0

OK, so I want to set the profile path and have it mapped to a drive letter, but I don't want everyone else to be able to access that folder. Just maybe admins and the actual user.

\server\home-directories\%username%

That's what I put in. But the problem is that anyone can just go to \server\home-directories and then have their pick any anyone else's home directory/profile folder. How do I block them and have active directory/gpo do it? I am using windows 7 and a few xp pro's and all server 2008 R2.

1 Answer 1

0

The trick is to use creator owner permissions. In fact it means that users are allowed to create any folder within root of home directories \\server\home-directories but can access only those created by themselves. I recommend you do not to try this guide straight on your production \\server\home-directories folder, but create test one due you may have broken inheritance or other permission stuff I'm not aware:

Open security tab from properties of \\server\home-directories. In this tab hit Advanced to edit special permissions:

1.) Leave there only admin permissions so you can later administer this folder

2.) Add Authenticated Users, but set flowing permissions:

Apply to: This folder only
Allow: Traverse folder, list folder, read attributes, read extended attributes, create folders, read permissions

3.) Add CREATOR OWNER, but set folowing permissions:

Apply to: Subfolders and files only
Allow: Full control (or some limited access for user to their home directory dependant on company policy)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .