Re: HOME FOLDER ON 2003 ENTERPRISE ED .64 BIT SERVER
Al <Al @discussions.microsoft.com> wrote:
> ok now this seems pretty simple but it doesn't work!!
>
> In ADU&C, I can select an AD user, properties, profile and enter a
> home folder.
>
> Z: \\SERVERNAME\HOME$\%USERNAME%
>
> Now on the shared server I created a share directory named HOME, then
> shared named home$, in there I created the users home folder.
>
> user boots up his/her XP Pro which is on the domain and can see
> his/her home folder but can't freaken create or drop any
> folders/documents in there.
>
> User gets: access denied, you need proper permissions on the folder.
> User has full control on their folder!
>
> Tried everything with permissions and google. Still can't get it to
> work.
In addition to the other advice (your permissions are clearly wrong
somewhere), I suggest you rethink the existing setup a bit. Rather than
using home directories, just use folder redirection. You can still map a
drive letter i your login script if you like. Here's some good info -
"How to dynamically create security-enhanced redirected folders by using
folder redirection in Windows 2000 and in Windows Server 2003"
http://support.microsoft.com/kb/274443
---
SUMMARY
In Microsoft Windows 2000 and in Microsoft Windows Server 2003, as an
administrator, you can customize desktops by using Folder Redirection. You
can redirect the following folders by using Active Directory and Group
Policy:
.. Application Data
.. Desktop
.. My Documents
.. My Documents/My Pictures
.. Start Menu
You can find more information about Folder Redirection by searching Windows
Help for Folder Redirection.
When you redirect folders to a shared location on a network, users need both
read and write access to this location so that the users can read the
contents these folders. However, in some scenarios, you may not want to
grant read access.
= Create security-enhanced redirected folders =
To make sure that only the user and the domain administrators have
permissions to open a particular redirected folder, do the following:
1. Select a central location in your environment where you would like to
store Folder Redirection, and then share this folder. In this example,
FLDREDIR is used.
2. Set Share Permissions for the Everyone group to Full Control.
3. Use the following settings for NTFS Permissions:
. CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
. System - Full Control (Apply onto: This Folder, Subfolders and Files)
. Domain Admins - Full Control (Apply onto: This Folder, Subfolders
and Files)
. Everyone - Create Folder/Append Data (Apply onto: This Folder Only)
. Everyone - List Folder/Read Data (Apply onto: This Folder Only)
. Everyone - Read Attributes (Apply onto: This Folder Only)
. Everyone - Traverse Folder/Execute File (Apply onto: This Folder
Only)
4. Configure Folder Redirection Policy as outlined in Windows Help. Use a
path similar to \\server\FLDREDIR\username to create a folder under the
shared folder, FLDREDIR.
Because the Everyone group has the Create Folder/Append Data right, the
group members have the proper permissions to create the folder; however, the
members are not able to read the data afterwards.
The Username group is the name of the user that was logged on when you
created the folder. Because the folder is a child of the parent folder, it
inherits the permissions that you assigned to FLDREDIR. Also, because the
user is creating the folder, the user gains full control of the folder
because of the Creator Owner Permission setting.
REFERENCES
For additional information, click the article number below to view the
article in the Microsoft Knowledge Base:
232692 (
http://support.microsoft.com/kb/232692/EN-US/) Folder Redirection
Feature in Windows