Age old question of home directory setup and permissions? 1

[cajuntank]

What is the best way to setup home directories for users in a medium/large network. I have done, seen, and read several variations. In the network I have taken over, we have several of those variations ranging from the share being the users directory (\\server\users\jpublic) to the share being the actual user him/herself(\\server\jpublic).

I would like to standardize on something across the board and would like some input/suggestions.

1.What I'm looking for is what permissions to set for the folder and NTFS on the share itself?
2.What is usually done so that users can't see other users folders (I know doing the sharing of the username itself would do this, ie... \\server\jpublic) but is there another way to handle this?
3.Will I have to touch each users profile property tab under ADUC to change this is can it all be done via a login script?

Thanks.

 

[porkchopexpress]

We use a single share for all of our home folders and set it so the users have 'change' share permissions this prevents the users from being able to mess with NTFS permissions, if they need to be able to do that then they will need 'full' share permissions. If you have users with different requirements you can group them under different shares or create a second share at the same point.

We then control home folder access using NTFS permissions so they can't open each others folders. You can also use 'access based enumeration' on 2003 SP1 and above servers, this will hide folders that users don't have any permissions to but it can add a small overhead. (We’ve never had any issues with performance)

Be aware that clients before 2000 Pro (read 9x) have trouble accessing home folders through a root share which is probably why you still have some individually shared home folders.

 

[cajuntank]

Do I just do a google search for access based enumeration? Is this an additional service I load (add/remove programs)?
What's your thoughts on doing hidden shares? I see a lot of people using them as well. I know this does not address from a security standpoint, but more from "smoke and mirrors".

 

[cajuntank]

Also, one of the reasons I'm hot on this is because all of a sudden some of my sites when the user logs in, they get their folder mapped up a directory level. When we reboot the machine, it might fix it then and there or it might take several reboots. I have seen this addressed a little on other forums and except for a GPO property to enable of (and I'm paraphrasing) make sure network connections are finished before logging in... or something like that.
Again, I'm taking this network over so I'm dicovering all kind of nice things that were done this way and that. Some of my sites don't even have login scripts running at all. It was done as a persistant drive mapping from the desktop itself.

 

[porkchopexpress]

I tend to use hiddes shares as you say it's not much security but it helps prevent nosey users.

Access Based Enumeration

http://www.microsoft.com/technet/te...et/technetmag/issues/2006/09/UtilitySpotlight

 

[porkchopexpress]

For you drive mapping issue i'd look at setting the 'Always wait for the network at computer startup and logon' policy.

http://technet2.microsoft.com/windo...f515-4b80-b794-fe09b5c21bad1033.mspx?mfr=true