Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using the AD Profile Tab to Auto create Home Directories at \server\home so the permissions are automatically created. What should the permissions (NTFS) be for the actual folder that the home directories are created in (\server\home)?

Also, share permissions are always Everyone Full Access since I control actual access with NTFS permissions, is that the correct method?

share|improve this question
add comment

4 Answers

up vote 8 down vote accepted

This is what I have in my favourites for reference:

http://blogs.technet.com/b/migreene/archive/2008/03/24/3019467.aspx

  • CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
  • System - Full Control (Apply onto: This Folder, Subfolders and Files)
  • Domain Admins - Full Control (Apply onto: This Folder, Subfolders and Files)
  • Everyone - Create Folder/Append Data (Apply onto: This Folder Only)
  • Everyone - List Folder/Read Data (Apply onto: This Folder Only)
  • Everyone - Read Attributes (Apply onto: This Folder Only)
  • Everyone - Traverse Folder/Execute File (Apply onto: This Folder Only)

It also recommends setting share permissions as:

  • Everyone - Full Control
share|improve this answer
    
Thanks, that's perfect! –  Gregg Dec 10 '12 at 18:27
    
umm.. @Gregg feel free to actually mark this answer as correct.. –  Rex Dec 19 '12 at 7:09
add comment

It's documented here:

https://blogs.technet.com/b/askds/archive/2008/06/30/automatic-creation-of-user-folders-for-home-roaming-profile-and-redirected-folders.aspx

Administrators: Full Control  
System: Full Control  
Creator Owner: Full Control  
Authenticated Users: Read & Execute, List Folder Contents, Read  

And you must further edit the ACE for Authenticated Users so that it only applies to This Folder Only.

share|improve this answer
add comment

Expanding on @Dan's answer...

Agree Creator Owner, but I never grant FC to users. This allows them to set their own DACLs, which, in my experience brings a world of pain, when the odd power-user (read "pain in the ar$e) removes permissions for SYSTEM, thus stopping you backing up their files. So, normally limit the user of the data to Modify (change in old-school parlance).

SYSTEM : FC, yes.

Domain Admins : Nope. Specify server's local administrators group.

Everyone : Why? Would personally never use "Everyone" anyway, as it includes non-authenticated users.

Share permissions - agree. They only serve to confuse access queries.

share|improve this answer
    
Is this an answer to the original question, or a comment in response to @Dan? I would suggest making your recommendations a stand-alone answer to the original question. If you have comments on @Dan's response, make them separately as comments. Your answer will not be presented in chronological order, and it should not depend on someone else's answer for context. –  Skyhawk Dec 9 '12 at 20:49
add comment

I agree it's better to control access at the NTFS level rather than the share level, but regardless of whether you give them Full Control, the users will always be able to set permissions on files they create because they are then the owner.

If you want to prevent them from changing permissions even on objects they own, make the permissions on the share Change (for Everyone) instead of Full.

Then you might as well give them Full (NTFS) on their own home directory so it's obvious what's going on.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.