Solved

Cannot get rights to home folder!

Posted on 2006-06-25
5
234 Views
Last Modified: 2010-08-05
Hi folks,

I have set up My Documents redirection to \\fileserver\users\%username

That works perfectly (after some headache). All users get their document folders when they log in.

I have created these top level folders from scratch, using the Profile utility when making a user. I would specify their Home path, and the server would create it and grant rights.

My problem is this now... all users that go to their My Documents, have NO rights to add/delete/update anything. They have read rights, but as I'm looking at the NTFS permissions, they have full rights to the folder!

Any ideas why this might be happening?

My \users\ directory is the share, has rights to "Everyone" to read and "Domain Admins" for full control... please let me know. As a test, I changed "Everyone" at the share level to have full control -- but now they have full control on every subfolder as well. If I deny "everyone" on NTFS level for each individual user account, then that user can't access their share either.

Thanks for any help! Time is of the essense with the answer :)
0
Comment
Question by:overworkedops
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
5 Comments
 
LVL 13

Expert Comment

by:itcoza
ID: 16979720
Hi overworkedops,

First things first.  Share Permissions are totally separate from NTFS permissions.

Regards,
M
0
 
LVL 13

Expert Comment

by:itcoza
ID: 16979738
What you need to do is to setup your NTFS permissions on the ..\users folder so that the "Domain Users" have Read access to that.  Do not remove "Domain Admins" or "Administrators" if they are there.  Now, you also have to redo the security on each user's folder if all your users have access to each opther's folders.  Give Each user full control over their own folder and remove all other unwanted security rights.

Once you are happy that your NTFS permissions are the way you want them, change the share permissions to "Administrators" Full and "Domain Users" Full.  Even though you have granted the Domain Users full access at the share level it will not change the higher level security that is NTFS.  

Let me know if you require more information on this subject.

Regards,
M
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 16979898
Folder re-direction permissions are quite fussy. Best as a rule to allow the policy to create the folders when possible, but the actually required permissions are outlined in the last part of the following link:
http://technet2.microsoft.com/WindowsServer/en/Library/a1b7ce04-708b-4145-830a-cadfc003acd31033.mspx?mfr=true
0
 
LVL 13

Expert Comment

by:itcoza
ID: 16980233
overworkedops,

Do you need more information?

*****************************
Regards, M
   
0
 
LVL 3

Accepted Solution

by:
jarremopoulos earned 500 total points
ID: 16981716
hi overworkedops,

I´ve using this configuration and it works fine.

Share permissions:
Domain Admins -> Full Control
Domain Users -> Change or full

NTFS permissions:
Domain users -> Read (this folder only)
CREATOR OWNER -> Full control (subfolders and files)
Administrators -> Full control
SYSTEM -> Full control

And you must delete existing users home folders and then re-create them via user account  profile sheet (\\fileserver\users\%USERNAME% )

Then homefolders get proper rights.

JMpouloZ

0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

The HP utility "HP Lights-Out Online Configuration Utility for Windows Server 2003/2008" could be of great use when it comes to remotely configure a HP servers ILO WITHOUT rebooting the server. We would only need to create and run scripts using thi…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question