Automatic creation of user folders for home, roaming profile and redirected folders

[LEFT][CODE]http://blogs.technet.com/askds/archive/2008/06/30/automatic-creation-of-user-folders-for-home-roaming-profile-and-redirected-folders.aspx[/CODE]


Hi Rob here again. Periodically we’re asked "what is the best way to auto-create home, roaming profile, and folder redirection folders instead of Administrators creating and configuring the NTFS permissions manually?" The techniques in this post requires you to use the environment variable %USERNAME% in the user’s home folder attribute when you create the users account.
We will also make use of the [URL="http://technet2.microsoft.com/windowsserver/en/library/e5026578-e891-4107-aa2e-9d180428055d1033.mspx?mfr=true"]“$” symbol[/URL] in the share name; which makes the share hidden from anyone who attempts to list the shares on the file server via computer browsing.
Alright let’s get started.
[B][U]Home directory:[/U][/B]
Home folders are created automatically when the user’s account is created and an administrator has enabled the use of home folders. You change the home folders for the user afterwards, but we are all about making the Admin’s life easier.
[B][COLOR=#008080]Create the folder and enable sharing[/COLOR][/B]

[INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_2.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb.png[/IMG][/URL] [/INDENT]As you can see we create the share name and added a dollar sign ($) to the end.
Next, we’ll configure the share permissions. It is important to note that there is a difference in the default permissions for a share between Windows NT/Windows 2000 and Windows Server 2003. By default, Windows 2000 gives the Everyone group Full Control permissions. Windows Server 2003 gives the Everyone group Read permissions. However, we’ll change this to:
[INDENT] [COLOR=#0000ff]Administrators: Full Control
System: Full Control
Authenticated Users: Full Control[/COLOR]
[URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_4.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_1.png[/IMG][/URL] [/INDENT]If you expect or want users to be able to select their home directory to be available while they are not connected to the network (also known as [URL="http://technet2.microsoft.com/windowsserver/en/library/830323a2-23ca-4875-af3c-06671d68ca9a1033.mspx"]Offline Files[/URL]), then you’ll want to make sure you turn on Offline file caching of the HOME$ share. You do this by:
[INDENT] 1. Click [B]Offline Settings[/B] on Windows 2000 or [B]Caching[/B] on Windows Server 2003 or later, which is located on the [B]Sharing[/B] tab.
2. Click [B]Only the files and programs that users specify will be available offline[/B]. If you would like more information on the different options and what they mean you can click [URL="http://technet2.microsoft.com/windowsserver/en/library/e8aeb155-0e06-4659-923a-f9ad228fd1211033.mspx?mfr=true"]here[/URL].
3. Then click [B]OK[/B].[/INDENT]NOTE: You should consider configuring Offline Files settings even if you do not want users to work with files while they are not connected to the network—you’ll want to disable Offline Files by clicking [B]Files or programs from the share will not be available offline[/B].
[B][COLOR=#008080]Configuring NTFS Permissions[/COLOR][/B]

Now we need to configure the NTFS permissions, so we need to be on the “Security” tab of the folder we created earlier.
1. Turn off inheritance on the folder and copy the permissions. You do this by:
[INDENT] a. Click the [B]Advanced[/B] button found on the [B]Security[/B] tab.
b. Clear [B]Allow inheritable permissions to propagate to this object [/B]check box in the [B]Advanced Security Settings[/B] dialog box.
c. Click [B]Copy[/B] when prompted by the Security dialog box.[/INDENT]2. Click [B]OK[/B] to return to the [B]Security[/B] tab. Ensure we have the following permissions set:
[INDENT] [COLOR=#0000ff]Administrators: Full Control
System: Full Control
Creator Owner: Full Control
Authenticated Users: Read & Execute, List Folder Contents, Read[/COLOR][/INDENT]3. Change permissions for Authenticated Users so they cannot access other users’ folders. You do this by:
[INDENT] a. Click [B]Advanced[/B] on the [B]Security[/B] tab.
b. Click Authenticated Users, and then click [B]Edit[/B].
c. On the [B]Permissions Entry for HOME[/B] dialog box, drop down the Apply[B] onto[/B] and select [B]This folder only[/B].
d. Click [B]OK[/B] twice.[/INDENT][INDENT] Here is a screen shot of this step:[/INDENT][INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_6.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_2.png[/IMG][/URL] [/INDENT][INDENT] We now have the permissions configured properly. Next, let’s create a user and specify the home folder location. This is done by going to the [B]Profile[/B] tab of the user account in[B] Active Directory Users and Computers.[/B] In the following screen shot shows an example of a drive mapping.[/INDENT][INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_8.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_3.png[/IMG][/URL] [/INDENT][INDENT] Yep, the [B]TOM[/B] folder got created without a problem:[/INDENT][INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_10.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_4.png[/IMG][/URL] [/INDENT][INDENT] When we look at the permissions of the [B]TOM[/B] folder we see the following:[/INDENT][INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_12.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_5.png[/IMG][/URL] [/INDENT][INDENT] We see that only [B]Administrators[/B], [B]System[/B], [B]Tom[/B], and [B]Creator Owner[/B] have permissions to the folder. Other users do not. [/INDENT][B][U]Roaming Profile:[/U][/B]
Configuring roaming profiles uses the same procedure as the home folder share, except for one difference. You should disable Offline Files and you should always hide the profile share using a dollar sign ($).
Since the setup is pretty much exactly the same (except for the share name) so I’m not going to bore you with the same steps as earlier.
The main difference between the roaming profile folder and the home folder is that the roaming profile folder is not created until the user logs on and then logs off. Windows creates the profile directory and copies the profile to the share once the user has completed one successful logon and logoff.
You configure the profile location on the [B]Profile[/B] or [B]Terminal Services Profile[/B] tab within Active Directory Users and Computers. Type a UNC path to where Windows should create the user profile. The following screen shot gives you an example a user account configured with a profile path.
[URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_14.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_6.png[/IMG][/URL]
[B][U]Folder Redirection:[/U][/B]
For the most part the share and NTFS permissions are the same as the Home folder configuration except we need to replace Authenticated Users with the Everyone group. This is required for Windows to automatically create the redirected folders. These two KB articles provide more information:
291087 Event ID 101 and Event ID 1000 Messages May Be Displayed When Folder
[url=http://support.microsoft.com/?id=291087]Event ID 101 and Event ID 1000 Messages May Be Displayed When Folder Redirection Is Set Up with Group Policy[/url]
274443 How to dynamically create security-enhanced redirected folders by using
[url=http://support.microsoft.com/?id=274443]How to dynamically create security-enhanced redirected folders by using folder redirection in Windows 2000 and in Windows Server 2003[/url]
[B][COLOR=#008080]Create the folder and enable sharing[/COLOR][/B]

So, we need to create a folder on a file server and enable it for sharing, again I would recommend that you hide the share using the dollar sign ($) at the end of the share name.
[INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_16.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_7.png[/IMG][/URL] [/INDENT]If you expect or want users to be able to select their home directory to be available while they are not connected to the network (also known as [URL="http://technet2.microsoft.com/windowsserver/en/library/830323a2-23ca-4875-af3c-06671d68ca9a1033.mspx"]Offline Files[/URL]), then you’ll want to make sure you turn on Offline file caching of the HOME$ share. You do this by:
1. Click [B]Offline Settings[/B] on Windows 2000 or [B]Caching[/B] on Windows Server 2003 or later, which is located on the [B]Sharing[/B] tab.
2. Click [B]Only the files and programs that users specify will be available offline[/B]. If you would like more information on the different options and what they mean you can click [URL="http://technet2.microsoft.com/windowsserver/en/library/e8aeb155-0e06-4659-923a-f9ad228fd1211033.mspx?mfr=true"]here[/URL].
3. Then click [B]OK[/B].
We will also need to set the following permissions for the share:
[INDENT] [COLOR=#0000ff]Administrators: Full Control
System: Full Control
Everyone: Full Control[/COLOR] [/INDENT][INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_18.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_8.png[/IMG][/URL] [/INDENT][B][COLOR=#008080]Configuring NTFS Permissions[/COLOR][/B]

We need to configure NTFS permissions for the newly created folder. You’ll want to remove inheritance from this folder, as we did when configuring home folders.
1. Turn off inheritance on the folder and copy the permissions. You do this by:
[INDENT] a. Click the [B]Advanced[/B] button found on the [B]Security[/B] tab.
b. Clear [B]Allow inheritable permissions to propagate to this object [/B]check box in the [B]Advanced Security Settings[/B] dialog box.
c. Click [B]Copy[/B] when prompted by the Security dialog box.[/INDENT]2. Click [B]OK[/B] to return to the [B]Security[/B] tab. Ensure we have the following permissions set:
[INDENT] [COLOR=#0000ff]Administrators: Full Control
System: Full Control
Creator Owner: Full Control
Everyone: Read & Execute, List Folder Contents, Read[/COLOR][/INDENT]3. Now we need change the permissions a bit for “Everyone” so that they do not have any permission to other users’ folders. This is done by doing the following:
[INDENT] a. Click [B]Advanced[/B] on the [B]Security[/B] tab.
b.Click [B]Everyone[/B], and then click [B]Edit[/B].
c. On the [B]Permissions Entry for FldrRedir[/B] dialog box, drop down [B]Apply onto[/B] and select [B]This folder only[/B].
d. Click [B]OK[/B] twice.[/INDENT][INDENT] Here is a screen shot of this step:[/INDENT][INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_20.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_9.png[/IMG][/URL] [/INDENT]4. Configuring Folder Redirection settings within Group Policy:
a. Use the Group Policy Management Console (GPMC) and edit the GPO containing the Folder Redirection settings you want modified. Configure each from the following list to use the [B]Basic – Redirect everyone’s folder to the same location[/B] Folder Redirection setting. Type the UNC path listed in the table into the Root Path setting for each folder listed in the following table

[IMG]http://i48.tinypic.com/2cpusqx.jpg[/IMG]
[INDENT] Here is a screen shot of Application Data being redirected:[/INDENT][INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_22.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_10.png[/IMG][/URL]
You can see that Windows shows you the entire path used for the Folder Redirection. So although we didn’t specify the user’s name in the [B]Root Path,[/B] the redirection example shows the folder path as: \\contoso-rt-mem1\FldrRedir$\Clair\Application Data
b. By default, Administrators do not have permissions to users’ redirected folders. If you require the ability to go into the users folders you will want to go to the “Settings” Tab, and uncheck: "Grant the user exclusive rights to" on each folder that is redirected. This allows Administrators to enter the users redirected folder locations without taking ownership of the folder and files.[/INDENT][INDENT] [URL="http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_24.png"][IMG]http://blogs.technet.com/blogfiles/askds/WindowsLiveWriter/Automaticcreationofuserfoldersforhomero_1018F/image_thumb_11.png[/IMG][/URL] [/INDENT]When you’re all done, you can kick back and enjoy the easy life of being an administrator. Now when you create the user and define the home path it will create the user’s home folder immediately. When Group Policy applies Folder Redirection; folders are created automatically. And, when the user logs off their roaming profile folders will be created after the first logon.
This last part is for the former Novell Admins out there. Yes, you could use [URL="http://www.microsoft.com/downloads/details.aspx?FamilyId=04A563D9-78http://www.microsoft.com/downloads/details.aspx?FamilyId=04A563D9-78D9-4342-A485-B030AC442084&displaylang=enD9-4342-A485-B030AC442084&displaylang=en"]Access Based Enumeration (ABE)[/URL] on these new shares; however if there is going to a lot of user folders on any one of these shares you could experience degradation of performance. Enabling ABE on a share does come at a price of performance. If you are still all hyped up to enable this feature please read ABE whitepaper available information so that you make an informed decision.




- Robert Greene

[/LEFT]