Filter Folder Redirection GPO with Authenticated Users

Question

Followed this doc to setup folder redirection: https://technet.microsoft.com/en-us/library/jj649078(v=ws.11).aspx

Under Step 3: Create a GPO for Folder Redirection it has me add my "Folder Redirection Users" group to the scope of the GPO, but it also has me delete and add back the "Authenticated Users" group.

So since I have the "Authenticated Users" group in the scope of this GPO does that mean it will hit ALL users under the OU it is applied to and not just members of the "Folder Redirection Users" group? Do the permissions it has you grant the "Authenticated Users" group when you delete and add it back prevent this from happening?

Answer 1

So since I have the "Authenticated Users" group in the scope of this GPO does that mean it will hit ALL users under the OU it is applied to and not just members of the "Folder Redirection Users" group? Do the permissions it has you grant the "Authenticated Users" group when you delete and add it back prevent this from happening?

This is needed as a result of the Security update for Group Policy as detailed at the link listed at the end of step 3. This is so that the GPO can be read by the appropriate entities. The GPO will only be applied to the users in the group in your Security Filter.

https://support.microsoft.com/en-us/help/3163622/ms16-072-security-update-for-group-policy-june-14,-2016

Answer 2

Your confusion is coming from the difference between reading and applying the policy. Per that document only the 'Folder Redirection Users' is set to apply the policy, but any user can see the contents.

Answer 3

No.

Click the Delegation tab, click Add, type Authenticated Users, click OK, and then click OK again to accept the default Read permissions.

This step is necessary due to security changes made in MS16-072.

As the article explains, only the Read permission is applied and only to the GPO object, not the NTFS folder. That means that any authenticated user is able to see the Group Policy. To apply the policy, you have to explicitly add the Apply permission.

The reason this is there is, that because of the mentioned security change, many GPOs now will only apply, if both user and computer object have at least Read permissions. Details in the linked security bulletin.