Hi,
THE SETUP
Server 2008 TS with users getting a full desktop
Windows 2008 DC's using 2008 GPO for the majority of the configuration
Single active directory domain at 2003 native functionality
Profiles are redirected by GPO to a DFSR share on a 2008 x64 file server.
Shell folders are redirected out of the profile to another DFSR share also on a 2008 file server.
I have set the recommended permissions (as below) on the redirected locations and both the profile and redirected folder are created successfully.
The permissions on
\\DFS\Users\Profile and
\\DFS\Users\Personal are:
Share:Everyone - Full Control
NTFS:CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
System - Full Control (Apply onto: This Folder, Subfolders and Files)
Domain Admins - Full Control (Apply onto: This Folder, Subfolders and Files)
Authenticated Users - Create Folder/Append Data (Apply onto: This Folder Only)
Authenticated Users - List Folder/Read Data (Apply onto: This Folder Only)
Authenticated Users - Read Attributes (Apply onto: This Folder Only)
Authenticated Users - Traverse Folder/Execute File (Apply onto: This Folder Only)
When in the TS session the users can now create files and save/open them in the redirected folders perfectly.
THE PROBLEMThe problem is that I have existing files that I wish to move from another server into their new redirected "Documents" folder.
When I move the files they inherit the permissions of the redirected folder as expected and the user can see but cannot access the files.
On checking, the user has "Special Permissions" that were created automatically by the folder redirection GPO that apply to "This folder only".
Any file actually created by the user seems to inherit the same permissions but this includes permissions to access the new file.
Files not actually created by the user (i.e. moved/copied into the folder) do not give the user access to the file.
I can work around the problem by adding the required permissions for the user at the top folder level but this should not really be required and is going to be a probelm if I have to administer this for 2500 users.
Has anyone come across this problem and know a solution.
Thanks
Billy