Networks

Ask something
Question Locked

AD home directory issue

0 helpful
3 replies

by larryd4

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Ok have something kind of wierd and I'm not sure why.

Scenario

My account is a member of Domain Admins group as well as Local. I have created a group for the rest of the IT staff called "IT"

I went to all of my servers and added the "IT" group to the root of the users folder where home folders are stored. I gave them full access but only to that \\users folder. No access to subfolders or files.

When the average IT guys goes in to an AD account to change the location or create a home folder for a user, AD creates the folder and assigns the correct security. But it also adds full controll to the folder for the IT anaylst making the change in AD.

Now the wierd part is when I do it, and I'm a memeber of the IT group and the domain/local admins group, it doesn't add my account to the security permissions.

isn't it vierd? ;)

3 replies

by kenone

That when you, a domain admin, create a folder on a DC for a user that you do NOT have admin rights to that folder?
I don't believe you.

by larryd4

No no no

A user directory storage foder is usually setup as follows

Adminsitrators - Full control folder, subfolder and files
System - Full control folder, subfolder and files
CREATOR OWNER - Full Control, sub folers and files

When you tell AD to create a home folder in this location it copies down the above permissions and then adds the AD account your creating with full control.

If I add the "IT" group at the top of the folder and have one of my people who are not a Domain admin but are local admins create a new AD account and crate the home folder. AD actually puts their ID at the top of the users folder along with the users full access.

This discussion is closed to new replies.