Best set up for new users - Home drive permissions and shares?

[reggiep]

We currently create users with a home folder in a folder such as Year7/username$

We then give full permission on the folder and then restrict access through the share.

I believe that most people do this the other way with control via security permissions and give full access through the share?

 

Can anybody suggest the best set up for user home folders and security?

 

I ask as I am currently playing around with bulk user creation tools and can't see how i can use any of them with my current set up!

 

thanks

[iMash]

I would give full access through the share and then lock it down using ntfs acls.

 

there was a KB article on the suggested permissions for home folders on Microsoft. Ill see if I can find it again.

[reggiep]

Thanks, That would be good to see.

[glennda]

I have a new share for each year not user - i personally think having a new share for each user is slow for the FS - there was a thread where we discussed a while ago but i can't find it.

 

I use \\server\intake10$\%username& then have everybody full control on the share and then restrict using NTFS

 

This means AD will automagically create the home drive which it won't if its a share.

[reggiep]

Cheers Glennda, I was considering changing the share to the yeargroup but you have reassured me.

[iMash]

I can't find the KB article atm (it was originally for 2003 but the principle is still the same I believe)

 

Off the top of my head you will need to use the advanced section of the security tab on the root of the share, and use the following (its a good starting point at least).

 

System - Full Control - This Folder, Subfolders and files

Administrators - Full Control - This Folder, Subfolders and files (And any other security groups you wish to access the home drives)

Authenticated Users - List Folder / Read Data & Read Attributes & Create Folders / Append Data - This Folder only

CREATOR OWNER - I use everything but Full Control, Read Permissions, Change Permissions & Take Ownership (But it can be full control if you wish) - Subfolders and files only.

 

Hopefully that makes sense. If not I shall try to elaborate slightly.

 

If I do manage to find that article I shall post a link to it in this thread.

 

Ash

 

Edit:

 

And glennda does the same, i would use a share for the year and then allow AD to create the profiles at the students first logon within that share.

[waldronm2000]

Automatic creation of user folders for home, roaming profile and redirected folders. - Ask the Directory Services Team - Site Home - TechNet Blogs may be of some use.

[iMash]

Found it............

 

Its more based on folder redirection but the principle is the same.....

 

How to dynamically create security-enhanced redirected folders by using folder redirection in Windows 2000 and in Windows Server 2003

[glennda]

And glennda does the same, i would use a share for the year and then allow AD to create the profiles at the students first logon within that share.

 

For profiles you need to ensure a group the user is part of (say students or year group) has write permission to the root of the share - as its not AD which creates the folder it is the user on first login

[iMash]

For profiles you need to ensure a group the user is part of (say students or year group) has write permission to the root of the share - as its not AD which creates the folder it is the user on first login

 

Yes sorry, I should have been more specific. That is why you allow authenticated users permission to create a folder in the root. and then as they would be the owner they inherit the full control permissions for anything subsequently created within that folder.

 

Authenticated users could be substituted with a specific security group (for example a group representing the year).

[reggiep]

We have a mandatory profile so that is one less thing to worry about!

[Duke5A]

We also have shares by graduation year, and the student's home folder created inside of that share. Permissions are handled at the NTFS level, while everyone is given full access through share level security. Students are given every permission to their respective home folders with the exception of full control. I had an issue a few years back with students taking ownership of the directory and removing access rights from administrators. Easy enough fix, but it was causing issues with the nightly backups.