Solved

roaming profile security permission issue.

Posted on 2016-08-27
9
78 Views
Last Modified: 2016-09-10
We have a Windows 2012 RDS environment.  We redirect the user appdata and desktop to a centralized network share.  

A new user login to one of a RDS server, his new profile is created in the network share.  When I inspect folder permission of his profile in the network share, I do not see he has access at all.  Only administrator group.  

The local administrator group of that RDS server contains the domain admins group.  The local USERS group of the server contains the domain user group.

Under the security permission of the network share, I only grant the local USERS group to read only to "This Folder Only". This is because I do not want everybody to have access to everybody's profile.

Please advise if you know how to fix this or a better way to handle.  

Thanks a lot.
0
Comment
Question by:nav2567
9 Comments
 
LVL 80

Expert Comment

by:David Johnson, CD, MVP
ID: 41773369
redirected folder permissions
c:\share\user$
Allow System Full control this folder,subfolders and files
Allow Administrators Full control this folder only
CREATOR OWNER Full control subfolders and files only
Redirected Users Group This Folder ONLY
0
 

Author Comment

by:nav2567
ID: 41773384
Thanks.

In my setup, any idea of why a new user's security permission of his profile was not added when that profile was created
0
 
LVL 25

Expert Comment

by:Sekar Chinnakannu
ID: 41773396
Also you can try to use profile management to configure the redirection, for more details http://www.carlstalhood.com/citrix-profile-management/
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:nav2567
ID: 41773487
Thanks.

If I configured NTFS and security permission that way ( tried that before), as mentioned, everyone will be able to read everyone's profile which is not want we want.  

My share permission settings are same as what is in the article.  In NTFS security permission setting, I only have granted the local USERS group (which contains the RDS users) to read-only to "This Folder Only". This is because I do not want everybody to have access to everybody's profile.

When a new profile is created, I expected to see the user's is granted Change right in NTFS permission.
0
 
LVL 25

Expert Comment

by:Coralon
ID: 41773862
David Johnson's answer is 100% correct.  If you do it that way, then users will not be able to see the contents of other user's profiles.  Be sure you only use the permissions that David specified.  

Personally, I tend to just use Authenticated Users instead of a specific user group.

System:F
Administrators: F (you can make it This Folder Only if you want.. I tend to leave it at full control -- (needed to make it easier to delete the profiles as needed).
Authenticated Users:R, Add Folder/Append Data - This Folder Only
Creator Owner:F - Subfolders and files only

Coralon
0
 
LVL 80

Expert Comment

by:David Johnson, CD, MVP
ID: 41773919
not all of my users have roaming profiles. i.e. administrative and service accounts.
0
 

Author Comment

by:nav2567
ID: 41774176
Thanks.  

If you dont mind, would you specify again on what exactly I need to add inside the below tags

1. Sharing>Advanced Sharing
2. Security (NTFS)

I currently have authentic users (f), system (f), domain admins (f) in 1 and I have system (f), administrators (f), creator owner (f), users (r - this folder only) in 2.
0
 
LVL 80

Accepted Solution

by:
David Johnson, CD, MVP earned 500 total points
ID: 41774344
in the sharing you can have everyone read/write
NTFS Security
Allow System Full control this folder,subfolders and files
Allow Administrators Full control this folder only
CREATOR OWNER Full control subfolders and files only
Redirected Users Group This Folder ONLY
You might want to enable ABE (Access Based Enumeration)
0
 
LVL 17

Expert Comment

by:Spike99
ID: 41774925
Have you checked share permissions?

In general, when restricting access using NTFS permissions, I would give the EVERYONE group FULL access in Share Permissions (which that Citrix article doesn't mention).

As this TechNet Article says:
If you want to manage folder access by using NTFS permissions exclusively, set share permissions to Full Control for the Everyone group.

https://technet.microsoft.com/en-us/library/cc754178(v=ws.11).aspx
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

What to do when Windows Update is not working correctly? What tools can I use to detect the cause of the malfunction problem? What does this numeric error code mean? These and other questions that you have been asking in the past are answered here (…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question