Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for a way to acomplish the following:

Currently users have home drives mapped via AD profile as follow: \\fileserver\users\username

However if once a user was able to access \\fileserver\users and view everyones folder, but had no access to them.

This is not ideal since we have people saving important stuff to on their drives. How can I restrict users permissions and views only to THEIR home drives?

I also saw this solution, but not sure if it would apply to me:

================================================================================

Share level permissions - Everyone full permission and remove all others

On the file/folder level set the following:

Authenticated users special permissions on the root of the \\server\homeshare\ to

Check the boxes next to the following:

  • Traverse folder / execute file
  • List Folder / read data
  • Read attributes
  • Read extended attributes / List item

All other boxed leave unchecked and make sure you apply "This Folder Only"

Domain Adminsfull rights and apply “this folder, subfolders, and files”

This will block the users from accessing other user home directories.

When you create the new user and set the home directory it will create the folder for you with the correct permissions.

share|improve this question

2 Answers 2

By default it shouldn't be possible for users to navigate into other user's folders - usually the NTFS permissions prevent this. If your user account folders are being created with NTFS permissions that allow anyone to read the contents then check the NTFS permissions and inheritance settings on the root of the share.

That said:

It's entirely possible to give users the ability to map a home drive directly to their home folder on a fileshare, whilst preventing them from navigating up to the root of the share to see the list of other user's folders.

I won't comment on the specific solution you have quoted since I've not tested it, but I have certainly done this in the past. Random trivia: this wasn't possible in NT4 since it didn't support mapping a drive to a subfolder of a share.

share|improve this answer
    
more random trivia, just to be clear the addition of being able to map to sub dirs of a share is not the answer to the problem. –  tony roth May 30 '12 at 22:15
    
@tonyroth Yes, worth re-iterating that point since I didn't emphasise it in my reply. The key in preventing users navigating up to the root of the share is in the NTFS permissions. –  Chris McKeown May 30 '12 at 22:24

First a question on clarifying the issue:

If the users can see but not access other users folders, what is the real issue? Do you not want them to see anything in the share other than their folder?

If the answer is that you don't in fact want them to see any other users folders (even if they can't access them), then the solution is to enable ABE (access based enumeration) on the share.

http://technet.microsoft.com/en-us/library/cc784710(v=ws.10).aspx

http://www.microsoft.com/en-us/download/details.aspx?id=17510

http://www.windowsnetworking.com/articles_tutorials/Implementing-Access-Based-Enumeration-Windows-Server-2003.html

share|improve this answer
    
Yes, I don't want them to see anything but their own home folder. Let me try it and I'll let you know! Thanks! –  George May 31 '12 at 14:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.