Folder Redirect Permissions Incorrect Windows 2012 R2 Essentials
New admin on this system. I have users who's offline files are not syncing with the redirected folder because they don't have permissions on lower level folders below their user names. The sync error shows up as an event ID 502 in the application log. Also, the domain admin id can't view or copy any of the folders. I suspect that some how or another someone jumbled the permissions.
Is there a powershell script to set the permissions back correctly? Does anyone have advice as to the steps I should take? I don't want to lose any data guessing at a solution.
Permission issues usually originate from manually moving the user’s folder from one location to another, or if the administrator takes ownership of the user’s folder to gain access to the contents. To prevent the first scenario from occurring, use the Move Users’ Redirected Documents Data wizard . A typical error you will receive on the client machine will be something like this:
Event Type: Error
Event Source: Folder Redirection
Event Category: None
Event ID: 102
Date: Date
Time: Time
User: Domain\User
Computer: Computername
Description: Failed to perform redirection of folder My Documents. The files for the redirected folder could not be moved to the new location. The folder is configured to be redirected to \\ servername \ sharename \%username%. Files were being moved from C:\Documents and Settings\ user \My Documents to \\ servername \ sharename \ user . The following error occurred: The security descriptor structure is invalid.
If you suspect that you are in this situation, verify the following:
The redirected user account must have at least Read, Traverse folder, List folder, Read attributes, and Read extended attributes on the actual share \\SERVERNAME\RedirectedFolders. If you cannot open this share from the client machine because you get an “Access Denied”, folder redirection will not work.
The redirected user account must have Full control and be the Owner of their personal folder \\SERVERNAME\RedirectedFolders\%USERNAME%\. If not, the GPO will fail to apply to that user upon login.
genusys
ASKER
Larry:
Do I take the chance of losing the user's offline data by changing permissions?
Larry Struckmeyer MVP
Do you have backups? Can you copy out the data folders on the laptop while connected or disconnected from the domain? If not sure, then every piece of user data is at risk.
https://support.microsoft.com/en-us/help/288991/enabling-the-administrator-to-have-access-to-redirected-folders
For the permissions issues, check this:
https://blogs.technet.microsoft.com/sbs/2010/10/08/folder-redirection-in-small-business-server-2008/
Permission issues usually originate from manually moving the user’s folder from one location to another, or if the administrator takes ownership of the user’s folder to gain access to the contents. To prevent the first scenario from occurring, use the Move Users’ Redirected Documents Data wizard . A typical error you will receive on the client machine will be something like this:
Event Type: Error
Event Source: Folder Redirection
Event Category: None
Event ID: 102
Date: Date
Time: Time
User: Domain\User
Computer: Computername
Description: Failed to perform redirection of folder My Documents. The files for the redirected folder could not be moved to the new location. The folder is configured to be redirected to \\ servername \ sharename \%username%. Files were being moved from C:\Documents and Settings\ user \My Documents to \\ servername \ sharename \ user . The following error occurred: The security descriptor structure is invalid.
If you suspect that you are in this situation, verify the following:
The redirected user account must have at least Read, Traverse folder, List folder, Read attributes, and Read extended attributes on the actual share \\SERVERNAME\RedirectedFol
The redirected user account must have Full control and be the Owner of their personal folder \\SERVERNAME\RedirectedFol