0

Looking at changing the way we manage roaming profiles, home drives and folder redirection.

Our last sysadmin was lazy and set everyone access to everything to get around the headache of setting up permissions on folders.

I am wanting these folders to be automatically created when I set the path in AD. At the moment the Home folder is created fine, however when Profile is created I need to take ownership of each folder to view/modify files which is a headache and not viable long term.

I have set up 3 shares for these features with the following permissions

HomeStore and ProfileStore
Security:
Creator Owner - Full
Domain Admin - Full
Authenticated Users - Read
Sharing:
Authenticated Users (This Folder Only) - Full
Domain Admin - Full
System - Full

FolderStore
Creator Owner - Full
Domain Admin - Full
Authenticated Users - Read
Sharing:
Everyone (This Folder Only) - Full
Domain Admin - Full
System - Full

Are these set correctly? I know there are issues with Admin having access to user files but we are a small company and this is requested of me often.

Improve this question

1 Answer 1

Reset to default
1

Without parsing the permissions you listed (because it makes my hear hurt) I would suggest following this article:

http://technet.microsoft.com/en-us/library/cc737633(WS.10).aspx

In addition, in Group Policy there's a setting to add the Administrators security group to roaming profiles which will grant the Administrators group the appropriate permissions to the roaming profiles, negating the need for you to take ownership when accessing the profiles, which will surely cause problems eventually.

Note 1: The aforementioned GP setting will affect only newly created profiles, not existing profiles.

Note 2: The GP setting needs to be set in the GPO that applies to the client computer object, not the profile server computer object.

Improve this answer
6
  • Apologies, I have tried to make this a little tidier! I have followed that guide and with the exception of server\Administrator which I replaced with domain\DomainAdmin these are all set correctly. I am using a test account which has no associated profile. When I created this account I ended up with a mess of folders I had to take ownership of and delete. Obviously I can create this folder first and inherit the permissions but this seems a little tedious. Are you saying the computer that creates the folders on the profile store needs this GP applied opposed to the user?
    – Daniel
    Jun 21, 2011 at 3:12
  • Yes, the computer creates the folders, not the user. The GP setting is only applicable for the Administrators group being added to the permissions of the profile folders, it's not going to help in getting them created correctly in the first place. As for the permissions, you aren't manually creating the user folders are you? If so, you shouldn't be.
    – joeqwerty
    Jun 21, 2011 at 3:26
  • Thanks for that, now I can at least take ownership easily when creating profiles. I am not creating user profiles no, I just want to make sure they are set up correctly. This is unrelated somewhat but if I were to set these shares up as a DFS-N can I just set the sharing permission on the namespace to read only and let the folder/sharing permissions take care of the rest?
    – Daniel
    Jun 21, 2011 at 3:31
  • Not sure about the DFS part. The point of the GP setting is so that you don't have to take ownership in order to access the profiles, you'll be able to do that via the permissions set for the Administrators group as a result of the GP setting.
    – joeqwerty
    Jun 21, 2011 at 3:36
  • When a user with no pre-existing profile folder in the profile share logs on, is a profile folder created for the user?
    – joeqwerty
    Jun 21, 2011 at 3:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.