0

I'm working on a Windows Server 2012 R2 domain controller, with primarily Windows 7 Professional clients.

I have recently set up folder redirection and user profile roaming, such that each domain user has a folder on a network share wherein they store both their user profile and their documents. These user folders have form,

D:\Users\%USERNAME%

on the the file server and, correspondingly,

\\MYSERVER\Users\%USERNAME%

on the domain.

These folders are generated automatically on the user first-time login, and contain all the usual suspects including "Application Data", "My Documents", "Links", "Contacts" and "Profile.V2".

All these subfolders are also generated automatically on the user's first login, as is specified by domain group policy. Specifically, all these subfolders with the exception of "Profile.V2" are the result of folder redirection policies; "Profile.V2" is the result of roaming user profile policies.

To achieve all this I've set NTFS permissions on

D:\Users\%USERNAME%

as is recommended by Microsoft (can't remember where now!) and by countless other derivative blog posts. These permissions are,

Disable Inheritance

Allow - SYSTEM - Full Control - This Folder, Subfolders and Files
Allow - Administrator - Full Control - This Folder, Subfolders and Files

Allow - CREATOR OWNER - Full Control - Subfolders and Files

Allow - MyUserGroup - Special (List Folder / Read Data; Create Folders / Append Data) - This Folder Only

This works well for me, with one problem. Once a user has logged on, and the folder structure generated as specified, the user naturally retains the permission to delete any of these folders as they like. This means that the user could, by accident or otherwise, delete - for example - "Desktop". Not only does this result in a loss of the contents of the "Desktop" folder, but it also breaks folder redirection on the next login.

My question is, what is the best way to prevent a user from deleting these top-level user subfolders ("Desktop", "Contacts", "Profile.V2", and the rest)? I have experimented with alternative permissions on the parent folder, but these inevitably break automatic folder generation on user first-time login. Moreover, I have tried to adjust the permissions on these subfolders programmatically following user fist-time login with a script - but I keep missing the mark (modifying ACLs using Powershell is proving to be something of a headache.)

What is the best-practice solution here? Surely I can't be the only one who's run into this issue!

  • I've dealt with this as well like most admins.. The folders will be generated again at next login. If a user looses their own content and looses their own work how is IS to blame? We can't - and aren't supposed to - climb into our folks minds. Hopefully you have policy in place that covers all this kind of stuff. – Tim Brigham Oct 12 '15 at 16:43
  • 3
    Don't redirect the My Documents folder to the same share as the roaming profile. Create separate shares for each of those. How is it that they're seeing and accessing the roaming profile folder directly? – joeqwerty Oct 12 '15 at 17:13
  • @TimBrigham Whilst we can't be to blame for user stupidity, it is part of the job description to anticipate likely avenues of stupidity and put in place preventative measures...Users, by definition, are not IT experts. They can and will make stupid mistakes. We need to make that as difficult for them to accomplish as possible and as easy to recover from as possible. – Steve365 Oct 12 '15 at 21:48
  • 1
    @Steve365. With all due respect it is not ITs job to prevent user stupidity. Help mitigate common mistakes and provide an avenue of recovery (like file and folder history)- absolutely. We are also responsible for educating the users so that even those with the IQ of a half grown radish get the message that performing action X is a career limiting move (in this case deleting the desktop). We can not fix stupid but, with enough pain and effort, it can be cured, but sadly not prevented. – Jim B Oct 13 '15 at 1:41
  • @JimB I've yet to meet someone who got fired for deleting their desktop folder ;-) Anyway, let's agree to disagree on this one... – Steve365 Oct 13 '15 at 8:26
1

Redirect each profile folder to a separate share. So the Desktop folder gets redirected to \myserver\usersDesktops\%username%.

Technet Article

| improve this answer | |
0

What if you remove Allow - CREATOR OWNER - Full Control - Subfolders and Files I suspect this is a bit redundant these days and maybe the reason they have the rights to do what you say.

Also the others are right, its better practice to separate them, as you have more flexibility.

| improve this answer | |
0

So it turns out there's no easy way to do this.

I took the other posters' advice to separate out the locations of the roaming profile root folder (e.g. for "Profile.V2") and the user home root folder (e.g. for "My Documents" and the rest), and this is working well. I've also hidden these shares from network browsing (by appending "$" to their share names), and somehow this has had the effect of completely preventing the user from accessing their own roaming profile folder (which is very good). I must confess that I find this behaviour perplexing - nonetheless it is very welcome!

I guess I'll just have to live with the fact that if a user deletes their own Desktop folder, then it's their own loss! Luckily I've got frequent backups of all these shares going, so that should go some way to mitigating damage.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.