Permissions on Student Home folders

[kennysarmy]

Quick quetion.

 

Student H:\ drives (home shares) are held on a 2003 R2 Server.

 

When I set up new students I go in to the new folder properties and then Sharing tab:

 

in "Permissions" I edit this to EVERYONE : full control

 

On the Security tab I edit so it says:

 

Administrators : Full Control

Creator Owner : Full Control

Domain Admins : Full Control

Staff : Read & Execute, List Folder Contents & Read

*specific user * : Modify

 

Will this cause any problems with the user not having Full Control?

 

What does everyone else do?

 

Cheers

[jsnetman]

The "specific user" entry looks wrong to me. It will be surpassed by the creator owner as the user will then be given full control as the owner. I may be misunderstanding your question though, is the specific user the actual user assigned that home folder, if not then it looks right.

[SteseD]

I've always been told, and follow that users should never have full control on their own folders, if only to prevent new files/folders being created which the Administrator is not the owner of.... so from my knowledge, everything is fine in your setup... (let me know if you get issues)

[6Foot2]

When creating our users we use AD to setup the Home Folder. We point AD at the location and then the folder is created automatically.

 

The permissions created this way are for the Specific User, Full Control.

[kennysarmy]

I've always done modify and don't think we've had any issues to date.....

[cyr0n_k0r]

best practice is to set profile folders as Full Control with the user also being set as the owner.

Userfiles folders should be set to Modify with the user also being set as the owner.

 

Active Directory attempts to make userfile folders full control when allowing the ADUC to create the folder but this is not recommended. I can't find it right now, but I swear I remember reading something from Microsoft that said userfiles should not be full control, only modify.

[jamesbrown]

Set the specific user to have modify permissions. If they have full control they can change the folder permissions if policies are not set to prevent this.