Folder Redirection Not Working..

[Deeem]

Hi guys,

Ok, We have got group policies setup for 3 OU's (Staff, Newdeal, Training).

The policys are pretty much the same on each OU for now, except that each one will redirect the users my docs depending on their Security Group. (i.e. Training -> \\ictserv\training\)

All the settings are still there in the group policy to redirect, but when the user logs on the my docs is linked locally.

Anyone got any ideas?

Thanks

Damon

 

[markdmac]

OK, let's drop down to basics first. Does that UNC path exist? Do the users have write rights to it?

Did you check the security settings of the GPO to see who it is set to be applied to? In GPMC edit the GPO. Right click the name and choose properties. On the security tab you will see the list of who the GPO will be applied to. The last setting os for Apply or Deny. Make sure the right users are in the Apply and that NO groups they belong to are in the Deny.

Make sure that replication has happend between your domain controllers to ensure the DC validating your users has the updated policy.

Finally, force a Group Policy update on your workstations.

On XP type the following at a command prompt.
gpupdate /force

On Win2K it is 2 comands:
secedit /refreshpolicy machine_policy /enforce
secedit /refreshpolicy user_policy /enforce

Last note: If your clients are NT4 or 98 then the policy won't hit them.


I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[Deeem]

Ok, it looks like its something to do with write/access permissions, is there set procedure on setting access writes for share permissions and ntfs permissions.

Could you guide me through it? I have tried reading up on the permissions guides and they exude a load of jargon.

Cheers

Damon

 

[markdmac]

Share and NTFS are not so mysterious if you break it down. The way it works is you combine the rights together and the most restrictive wins.

For example if you give Full Access to a share but only Read Access on the NTFS, the user would only have Read Access.

Most admins I have found just give the Full Access on the share level and then lock down the NTFS.

In your case you may need to take this one step further because you need to determine if it is OK or not to allow other users to see the files of other users.

Rather than make assumptions, tell me how you would like it to be restricted and I can give you pointers on how to accomplish your goal.



I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[Deeem]

Cool, thanks man!

I would like to have it set up so that users are able to have full control over their own my docs on the server.

Also, so that they cannot see each others my docs, but domain admins can have full control and view everything.

If this is possible to setup, great!

Thanks for the help

Damon

 

[markdmac]

yes this is possible, but will require just a little bit of work. How many users do you have? That will determine the need to script this all or not.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[Deeem]

We have 25-30 users needing my docs redirection.

Regards

Deeem

 

[Deeem]

I have checked via the users machine if they can access their \\ictserv\training\%username%\my documents folder and it says access denied.

When I check the security on that network my docs folder it says only domain admins is set up on the folders.

Regards

Deeem

 

[markdmac]

OK, that isn't that many so manual settings should be OK.

You will need to use the Advanced button on the NTFS settings.

At the \\ictserv\training\ level set the NTFS permissions so that the training group has List permissions on This Directory Only. Give Admins and System Full Control on This Folder, SubFolders and Files.

Now drill down to the user folders. With inherritance on the Admin & system should have Full Control and users should have nothing. Add your individual user with the permissins you wnat them to have. Most likely you want them to have everything except full control. (Full Control gives then the ability to assign rights to the folder and you just want them to be able to store docs in it and modify their docs. I find it fastest to select Full Control which checks everythign else, then I uncheck just the Full Control. Click the Advanced button and make sure that the setting for the user is for This Folder, SubFolders and Files.

Repeat this last step for each user folder and you should be good to go.



I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[Deeem]

Hi,

Thanks for the reply.

I did all that, the user can access the \\ictserv\training\%username%\my documents\ through my network places now thanks to the inheritable permissions check box

But...the folder redirection is still not working, it remains pointing to local.

Bah! Thanks for all your help so far anyway!

Deeem

 

[Deeem]

OK forget that last post.

It works on itimitantly on some machines and not others. Very wierd, im not completely sure whats going on here lol

 

[markdmac]

On the machines it is not workig on force a Group Policy update on your workstations.

On XP type the following at a command prompt.
gpupdate /force

On Win2K it is 2 comands:
secedit /refreshpolicy machine_policy /enforce
secedit /refreshpolicy user_policy /enforce



I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[Deeem]

Thanks for the reply again mark.

OK, its a complete spin out but heres the scenario.

OU: Newdeal
Users: neilg, andrewr, emmap, davidb

We have 2 computers here Im using to test these policys etc on.

neilg is the only user folder redirection works on, yet there all in the same group and OU that the policy is applied on.

All the permissions are fine as the users and browse through my network places to their my docs folder on the server.

I tried the gpupdate /force to no avail im afraid.

Any ideas?

Thanks in advance

Damon

 

[markdmac]

I would check all of the groups that each user is a member of. How have you set the GPO security? Verify that you have set the apply to a group that all three users are a member of.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[Deeem]

Hi Mark,

All the users are members of the groups they should be.

The security of the GPOs is:
Authenticated Users - Read, Apply Group Policy
Group - Read, Apply Group Policy
And all the other admin permissions.

What I dont understand is why it only works on 1 user in the group and only works on 1 of the test machines.

Is there something I should be doing to the local computers to accept this redirection policy?

*Animation of me pulling hair out*

Regards

Damon

 

[markdmac]

Damon,

Try using RSOP and GPRESULT to see what AD thinks should be hitting your users.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[Deeem]

Hi,

Ok on the GPRESULT for user davidb we got..

Type: Windows XP
Config: Member Workstation
Domain Name: ICT
Domain Type: Windows 2000
Site Name: Default-First-Site-Name
Roaming Profile:
Local Profile: c:\documents and settings\davidb.ICT

Group Policy was applied from:
ictserv.ict.com

Applied Group Policys:
Newdeal Group Policy, Default Domain Policy

Users part of the following Group(s):
newdeal
Everyone
Bulletin\Users
LOCAL
NT Authority etc.

Regards

Damon

 

[markdmac]

OK, and what is the name of the policy that holds the folder redirection? Is it newdeal?

How does the gpresult differ on the user that IS getting the redirection?

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[Deeem]

The policy that holds the redirection for those users in particular is called "Newdeal Group Policy".

The group the users are in is "newdeal"

There is no difference in the gpresults for the newdeal group users what so ever.

Mindboggling!

Damon

 

[Deeem]

Hi

I know someone with the MCSE Videos and theres a lesson on folder redirection apparently. Ill take a good look at that.

Other than that, im screwed!

Cheers for ya help anyway mark!