Removing Folder Redirection AFTER Transitioning to a Fully Remote Workforce

Question

I have a client who has moved out of their office space and all the employees work exclusively from home.  They relocated their on-premises servers to a colo data center, but clients can only access the servers though a VPN connection.  There’s no office to go into where the laptops have line-of-sight to a domain controller. 

I’m helping them move to M365 and would like to replace their folder redirection GPO with OneDrive for Business.  I have created a security group for user that have their folders redirected and applied it to the folder redirection GPO, in place of the Authenticated Users group.  This gives me the ability to remove that GPO from individual users. 

My issue is the remote laptops don’t pick up that change.  My migration process is outlined below: 

1.       Connect to the client computer with remote access software (e.g. Splashtop).

2.       Have the user connect to the VPN. 

3.       Remove the user from the ‘Folder Redirection Users’ security group. 

4.       Run GPUpdate.exe /Force and log them off. 

a.       This unfortunately disconnects their VPN session. 

5.       Instruct the user to log back on again. 

6.       Manually move the known folders to OneDrive. 

When I try to manually move the Desktop, Documents and Pictures folders, I get an error that says “Your IT administrator has set a policy that prevents changes to known folders. Contact your administrator to resolve this issue. (Capabilities: 0x101)”.  Obviously, the client computer still thinks the folder redirection GPO is applied. 

Since the folder redirection GPO is processed during logon, but the user is never connected to the network or VPN at that point, that GPO is never removed. 

Is there a way to manually remove the GPO from the client side, like through the registry?  Or somehow trick the clients into thinking the policy no longer applies to the user?  I’d like to avoid deploying an Always On VPN connection for just this one task, as it will be removed once OneDrive is in use.  Plus, it’s deployed via a GPO and I’d have to instruct end users to connect to the VPN for that deployment, and I’m trying to get away from the VPN and on-prem infrastructure. 

Thanks in advance for any ideas you can share! 

Answer 1

This has probably been fixed, but even though you've turned off folder redirection, the registry keys in Shell Folders (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders) and User Shell Folders (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders) are still pointing to the network share. These need to be reset back to local before turning on backups in OneDrive as folder redirection and OneDrive share/use the same registry keys.