended Attributes Read Permissions (This folder only) By the time you've done that you've basically assigned 'Read and Execute' (this folder only). I'm not sure if you have a good reason not to want this level of access to that folder? If you can live with it, great, if not you could then try itterating through removing a Read permission at a time until it stops working again. That fixed it! Although, why it worked on a W2K3 share without those permissions I do not know! Thanks
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now