Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


Folder Redirection - root folder permissions

Posted on 2008-10-28
Medium Priority
Last Modified: 2012-08-13

I have one question I'd like to discuss with the experts.
I'm implementing the folder redirection using group policies for one of my customers. Something what I've done many times before.
But what never came to my mind - the customer complains, that if I set the root folder permissions as they are required (Users - List Folders/ Read Data, Create folders / Append Data - for this folder only), the users will be able to create a new subfolders in the root folder manually - which the customer wants to prevent.

Can anybody help me with justification of this fact? I mean - does it really matter when users are allowed to create some unwanted folders? Or is there a kind of workaround, that would work the way that there will be created only folders required by group policy and user will not be able to create some additional ones? (on the same level, eg. there are folders like jsmith, abrown, jdoe...and on the same level could appear a new folders created manually by users).

Any advice would be appreciated.
Question by:martin_babarik
  • 3
  • 2
LVL 70

Expert Comment

ID: 22827651
I cannot see any justification in not allowing users to create folders within their own root folder - indeed it should be encouraged to that users can organise their data more efficiently.
LVL 13

Author Comment

ID: 22829291

not sure if I made myself clear. Of course users are allowed to create subfolders in \\server\userdata\%username%\
But the customer doesn't want the users to create sufolders in \\server\userdata
If I don't use the default folder creation by folder redirection policy, it would mean that the admins will have to create user folders manualy and also set the permissions manually, which IMO gives a huge amount for human errors.
Thank you.
LVL 70

Expert Comment

ID: 22829379
You should not normally need to creat folders manually at the root - the folder re-direction polict wii do this - and set the  permissions automatically to give the new user access to their own folder
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

LVL 13

Author Comment

ID: 22829582
Yes, that's what I'm talking about:) But if I leave the folder creation on GP, I will have to rely on the root folder permissions thus allowing users to create new folders on the same level where their personal folders are.
I can prevent by using more strict ntfs permissions on the user folders root folder not allowing users to create new folders here - but in this scenario the GP folder creation will not work and I'd have to create each user personal folder manually - which doesn't seem to be very clear and correct solution for me.
LVL 31

Accepted Solution

Henrik Johansson earned 2000 total points
ID: 22858032
The permissions nead to let the user create folder to let the GPO create the folder, or you'll get the extra admin work to pre-create each user's folder with the correct permissions set.

If not wanting to let users create their own folders in the share, it might work to revoke the list folder permission on the parent folder. Not sure if it works when the requirement list states that the user shall be granted list access, but it's worth a try...

To be sure that the users don't use "md \\server\userdata\MyOwnFolder", you nead to revoke the folder creation right from the users and automate the folder creation with a scheduled script that also sets the correct permissions on the folder.
LVL 13

Author Closing Comment

ID: 31510685
Thank you for the advice. There doesn't exist a simple solution to meet the customer's needs, so I guess I will choose the direction with scripted folder creation, eventhough I don't like it much.

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scripts are great for performing batch jobs against users, however sometimes the GUI is all you need.
The article explains the process to deploy a Self-Service password reset portal I developed a few years ago. Hopefully, it will prove useful to someone.  Any comments, bug reports etc. are welcome...
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

569 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question