Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Looking at changing the way we manage roaming profiles, home drives and folder redirection.

Our last sysadmin was lazy and set everyone access to everything to get around the headache of setting up permissions on folders.

I am wanting these folders to be automatically created when I set the path in AD. At the moment the Home folder is created fine, however when Profile is created I need to take ownership of each folder to view/modify files which is a headache and not viable long term.

I have set up 3 shares for these features with the following permissions

HomeStore and ProfileStore
Creator Owner - Full
Domain Admin - Full
Authenticated Users - Read
Authenticated Users (This Folder Only) - Full
Domain Admin - Full
System - Full

Creator Owner - Full
Domain Admin - Full
Authenticated Users - Read
Everyone (This Folder Only) - Full
Domain Admin - Full
System - Full

Are these set correctly? I know there are issues with Admin having access to user files but we are a small company and this is requested of me often.

share|improve this question
up vote 1 down vote accepted

Without parsing the permissions you listed (because it makes my hear hurt) I would suggest following this article:

In addition, in Group Policy there's a setting to add the Administrators security group to roaming profiles which will grant the Administrators group the appropriate permissions to the roaming profiles, negating the need for you to take ownership when accessing the profiles, which will surely cause problems eventually.

Note 1: The aforementioned GP setting will affect only newly created profiles, not existing profiles.

Note 2: The GP setting needs to be set in the GPO that applies to the client computer object, not the profile server computer object.

share|improve this answer
Apologies, I have tried to make this a little tidier! I have followed that guide and with the exception of server\Administrator which I replaced with domain\DomainAdmin these are all set correctly. I am using a test account which has no associated profile. When I created this account I ended up with a mess of folders I had to take ownership of and delete. Obviously I can create this folder first and inherit the permissions but this seems a little tedious. Are you saying the computer that creates the folders on the profile store needs this GP applied opposed to the user? – Daniel Jun 21 '11 at 3:12
Yes, the computer creates the folders, not the user. The GP setting is only applicable for the Administrators group being added to the permissions of the profile folders, it's not going to help in getting them created correctly in the first place. As for the permissions, you aren't manually creating the user folders are you? If so, you shouldn't be. – joeqwerty Jun 21 '11 at 3:26
Thanks for that, now I can at least take ownership easily when creating profiles. I am not creating user profiles no, I just want to make sure they are set up correctly. This is unrelated somewhat but if I were to set these shares up as a DFS-N can I just set the sharing permission on the namespace to read only and let the folder/sharing permissions take care of the rest? – Daniel Jun 21 '11 at 3:31
Not sure about the DFS part. The point of the GP setting is so that you don't have to take ownership in order to access the profiles, you'll be able to do that via the permissions set for the Administrators group as a result of the GP setting. – joeqwerty Jun 21 '11 at 3:36
When a user with no pre-existing profile folder in the profile share logs on, is a profile folder created for the user? – joeqwerty Jun 21 '11 at 3:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.