Folder Redirection GPO

Question

Folder Redirection GPO

Joel Heideman 136

We setup folder redirection policy and mistakenly set the "Grant the user exclusive rights option."

So Administrators cannot access folders due to ownership or other ACL restrictions.

I did a takeown command on a users folder and I was then able to access the folders, but, that broke the share for the user and I had to re-apply the ACL for them to have rights.

I'm curious how this GPO setting would no react if I uncheck the option in the GPO?

I doubt this will affect the Ownership of the hundreds of folders now, correct?

I'm sure I'm not the only one to experience this so I'm looking for a way out without having to re-create the share.

What does the exclusive rights option actually do for current and future folders?

Thanks :)

1 answer

Your answer

Answer 1

Thameur-BOURBITA 36,261 Moderator

Hi @Joel Heideman

I confirm that when you set this GPO setting ""Grant the user exclusive rights option."", only user can access on his holder.

Unfortunatly it's not possible to rollback through GPO, you should use Powershell command to assign the owernership to a admin group or other ACLs.

Below a example of powershell script to change the owner:

$ACL = Get-ACL -Path "D:\folderName"
$Group = New-Object System.Security.Principal.NTAccount("Builtin", "Administrators")
$ACL.SetOwner($Group)
Set-Acl -Path "D:\folderName" -AclObject $ACL

Please don't forget to accept helpful answer

Joel Heideman 136

Thanks - the issue with taking ownership with that script is it leaves the user with ACL of the USER top parent level only, and you have to re-assign all the permissions.

I found scripts to do this but since the users don't need their data, we will re-create the share and start over.

$acl = Get-Acl -Path C:\folder # Dummy folder created only to configure desired permissions (for the user folders)
$folder = (Get-ChildItem -Path D:\FolderRedirection).Name
$folder | ForEach-Object {
$user = New-Object System.Security.Principal.NTAccount ("DOMAIN", "$_") # DOMAIN is your NetBIOS Domain Name
$acl.SetOwner($user)
Set-Acl -AclObject $acl -Path "\\SERVERNAME\folderredirection$\$_"
Get-ChildItem -Path "\\SERVERNAME\folderredirection$\$_" -Recurse -Force | Set-Acl -AclObject $acl
}

REM This script changes the owner of each folder within Redirected Folders to the administrators group. Then it grants full control to administrators and the user the folder is named after.  It then changes the owner to that user.

SETLOCAL
SET "sourcedir=C:\Redirected Folders"
PUSHD %sourcedir%
FOR /f "tokens=1*" %%a IN (
 'dir /b /a:d'
 ) DO (  
 takeown /F %%a /R /D Y
 icacls %%a /grant %%a:^(OI^)^(CI^)F /T
 icacls %%a /grant administrators:^(OI^)^(CI^)F /T
 icacls %%a /setowner %%a /T
  
 )
POPD
GOTO :EOF

Thameur-BOURBITA 36,261 Reputation points Moderator

2023-12-14T23:29:03.92+00:00
@Joel Heideman
On your script when you use a dummy folder as template acl you will reset the existing ACL of user folder to force this template.

You need just adjust your script and avoid to reset ACL of user folder .

I tried to update your script to remove dummy folder and it will based on existing ACL on user folder:

$folder = (Get-ChildItem -Path D:\FolderRedirection).Name $folder | ForEach-Object { $acl = Get-Acl -path "\\SERVERNAME\folderredirection$\$_" $user = New-Object System.Security.Principal.NTAccount ("DOMAIN", "$_") # DOMAIN is your NetBIOS Domain Name $acl.SetOwner($user) Set-Acl -AclObject $acl -Path "\\SERVERNAME\folderredirection$\$_" Get-ChildItem -Path "\\SERVERNAME\folderredirection$\$_" -Recurse -Force | Set-Acl -AclObject $acl }

Please don't forget to accept helpful answer
Thameur-BOURBITA 36,261 Reputation points Moderator

2023-12-16T11:54:49.3066667+00:00

Hi @Joel Heideman

Just checking if there is any progress

Please don't forget to accept helpful answer
Joel Heideman 136 Reputation points

2023-12-16T13:17:19.1366667+00:00
Thank you for the script - I wish I had seen it earlier as I went in different direction that works perfectly now.

The best option I have found for us since we do are not concerned with keeping user data is to re-create the share, re-configure the GPO.

Use batch file in my previous post. to reset all permissions

Delete all folders

3.Create the new share with Domain Users full control ACL on share permissions, then manually set the correct ACL using these 3 commands -

icacls.exe E:\Data /inheritance:d

icacls.exe E:\Data /remove:g Users

icacls.exe E:\Data /grant Everyone:(x,ra,ad)

Share is now created properly - users cannot see subfolders of other users, only their own folder when exploring.
Thameur-BOURBITA 36,261 Reputation points Moderator

2023-12-17T23:04:38.39+00:00

Hi @Joel Heideman

Thank you for your feedback.

Please don't forget to accept helpful answer to close your thread
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Thameur-BOURBITA 36,261 Reputation points Moderator

2023-12-26T10:28:24.96+00:00

Hi @Joel Heideman

Please close this thread by accepting helpful answer in order to helpf forum visitor to identify the helpful answer.

Please don't forget to accept helpful answer and close the thread.

Share via

Folder Redirection GPO

1 answer

Your answer