Folder Redirection - root folder permissions

Posted on 2008-10-28
Last Modified: 2012-08-13

I have one question I'd like to discuss with the experts.
I'm implementing the folder redirection using group policies for one of my customers. Something what I've done many times before.
But what never came to my mind - the customer complains, that if I set the root folder permissions as they are required (Users - List Folders/ Read Data, Create folders / Append Data - for this folder only), the users will be able to create a new subfolders in the root folder manually - which the customer wants to prevent.

Can anybody help me with justification of this fact? I mean - does it really matter when users are allowed to create some unwanted folders? Or is there a kind of workaround, that would work the way that there will be created only folders required by group policy and user will not be able to create some additional ones? (on the same level, eg. there are folders like jsmith, abrown, jdoe...and on the same level could appear a new folders created manually by users).

Any advice would be appreciated.
Question by:martin_babarik
  • 3
  • 2
LVL 70

Expert Comment

ID: 22827651
I cannot see any justification in not allowing users to create folders within their own root folder - indeed it should be encouraged to that users can organise their data more efficiently.
LVL 13

Author Comment

ID: 22829291

not sure if I made myself clear. Of course users are allowed to create subfolders in \\server\userdata\%username%\
But the customer doesn't want the users to create sufolders in \\server\userdata
If I don't use the default folder creation by folder redirection policy, it would mean that the admins will have to create user folders manualy and also set the permissions manually, which IMO gives a huge amount for human errors.
Thank you.
LVL 70

Expert Comment

ID: 22829379
You should not normally need to creat folders manually at the root - the folder re-direction polict wii do this - and set the  permissions automatically to give the new user access to their own folder
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

LVL 13

Author Comment

ID: 22829582
Yes, that's what I'm talking about:) But if I leave the folder creation on GP, I will have to rely on the root folder permissions thus allowing users to create new folders on the same level where their personal folders are.
I can prevent by using more strict ntfs permissions on the user folders root folder not allowing users to create new folders here - but in this scenario the GP folder creation will not work and I'd have to create each user personal folder manually - which doesn't seem to be very clear and correct solution for me.
LVL 31

Accepted Solution

Henrik Johansson earned 500 total points
ID: 22858032
The permissions nead to let the user create folder to let the GPO create the folder, or you'll get the extra admin work to pre-create each user's folder with the correct permissions set.

If not wanting to let users create their own folders in the share, it might work to revoke the list folder permission on the parent folder. Not sure if it works when the requirement list states that the user shall be granted list access, but it's worth a try...

To be sure that the users don't use "md \\server\userdata\MyOwnFolder", you nead to revoke the folder creation right from the users and automate the folder creation with a scheduled script that also sets the correct permissions on the folder.
LVL 13

Author Closing Comment

ID: 31510685
Thank you for the advice. There doesn't exist a simple solution to meet the customer's needs, so I guess I will choose the direction with scripted folder creation, eventhough I don't like it much.

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction You may have a need to setup a group of users to allow local administrative access on workstations.  In a domain environment this can easily be achieved with Restricted Groups and Group Policies. This article will demonstrate how to…
This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

790 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question