Hi,
What are the recommended NTFS permissions from user home drives when you want to automate their creation from the Profile tab of each user account in AD? I dug around and tried some of the older recommendations but I am getting odd results.
Here is what I have done and the results:
Windows Server 2016
Created folder = Home
Shared folder as Home and share permissions Everyone = Full Control
NTFS Permissions on Home
SYSTEM
Full Control
This folder, subfolders and files
Company_Home_Admins
Full Control
This folder, subfolders and files
CREATOR OWNER
Special
All permissions EXCEPT Change permissions, Take ownership
Subfolders and files only
Authenticated Users
Special
Traverse folder/execute file, List folder/read data, Read attributes, Create folders/append data
This folder only
Then on my AD user account, go to the Profile tab, and set I the Home folder path to:
\\file_server\Home\%username%
Click OK
As expected it changes the path to:
\\file_server\Home\JeffP
Look at the file server in the Home folder I see a
JeffP folder created...but the permissions are not what I expect.
NTFS Permissions on Home\JeffP
SYSTEM
Full Control
This folder, subfolders and files
Inherited from D:\Home
This is as expected
Company_Home_Admins
Full Control
This folder, subfolders and files
Inherited from D:\Home
This is as expected
CREATOR OWNER
Special which is all permissions EXCEPT Change permissions, Take ownership
Subfolders and files only
Inherited from D:\Home
This is as expected
JeffP
Full Control
This folder, subfolders and files
Inherited from None
Why is the user getting Full? We don't want them to be able to Take Ownership or Change Permissions.
File_Server\Administrators
Full Control
This folder, subfolders and files
Inherited from None
How is this getting on here? We dont want the Windows serer admins to have any permissions. They are not NTFS educated.
File_Server\Administrators
Special which is all permissions EXCEPT Change permissions, Take ownership
This folder only
Inherited from D:\Home
How is this getting on here? And inherited? The local administrators group is no where applied to the Home folder.
Is this happening because the folder is getting created via the AD account and therefore it considers the user to be an administrator? The local Administrators group getting applied twice and in one instance saying it is inherited when it is absolutely not inherited is just baffling me.
If you made it this far thanks in advance!