9

I am using the AD Profile Tab to Auto create Home Directories at \\server\home, so that the permissions are automatically created.

What should the NTFS permissions be for the actual folder that the home directories are created in (\\server\home)?

Also, share permissions are always Everyone :: Full Access since I control actual access with NTFS permissions; is that the correct method?

4 Answers 4

14

This is what I have in my favourites for reference:

http://blogs.technet.com/b/migreene/archive/2008/03/24/3019467.aspx

  • CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
  • System - Full Control (Apply onto: This Folder, Subfolders and Files)
  • Domain Admins - Full Control (Apply onto: This Folder, Subfolders and Files)
  • Everyone - Create Folder/Append Data (Apply onto: This Folder Only)
  • Everyone - List Folder/Read Data (Apply onto: This Folder Only)
  • Everyone - Read Attributes (Apply onto: This Folder Only)
  • Everyone - Traverse Folder/Execute File (Apply onto: This Folder Only)

It also recommends setting share permissions as:

  • Everyone - Full Control
0
6

It's documented here:

https://blogs.technet.com/b/askds/archive/2008/06/30/automatic-creation-of-user-folders-for-home-roaming-profile-and-redirected-folders.aspx

Administrators: Full Control  
System: Full Control  
Creator Owner: Full Control  
Authenticated Users: Read & Execute, List Folder Contents, Read  

And you must further edit the ACE for Authenticated Users so that it only applies to This Folder Only.

2

Expanding on @Dan's answer...

Agree Creator Owner, but I never grant FC to users. This allows them to set their own DACLs, which, in my experience brings a world of pain, when the odd power-user (read "pain in the ar$e) removes permissions for SYSTEM, thus stopping you backing up their files. So, normally limit the user of the data to Modify (change in old-school parlance).

SYSTEM : FC, yes.

Domain Admins : Nope. Specify server's local administrators group.

Everyone : Why? Would personally never use "Everyone" anyway, as it includes non-authenticated users.

Share permissions - agree. They only serve to confuse access queries.

1
  • 2
    Is this an answer to the original question, or a comment in response to @Dan? I would suggest making your recommendations a stand-alone answer to the original question. If you have comments on @Dan's response, make them separately as comments. Your answer will not be presented in chronological order, and it should not depend on someone else's answer for context.
    – Skyhawk
    Dec 9, 2012 at 20:49
1

I agree it's better to control access at the NTFS level rather than the share level, but regardless of whether you give them Full Control, the users will always be able to set permissions on files they create because they are then the owner.

If you want to prevent them from changing permissions even on objects they own, make the permissions on the share Change (for Everyone) instead of Full.

Then you might as well give them Full (NTFS) on their own home directory so it's obvious what's going on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .