Folder Redirection - root folder permissions

Posted on 2008-10-28
Last Modified: 2012-08-13

I have one question I'd like to discuss with the experts.
I'm implementing the folder redirection using group policies for one of my customers. Something what I've done many times before.
But what never came to my mind - the customer complains, that if I set the root folder permissions as they are required (Users - List Folders/ Read Data, Create folders / Append Data - for this folder only), the users will be able to create a new subfolders in the root folder manually - which the customer wants to prevent.

Can anybody help me with justification of this fact? I mean - does it really matter when users are allowed to create some unwanted folders? Or is there a kind of workaround, that would work the way that there will be created only folders required by group policy and user will not be able to create some additional ones? (on the same level, eg. there are folders like jsmith, abrown, jdoe...and on the same level could appear a new folders created manually by users).

Any advice would be appreciated.
Question by:martin_babarik
  • 3
  • 2
LVL 70

Expert Comment

ID: 22827651
I cannot see any justification in not allowing users to create folders within their own root folder - indeed it should be encouraged to that users can organise their data more efficiently.
LVL 13

Author Comment

ID: 22829291

not sure if I made myself clear. Of course users are allowed to create subfolders in \\server\userdata\%username%\
But the customer doesn't want the users to create sufolders in \\server\userdata
If I don't use the default folder creation by folder redirection policy, it would mean that the admins will have to create user folders manualy and also set the permissions manually, which IMO gives a huge amount for human errors.
Thank you.
LVL 70

Expert Comment

ID: 22829379
You should not normally need to creat folders manually at the root - the folder re-direction polict wii do this - and set the  permissions automatically to give the new user access to their own folder
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

LVL 13

Author Comment

ID: 22829582
Yes, that's what I'm talking about:) But if I leave the folder creation on GP, I will have to rely on the root folder permissions thus allowing users to create new folders on the same level where their personal folders are.
I can prevent by using more strict ntfs permissions on the user folders root folder not allowing users to create new folders here - but in this scenario the GP folder creation will not work and I'd have to create each user personal folder manually - which doesn't seem to be very clear and correct solution for me.
LVL 31

Accepted Solution

Henrik Johansson earned 500 total points
ID: 22858032
The permissions nead to let the user create folder to let the GPO create the folder, or you'll get the extra admin work to pre-create each user's folder with the correct permissions set.

If not wanting to let users create their own folders in the share, it might work to revoke the list folder permission on the parent folder. Not sure if it works when the requirement list states that the user shall be granted list access, but it's worth a try...

To be sure that the users don't use "md \\server\userdata\MyOwnFolder", you nead to revoke the folder creation right from the users and automate the folder creation with a scheduled script that also sets the correct permissions on the folder.
LVL 13

Author Closing Comment

ID: 31510685
Thank you for the advice. There doesn't exist a simple solution to meet the customer's needs, so I guess I will choose the direction with scripted folder creation, eventhough I don't like it much.

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question