Creating home directory in 2003 sbs

1) Create a shared folder on a server and name it HomeDirs (can be anything, just name it logically).
2) Set the shared perms on the HomeDirs shared folder to have Full Control access for domain admins
3) Open up Active Directory Users and Computers and do a multi-select on the users that need to have a home directory under this shared folder.
4) Select Properties after right-clicking on the multi-selected users.
5) Select the Profile tab.
6) Check the Home folder check box.
7) Select the Connect radio button.
8) Select a drive letter for the home directories.
9) Type \\servername\HomeDirs\%username% in the 'To' text box area.
10) Select 'OK'. This will automatically create home folders for all users with only domain admins having full control
11) Use Xcalcs to assign each user MODIFY permission on his respective folder

Greetings:

We do not allow the domain users to even see the structure.  Our share is set at the root level (in your case .. homedir) and the user homedrives are created just below.

Inheritance is turned off at the top of the user folder, and the only permissions we set are

Creator Owner - full
The specific user - Modify
...NOTE:  We use the advanced settings to grant delete files and folders
Administrators (which includes our backup acocunt) - Full
System - Full

Either the specific user or the administrators group should be the owner.

XCACLS is a very usedful tool for setting permissions
http://www.ss64.com/nt/xcalcs.html

Xcacls.vbs can be used to modify inheritance.

regards

I'm sorry to say that all of those recommendations are NOT valid for an SBS configuration as they would break the ability to use the configuration wizards... most of which are required for a trouble-free SBS install.

There's no need to create a home directory for users in SBS 2003 because it's done automatically.  When you add a user with the Add-User wizard, a home folder is automatically created in \\servername\users\%username%.  You may not alter the name of the home share, it must be called "\Users".

The actual folder is at C:\Users Shared Folders, unless you altered this location on the initial installation.  If you want to move it you must follow the steps found in http://sbsurl.com/movedata.

Additionally, if you want user's My Document's folder to be redirected to thier home folder, then you should run the My Documents Folder Redirection Wizard.

If you didn't use the add-user wizard to create your users and by chance put them in an OU other than the default of yourdomain.local\MyBusiness\Users\SBSUsers, then you need to move them to that OU, and run the Change User Permissions Wizard to repair their user accounts.

SBS is based on standardized configurations so that management and upkeep is minimal.  You can read more about SBS's "gotchas" along with it's great and unique features here:  http://sbsurl.com/itpro

Further Documentation is available at http://sbsurl.com/techguide and www.sbscommunity.com

Jeff
TechSoEasy

Thank you for your replies, I'm not too bothered about using the wizards.

The way I have found to do this would appear to be very simple

Share the folder give domain admins and users full share permissions and give only administrators full permissions on security, in A.D direct the users home folder into the share,

This allows only admins and the user to access the folder, it also does not allow the user to browse to the folder through the network to view the directory structure of inside the folder.

I'm open to criticism!

You say you're not to bothered about using the wizards?  Do you mean about NOT using the wizards?  Perhaps I wasn't really clear in my comments then... because NOT using the wizards will actually cause you to have continued "abnormal" behavior.  You'll spend hours and hours troubleshooting and configuring when you wouldn't have to if you had done it the way the server was designed.

The CEICW alone issues 500 separate command lines which are necessary n order to keep your server's network, IIS, Exchange and SharePopint configurations all in sync.  If you configure these manually you risk breaking one of the others.

See: http://msmvps.com/blogs/bradley/archive/2004/06/24/8898.aspx

As for My Documents Folder Redirection and Home Directories, there are built-in conveniences which are achieved by using the wizards... but it's really more than that... Not using the basic fetaures of the server you have just made an investment in will inhibit you from really providing a more efficient infrastructure and collaborative environment for your employees.

To answer directly to your security settings "plan".  That won't work.  Users MUST have FULL Permissions of everything inside the folder you want them to be able to use for retreiving and saving documents.  Otherwise, they wouldn't be able to rename a document, they couldn't edit one, they even wouldn't be able to open many file types if they don't have any Security permissions.

Jeff
TechSoEasy

ok, I hear what your saying about SBS wizards, it does make more sense, but suppose it was a standard server, and I wanted to set users home directories, are you saying that the way I have shared the folder will cause me a problem?  I can't see how as when I check permissions on the users home directory they have full control to the folder,

Maybe I have not been clear, the folder I have shared is called data (share permissions are domain admins and domain user full control. NTFS permissions are full for administrators only, through active directory I create the home folder and use drive letter Z:, so the home folders location would be \\server\data\johndoe

Johndoe has a Z: drive in my computer he can create delete modify etc anything in the Z drive but he cannot see anything else in the data folder if he tries to browse to \\server\data he gets accessed denied