Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

A client has folder redirection in AD setup on each user's Home Folder set to the Z:\ drive as \server\share\username. A Group Policy redirects the user's Documents to the user's Home Folder with the option 'Grant the user to exclusive rights to Documents' selected.

The share on the server has permissions for the relevant user security group with 'Full Control', but each user's folder only have NTFS permissions only for 'CREATOR OWNER' and 'Domain Admins'.

Why can the different users access other user's folders? I thought the most restrictive permissions applied effectively between the share and the NTFS permissions.

Also, this setup has been like this for years, and this client recently updated all client computers to Windows 7. What is the best way to setup this redirection now? I assume only in Group Policy, also Basic Redirection - to create a folder for each user under the root path?

share|improve this question
    
What security principal is the owner of the folders? –  Greg Askew Jun 17 '12 at 19:10
    
The root folder as well as the subfolders' Owner is servername\administrators. And added to this group is Domain Admins and Power Users (Users who need local admin rights). I can access all folders with a non-Power User as well. –  Shawn Gradwell Jun 18 '12 at 5:46

1 Answer 1

On one of the folders, Security tab > Advanced button, you can use the Effective Permissions tool to determine exactly what permissions are conferred to a particular security principal.

I would suspect that a user may have elevated permissions or rights that you are not aware of. This may occur due to inadvertent or inappropriate rights assignment or group membership nesting.

gpresult may be used on a user's station where they are logged on to get a complete report of their actual group membership. Or if you have access to a computer where one of the users has recently logged on, you can run gpresult /user domain\username /h gpresult.html to generate the rsop data from their local profile.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.