Solved

Offline Files Synchronization - Best Practices

Posted on 2009-05-20
9
1,136 Views
Last Modified: 2012-05-07
In the scenario below, we have all Server 2003 Standard servers in an Active Directory domain environment.  All users run XP Pro with at least SP2.

Each branch at our organization has a Server 2003 Standard Edition server that the users store their 'My Documents' on.  Each users' home directory is mapped to a drive letter (in our example, we'll use H:\), and that drive letter is the location that the 'My Documents' folder points to.  The laptop users have 'Offline Files' enabled, and the files sync when the user logs on and off the computer.  According to Microsoft KB275461 (http://support.microsoft.com/kb/275461), the best solution is to provide all users with at least READ access to the root directory of the users' shared folder (ie \\SERVER\USERS\).  However, if we do this, that means Joe Smith (a user with very little rights on the network) can read all the files located in Jane Doe's user directory (\\SERVER\USERS\JDOE\).  What is the best practices to use in order for each user to have a home directory located on \\SERVER\USERS\ that will allow laptop users to successfully sync their files as well as not let any other users access another user's files.

I hope I've explained myself well, and I apologize if I did not.

To summarize, we have a shared directory on the server called \\SERVER\USERS.  Each user has his/her own directory under that root directory.  Currently, we are experiencing issues with laptop users that are getting "Access Denied" error (as seen in Microsoft KB275461) and we need a solution without giving all users the access to read another user's files.

Thanks!
0
Comment
Question by:olinccu
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
9 Comments
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24434851
You should download, install and enable ABE(access based enumeration)
http://technet.microsoft.com/en-us/library/cc784710(WS.10).aspx
 
Then the users will only see their own folder and nobody elses
0
 

Author Comment

by:olinccu
ID: 24434893
That is definitely an awesome feature.  However, I do not believe that would fix my issue.  Following the KB article from Microsoft that says to give ALL USERS at least READ access to the root share folder, that would then give users access to read all files in that folder.  So that, to me, will not be solved by the ABE feature.  Even if it no longer listed the folder when they're browsing the network folders, they could still get to it via UNC, which is still a security risk that we cannot take.
0
 
LVL 47

Accepted Solution

by:
Donald Stewart earned 500 total points
ID: 24435044
I believe that if you grant Read permissions on just the Parent folder, you'd then be ok.
accessbased.bmp
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 

Author Comment

by:olinccu
ID: 24435223
So, to clarify, I would give READ access to all domain users on the root directory \\SERVER\USERS only.  Then, let's say I have a user named Jane Doe.  I would then make sure her permissions only give her (and appropriate administrative users) rights to her directory and the domain users would not be a part of her permissions.  Is that correct?  That definitely makes sense as far as keeping things secure.  Thanks for your input so far!
0
 
LVL 18

Expert Comment

by:Don S.
ID: 24435253
Here are the MS recommended permissions that I have used extensively and work correctly:

Redirected Folders Parent:

Creator Owner = Full Control, Subfolders and Files Only
Domain Users = List Folder/Read Data, Create Folders/Append Data - This Folder Only
System =  Full Control, This Folder, Subfolders and Files
Admistrators =  Full Control, This Folder, Subfolders and Files
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24435266
Yes, the way that it is set up here as shown above, users get access denied if trying to browse to other users folders.
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24435305
0
 

Author Closing Comment

by:olinccu
ID: 31583645
I was hoping this would be the solution (or something similar).  But posting the question and having responses (and proof) that solidifies the answer is why I'm glad I've joined EE.  Thanks!!
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24435378
You're welcome!!!
 
And welcome to EE
0

Featured Post

Webinar: Aligning, Automating, Winning

Join Dan Russo, Senior Manager of Operations Intelligence, for an in-depth discussion on how Dealertrack, leading provider of integrated digital solutions for the automotive industry, transformed their DevOps processes to increase collaboration and move with greater velocity.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question