1

In our AD, we create new users by copying a default user in ADUC. For the default user we specified a home folder using the %USERNAME% variable (mapped to H:): \fileserver\homes\%USERNAME%

For new users, the home folder on the server is automatically created with BUILTIN\Administrators set as owner. But we need the user to be set as owner. How can we achieve this?

The permissions set on the parent folder (homes) are the following:

CREATOR OWNER         Full            Subfolders and files only
g_admins              Full            This folder, subfolders and files
SYSTEM                Full            This folder, subfolders and files
Authenticated Users   Read, Append    This folder only
(Owner: g_admins)
Bryan
  • 7,538
  • 15
  • 68
  • 92
x-ray
  • 130
  • 1
  • 6

2 Answers2

2

Why? Your permissions seem odd too. Assuming you haven't changed the default server behavior for "bypass traverse checking" then all you need is:

\fileserver\homes

  • Domain Admins = Full

  • G_Admins = Full

When you create a user in ADUC and assign their home drive:

\fileserver\homes\%username%

it should set those permissions as:

  • Domain Admins = Full
  • G_Admins = Full
  • %username% = Full (whatever the user's login ID is)

If you want authenticated users to have read access to everyone's home folder then add them to the \fileserver\homes folder with Read access.

But maybe there's a reason for your setup...just showing you how I would do it.

TheCleaner
  • 32,352
  • 26
  • 126
  • 188
  • Ok, I tried setting Domain Admins = Full and g_admins = Full (only those two) for \\fileserver\homes, but the owner of new %username%-folders still is BUILTIN\Administrators. I want that to be the user so that we can use disk-quotas. – x-ray Apr 17 '12 at 16:34
  • You can use subinacl to set the ownership, but it'd have to be scripted with variables if you don't want to mess with it manually. I thought disk quotas were based on file ownership not folder. As users create files in their home directory they will be the owner of those files, so disk quotas should apply. – TheCleaner Apr 17 '12 at 18:27
0

You need to add the CREATOR OWNER security principle to your "homes" folder and assign it whatever permissions you want the user to ultimately have when their home folder gets created. This will automatically set them as the owner and also preset their permissions.

Note, as a best practice, you should give the users Modify permissions and not Full, even for their own files. A common problem that I have seen is that a "savvy" user will go in and remove SYSTEM and Administrators permissions from their files, which ultimately prevents their files from being backed up and may even affect the enforcement of quotas or other maintenance done by server administrators.

SamErde
  • 3,324
  • 3
  • 23
  • 42
  • How exactly would the permissions look like when I only want to give users "Modify"-permissions? – x-ray Apr 24 '12 at 08:01
  • That depends if you are modifying the ACL (permissions) from the basic security dialog box or if you went through to the advanced security settings dialog. In the standard security tab, click Edit, then add "CREATOR OWNER" and just check the box next to Modify. If you are working in the Advanced Security Settings window, you will need to check Allow for everything EXCEPT "Full Control", "Delete subfolders and files", "Change Permissions", and "Take ownership". – SamErde Apr 24 '12 at 12:22