Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

When you configure folder redirection on my documents in group policy and check the "Grant exclusive rights" check box, only the SYSTEM and user has rights to the folder. Domain administrators loose accesss.

I know how to manually add access back by changing the permissions/ownership but I'm sure I read about an additional group policy setting that modifies this mechanism so that administrators are also included when a workstation takes over exclusive control.

But I can't for the life of me find any details about what the policy is called/where it is. First time in a while that Google has let me down.

share|improve this question
    
Can I ask why you need to grant exclusive rights? IMHO permissions should be configured on the file location and then let folder redirection JUST redirect. –  Dan Jul 31 '13 at 9:47
    
That's what we have done in the past as part of our new user script. Best practise appears a little split here between letting the client machines do it themselves when the user first logs on or creating the folders with the right permissions when IT create the user –  Rob Nicholson Aug 1 '13 at 9:48

1 Answer 1

The answer is to simply uncheck that option and to make sure that the Administrator has the appropriate permissions on the parent folder and that permissions inheritance is configured correctly.

http://support.microsoft.com/kb/288991

share|improve this answer
    
I will have to check this but I think this doesn't resolve the problem. That article describes how to configure the root folder for user's documents so that when the user creates their folder at first logon, it is able to do so, i.e. the permissions on the parent allow the user to create the folder. However, if "Grant exclusive rights" is checked, this operation will REMOVE everyone except SYSTEM and the user. This is exactly the problem we are trying to overcome –  Rob Nicholson Aug 1 '13 at 9:52
    
The GP I recall modifies this mechanism so that when the client adjusts the folder permissions, it leaves Administrators in as well. That's the GP I'm after... –  Rob Nicholson Aug 1 '13 at 9:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.