Folder Redirection: Permissions

[Manu Narayan]

We use redirected folders via a GPO. Everyone's My Documents and Desktop are redirected to a server. This allows us for backup as well as 'roaming' users.

The issue is, the share was setup with the root, everyone has access (not a security breach, people cna see a users root folder, but not traverse inside) However, the GPO was setup to grant each user 'exclusive rights' to their own folder. This prohibits domain admins from accessing the data.

I've since modified the root share to have full control for Creator/Owner, Domain Admin, and System. However, this permission will not propogate, since the domain admin is not the owner of the user's folder.

I've tried to uncheck 'grant exclusive rights' on the GPO, and that works for new redirected folders, but it does not change the status of existing users (even on log on/log off)

So the question is, as a domain admin, if I have no permissions/am not the owner on a folder, how can I add permissions to it? Or, more precisely, how can I make it so after the fact, a domain admin can access a redirected folder...

Thanks...
Manu

[Ivan Ferreira]

You have to remove the redirected folder policy.

Before, configure the policy removal option to:

Redirect The Folder Back to teh local userprofile location when policy is removed.

The special folder will return to the user profile location, the contents are copied, not moved and won't be deleted from the location they where redirected to.

Then configure the policy again without grating exclusive rights.

Also note that if you redirect My Documents to the home folder, domain administrators have Full Control permission over the userâ s My Documents folder, even if you enable the Grant The User Exclusive Rights To My Documents option.

When you redirect My Documents to a userâ s home folder, the system assumes that the
administrator has set the following items correctly:

Security
Ownership
Home directory property on the user object

Works only with XP Pro clients.

[Manu Narayan]

Ick remove and then readd the policy?

So that means people logging in, 'applying personal settings' back to their local profiles and then another restart and 'applying personal settings' back to the server?

No other options here?