Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a class infrastructure with classes consisting of "user" pc's and a single "teacher" pc. The fileserver has a folder for the teacher's "my documents", in which there are folders for each of the student users. Both types of accounts have their "my documents" redirected to these folders.

We use this nested structure so that the teacher has access to their documents in an easy way, allowing him for instance to put new shortcuts on their desktop or collect files.

The problem is that (only recently, apparently) whenever a user tries to insert files from My Documents into a powerpoint for instance it will prompt for credentials to the server. You can press cancel and re-enter the folder and it will work fine. Restart powerpoint (or whatever Office application) and you get prompted again. Apparently it's the same for their desktop, which is also redirected. Browsing to My Documents in explorer should work fine.

It's a bit vague, but the teachers aren't the best in supplying feedback. I tried to explain as best I could.

EDIT: removed link to the other issue as it was unrelated and now solved

Thanks a bunch

share|improve this question
    
How is the redirect set up? UNC path, HTTP? –  dunxd Sep 9 '10 at 13:08
    
UNC indeed. \\server\folder (windows fileserver) –  HannesFostie Sep 9 '10 at 13:14
    
I should add: actually logging in and choosing to remember the credentials does not change anything! –  HannesFostie Sep 9 '10 at 13:24
    
Other problem is now clearly unrelated, it was something by design that I didn't know about. So just this one remains... –  HannesFostie Sep 9 '10 at 14:03
    
I'm surprised there weren't issues with permissions when it came to redirecting something that belongs in a user profile. Especially as MS has been tightening how profiles and security works. You're saying that the teacher user's My Docs is being accessed by all the students as well? Why not map a share to something like G: and give permissions for everyone from that? Minimal training to have them go to g:\folder\file.doc, might save on permission hassles too. That's just me though. –  Bart Silverstrim Sep 9 '10 at 14:45

1 Answer 1

To clarify:

C:\users\Teacher\Documents is shared, and contains

user1\
user2\
.
.
usern\

Recall that Windows authentication is based on "most restrictive" so if you've a Deny in the mix it will trump any Allow for the same resource to the same entity. User folders also typically have very restrictive access by default.

I would recommend that you redirect to a network share outside of the \users\ folder (or \Documents and Settings\ for pre-Vista/Server 2008 environments). Instead, create a new folder off the root or on a file server if you've one available, share that, and give the teacher Read access. Each user folder under that can then inherit that Read, and be assigned Full Control to the person it's assigned to. That SHOULD allow a single sign-in when Windows starts and re-establishes the persistent mapped share, rather than when each app is started and hooks the My Documents redirect.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.