Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have several Windows workstations which are shared by multiple users. I'm currently considering a scheme where users have their own user accounts and profiles, but they share the same Desktop and Documents folders. Our users are used to sharing things with each other by saving to the desktop, so this wouldn't require any training. My questions about this scheme are:

  1. Is this a terrible idea? The fact that I don't see anybody else doing this makes me think there's something wrong with it, or there's a much easier way to achieve what I want.

  2. I could probably do this by logging into each account, going into properties for the Desktop and Documents, and choosing Location → Move. Is there a way to configure the computer to do this automatically on all new user accounts?

Scenario

Currently, the workstations log into a single local user account. The only sensitive data is stored in a few applications like Outlook. We do not have a domain and have no plans to create one.

As far as I know, we can't simply password-protect Outlook profiles because we use Exchange in cached mode. OST files can't be password protected, and since we use cached mode even if we enabled "Always prompt for credentials" on the Exchange account, a snooping user could just hit cancel and look through cached email. When searching online, the advice to protect Exchange accounts seems to always be "use separate Windows accounts".

Since users love saving everything to their desktop and that's how they share files with each other, using separate accounts would require everyone to remember to put shared documents in special shared folders. I foresee this just causing too much friction to be worth it.

But, if I could create multiple accounts that share the same Desktop and Documents folders, users would be able to share files simply by saving them to the Desktop or Documents folders, and yet sensitive per-user data would still be stored in AppData and therefore be protected by ACLs and the Windows account passwords.

The workstations are running Windows XP, Vista, and Windows 7, and running any version of Outlook from 2003 all the way through 2013.

share|improve this question

2 Answers 2

You can redirect folders to the same location using GPO. This includes the desktop and documents. Just make sure all users have permissions.

That's the technical answer. From a technical viewpoint, this can be done. Is it a good idea? No. Not really. This can be handled by giving each user their own documents and desktop like normal, but making a network share that is automatically mapped to each user on login - again, via GPO.

share|improve this answer
    
I must have accidentally removed it while I was editing my question, but we don't have a domain and will certainly not be adding one (too much management overhead, and our workstations are in four completely isolated networks). –  Stephen Jennings Mar 27 '13 at 22:16
3  
@StephenJennings Then you can do this with the local group policy settings and/or script it. Still not a good idea, and the proper way to do this that isn't guaranteed to come back to bite you is to set up a networked file share for the purposes of sharing files. –  HopelessN00b Mar 28 '13 at 0:11

The simple way of doing this is by creating a domain with a domain controller, and having these machines all be members of the domain. Based on your existing security model, however, I think separating accounts by using a domain is far beyond the scope of security you wish to achieve.

The basic way of sharing documents amongst multiple user accounts is the "All Users" profile. It is geared specifically for that. Anything in this profile appears to everyone who logs into the machine.

share|improve this answer
    
The problem with "All Users" is that if a user saves a file to the desktop, it will go into their profile's desktop folder, not the All Users desktop. Even with training the users would constantly get this wrong, so it's not a viable option. –  Stephen Jennings Mar 27 '13 at 22:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.