Some days ago I faced folder redirection problems for some users who's My Documents folders were redirected to share where they had Change (not Full Control) access (additionally restrictive NTFS permissions were used). These users were also configured to use roaming profiles.
The problem was that My Documents folder wasn't redirected for some (not all) users, instead it pointed to local copy of My Documents folder from roaming profile (in other words My Documents path for those users was "%userprofile%\My Documents" instead of "\\file-server\users\%username%\My Documents").
Also some .tmp files were created in "\\file-server\users\%username%\My Documents" and an error similar to this was logged in event log:

Failed to perform redirection of folder My Documents. The files for the redirected folder could not be moved to the new location. The folder is configured to be redirected to <\\file-server\users\%username%\My Documents>. Files were being moved from <C:\Documents and Settings\Davis\My Documents> to <\\file-server\users\Davis\My Documents>. The following error occurred while copying <C:\Documents and Settings\Davis\My Documents\My Music> to <\\file-server\users\Davis\My Documents\My Music>:
The security descriptor structure is invalid.

Although this was not tested, I suppose that folder redirection needs Full Control access to redirection destination to copy files. I didn't want to give users ability to change access permissions on their folders, so I didn't consider Full Control access as a good solution. Also just setting registry paths via logon script didn't seem to be a good idea.
After some search on internet I didn't found any suitable solution (this is the main reason why I have published this).
The main idea is that folder redirection will work fine if there will be no folders/files to move. So I simply wrote a script that moved all My Documents folders from roaming profiles to folder redirection targets (actually that script was a bit different but this doesn't matter).
Basically the solution is to manually (with help of a script) move folders that should be redirected to their redirection targets. When there will be no folders to move, folder redirection will simply change registry paths instead of complaining about permissions.
Moving folders is very simple with roaming profiles and I think it can be easily implemented in logon scripts for automated processing of local profiles as well.
Posted on 2007.05.21. 17:47

Post a comment