Redirect My Documents
Right-click My Documents in the GPE's console pane, select Properties, and move to the Target tab. My Documents' default Target setting is No administrative policy specified. Click the arrow at the right of the Setting box to display the following redirection choices:
- BasicRedirect everyone's folder to the same location. Choose this option to redirect My Documents for all users in the selected container (e.g., the domain, the OU) and to use the same server for all redirected folders.
- AdvancedSpecify locations for various user groups. Choose this option to redirect My Documents for only mem-bers of particular groups or to specify different servers for different groups' folders.
The Basic redirection option is straightforward; all you need to do is establish the target folder on the server. The Advanced redirection option lets you be selective about the target users and target folders. You can use this option to redirect folders for specific users according to their group memberships. For example, if you've created a security group for mobile users, this option provides a way to exclude those users from the redirected folders policy. (If you haven't created a security group for mobile users, you should create one or more OUs for them and apply the redirected folders policy at the OU level.) The Advanced option requires more steps, so I'll describe the process for configuring this option. If you choose the Basic option, simply follow the step for specifying the target folder.
When you select the Advanced option, a Security Group Membership section appears on the Target tab. To add a group to the list, click Add. This action opens the Specify Group and Location dialog box, which you use to select groups and to specify the location of each group's redirected folders.
Click Browse in the Security Group Membership section to open the Select Group dialog box. Select the security group to which you want to apply folder redirection and click OK. The group's name appears in the Security Group Membership section's text box.
In the Target Folder Location section's text box, type the Uniform Naming Convention (UNC) path to the server share you created to hold the redirected folders. To this path, add the variable %username%. If you don't remember the UNC path, you can click Browse and select the folder, but the Target Folder Location box then displays the folder's path with a drive letter instead of a UNC path. Delete the drive letter and use the UNC path format instead. Figure 1, page 144, shows the specifications to redirect folders for my domain's accounting department (i.e., members of the Accntg group in the WESTERN domain) to a parent folder (i.e., the Userdocs folder on the server west).
Repeat these steps to continue adding groups. You can place each group's redirected folders on different servers or in different parent shares, or you can put all the redirected folders into the same share on the same server. When you've added all the groups you want to target, move to the Properties dialog box's Settings tab to configure the redirection settings for the policy. Figure 2, page 144, shows the recommended options.
If you didn't previously separate My Pictures and My Documents, the options in the Settings tab's My Pictures Preferences section are inaccessible. Wherever you redirect My Documents, My Pictures comes along for the ride.
Automatically Creating User Subfolders
The next time an affected user logs on, the system automatically creates the \%username% subfolder on the server and copies all existing user documents to that subfolder. As the user saves and opens documents, the user's system transparently accesses the server-based folder.
If you want to verify the creation of a user's folder, you (or the user) can right-click the My Documents folder on the client desktop and select Properties. The Target box under the Folder Location section should display the UNC path for the server-based folder (instead of the user's subfolder under the local Documents and Settings folder). You can also check the server to make sure the folder you created adds a \%username% subfolder as each affected user logs on.
Protecting User Privacy
As I mentioned earlier, the folder redirection feature provides safeguards for user privacy: The redirected documents are available only to the user. (Even an administrator who tries to open a user's subfolder on the server receives an error message stating that access is denied.) Each \%username% subfolder has the following default permissions:
- %username% (i.e., the user)—Full Control
- Everyone—No Access
- System—Full Control
Everyone Wins
I use folder redirection because it's the only surefire scheme for backing up user-created documents. The additional advantages of freeing up disk space on client computers and giving roaming users the ability to quickly get to their documents makes redirection a worthwhile feature that every administrator should investigate.