0

We have a class infrastructure with classes consisting of "user" pc's and a single "teacher" pc. The fileserver has a folder for the teacher's "my documents", in which there are folders for each of the student users. Both types of accounts have their "my documents" redirected to these folders.

We use this nested structure so that the teacher has access to their documents in an easy way, allowing him for instance to put new shortcuts on their desktop or collect files.

The problem is that (only recently, apparently) whenever a user tries to insert files from My Documents into a powerpoint for instance it will prompt for credentials to the server. You can press cancel and re-enter the folder and it will work fine. Restart powerpoint (or whatever Office application) and you get prompted again. Apparently it's the same for their desktop, which is also redirected. Browsing to My Documents in explorer should work fine.

It's a bit vague, but the teachers aren't the best in supplying feedback. I tried to explain as best I could.

EDIT: removed link to the other issue as it was unrelated and now solved

Thanks a bunch

6
  • How is the redirect set up? UNC path, HTTP?
    – dunxd
    Sep 9, 2010 at 13:08
  • UNC indeed. \\server\folder (windows fileserver) Sep 9, 2010 at 13:14
  • I should add: actually logging in and choosing to remember the credentials does not change anything! Sep 9, 2010 at 13:24
  • Other problem is now clearly unrelated, it was something by design that I didn't know about. So just this one remains... Sep 9, 2010 at 14:03
  • I'm surprised there weren't issues with permissions when it came to redirecting something that belongs in a user profile. Especially as MS has been tightening how profiles and security works. You're saying that the teacher user's My Docs is being accessed by all the students as well? Why not map a share to something like G: and give permissions for everyone from that? Minimal training to have them go to g:\folder\file.doc, might save on permission hassles too. That's just me though. Sep 9, 2010 at 14:45

2 Answers 2

2

Even though this post is old, I came across the same thing today with Windows 7 clients accessing redirected folders on a Windows Server 2012R2 with Excel 2013. So the problem is still there.

Problem Reproduction

Since the original description was a bit vague here is the exact way to reproduce the problem:

  • "my documents" (or probably any other library) is redirected to a server share
  • "my documents" contains an MS Excel (probably any MS Office) document.
  • create a link to that document in another redirected library, for example on the "desktop".
  • trying to open the document by double-clicking the link will prompt for the user's credentials, while a double-click directly on the file in "my documents" works fine.

It is interesting to note that this only happens when creating the link from within a redirected library like "my documents". If you access the same shared folder directly by its UNC path and create the link from there, everything works fine as well.

The Solution that worked for me

It is a permission problem on the redirected folders share, even though it looks fine at first and is perfectly accessible for other programs than MS Office.

The shares that host redirected folders need exactly these permissions, as documented by Microsoft (as early as Windows Server 2003):

on the share:

EVERYONE:F (or at least F for the users that access the share)

in the file system:

CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
System - Full Control (Apply onto: This Folder, Subfolders and Files)
Domain Admins - Full Control (Apply onto: This Folder, Subfolders and Files)
Everyone - List Folder/Read Data (Apply onto: This Folder Only)
Everyone - Read Attributes (Apply onto: This Folder Only)
Everyone - Traverse Folder/Execute File (Apply onto: This Folder Only)
Everyone - Create Folder/Append Data (Apply onto: This Folder Only)

I was missing the last 2 permission entries, thinking I could get away with just read access. Adding those 2 entries, which seem totally unrelated, solved the problem.

0

To clarify:

C:\users\Teacher\Documents is shared, and contains

user1\
user2\
.
.
usern\

Recall that Windows authentication is based on "most restrictive" so if you've a Deny in the mix it will trump any Allow for the same resource to the same entity. User folders also typically have very restrictive access by default.

I would recommend that you redirect to a network share outside of the \users\ folder (or \Documents and Settings\ for pre-Vista/Server 2008 environments). Instead, create a new folder off the root or on a file server if you've one available, share that, and give the teacher Read access. Each user folder under that can then inherit that Read, and be assigned Full Control to the person it's assigned to. That SHOULD allow a single sign-in when Windows starts and re-establishes the persistent mapped share, rather than when each app is started and hooks the My Documents redirect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .