Post by Lawson PolingMarcin, thank you for your reply. I'd like to further debate the issue. I am
not an expert on the subject of GPOs, but I do try to drill down into issues
to achieve clarity. That said, if you could provide a URL that supports your
reply I'd be most appreciative. It's simply due diligence on my part. I can't
return to my boss and say "Marcin said...". I'm sure you understand.
That aside, I'm considering the labeling of an OU and/or Security Group, and
your comment that the physical location is relevant. By the way, this is a
User GPO which I'm sure you are aware.
In this case, I could have called the OU 'Sandbox' and the Security Group
'Pale'. There is no reference to physical location here and, just because a
User and their computer may be in a particular location, it doesn't mean
either one would authenticate to the local Server and thereby suggesting a
current location. So I'm really stumped trying to reconcile your comment that
being in a particular location could have an effect insofar as GPOs go.
My take away from your reply also suggests that if I were to implement for
our other offices similar GPOs via OU's and Security Groups, the multiple
GPO's would apply to a User for each office they visited, thereby resulting
in a train-car of servers to which the synchronization would try to take
place. That would certainly not be a desired result of implementing Folder
Redirection.
Thank you for your response and your indulgence. I look forward to
"achieving clarity" :-)
Lawson...
Hello Lawson,
Can you provide a little more info on how you implemented Folder
Redirection? If you can elaborate a bit on how you setup the GPO, which
folders you opted for, how you setup the group, the folder redirect
location, where the users are (OU wise), etc.
Also, see if the following links help out any, as well as my little blog on
it.
I hope it helps...
======================================================================================================
======================================================================================================
Folder Redirection
I believe Folder Redirection with using Offline Files will be the better
solution for many environments. I have it implemented in all my customer
sites. All data with redirection set, as well as offline files, are cached
locally and only synch up at scheduled, manually set times, or when logging
on or off. It vastly reduces client to server traffic. Here are some links
regarding redirection.
Using Folder Redirection for the My Docs, App data, Start Menu and Desktop,
a user will get their data no matter where they login. Enabling Offline
Files as well, will provide an additional performance increase on the user
side, as well as the ability to take machines off-site (such as laptops) and
the folks will have their data no matter where they are. However, I usually
just implement Folder Redirection with the My Documents folder, and not the
others, due to the overhead of data and backup capacities on the server. You
know how large the application folder can get, and not always a good choice
to implement redirection with. Keep that in mind when you implement this
feature.
There are a few things that need to be setup in place to make redirection
work.
1. The user accounts need to be in the OU the Redirection Policy will apply
to. It doesn't matter where the computer accounts are. This is because
Redirection is a User based Policy.
2. More than likely, the Redirection policy is probably setup to apply to a
group. Therefore, make sure the user account is part of that group.
3. Only the internal DNS servers must show up in a machine's IP properties.
4. They way I setup the shares, is create a root folder called Users. I
share it out as Users$ and set share permissions to only System=FC and
Domain Admins=FC.
5. Then I would create child folders, one for each user. For example, for a
user named Bill, I create a BIll folder, then share it out as Bill$, and set
the share permissions to Domain Admins=FC, System=FC, and Bill=FC. The share
permissions for the user MUST BE FC or it won't work. Then I set the NTFS
permissions (the Security tab), to Domain Admins=FC, System=FC, and Bill=FC.
The user MUST have FC for both the share and the NTFS permissions.
6. In the user's AD properties, Profile tab, you want to configure a home
folder, and this is assuming you want their stuff redirected to the home
folder, such as clicking on G, H, or whatever letter, then configuring
something like \\servername\%username%$ (the $ makes it hidden). Whether to
hide it or not depends on corporate SOP. The %username% is a variable that
will create the folder for you, but I usually do it manually, as in the
previous steps.
7. Create the Redirect policy based on the group membership, for example the
My Documents folder, should be redirected to \\servername\username$\. You
can also create it as \\servername\username$\MyDocuments Documents, which I
like because their data goes into a subfolder under the user folder as My
Documents. Now many places simply use \\servername\username$ and is easy,
and it works. However, with this method, ALL of their documents wind up
directly in the root of the home folder. However, this could be a little
problematic with Vista. For more info on Vista and XP in a mixed
environment, and problems that may occur, read the bottom to articles in the
list of links provided below.
8. In the policy, select "Basic - Redirect everyone's folder to the same
location. For the target folder location, Redirect to the following
location, and it will create a UNC in the form of: \\%HOMESERVER%%HOMEPATH%.
Under the settings tab, check the box that says Grant the user exclusive
rights to My Docs. Also select to Move the Contents, as well as Leave the
Folder in the new location when the policy is removed.
9. I usually create a logon bat script, place it in the NETLOGON share, and
specify the script name in thier AD properties, to manually map the same
drive letter specified under the Profile tab for the home folder to the home
folder, such as with a command line of "net use h: \\servername\username$".
It can also be done using VB and a logon script in their GPOs. The script
normally does multiple other things as well. I'm just pointing out this
portion of it. It is your choice of using VB, CMD or bat files when creating
a script.
10. Enable Offline Use for the redirected My Documents.
11. Repeat for the other folders, if you choose to include them. I would set
them to use subfolders, such as Application Data, so the data doesn't get
intermixed with the My Docs.
Related articles:
Recommendations for Folder Redirection: Group Policy
http://technet.microsoft.com/en-us/library/cc785925.aspx
Folder Redirection feature in Windows
http://support.microsoft.com/kb/232692
How To Configure Folder Redirection, Aug 22, 2007 ... How to use Group
Policy
to redirect the "Desktop", "My Documents", "Start Menu" and "Application
Data" folders.
www.msterminalservices.org/articles/Configure-Folder-Redirection.html
How to Configure Folder Redirection
http://technet.microsoft.com/en-us/library/cc782799.aspx
How To Configure Folder Redirection
http://www.msterminalservices.org/articles/Configure-Folder-Redirection.html
User Profiles and Folder Redirection FAQ
http://www.microsoft.com/technet/community/en-us/management/manage_faq.mspx
Enabling the administrator to have access to redirected folders
http://support.microsoft.com/kb/288991
Folder Redirection in a mixed environment XP/Vista
http://www.gpanswers.com/community/viewtopic.php?t=2257
Folder redirection in Vista creates duplicate Music, Pictures, Desktop
folders.
http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/Windows_Vista/Q_23457815.html
======================================================================================================
======================================================================================================
--
Ace
This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.
Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
***@mvps.RemoveThisPart.org
For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
"Efficiency is doing things right; effectiveness is doing the right
things." - Peter F. Drucker
http://twitter.com/acefekay