Jump to content
MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. ×

Wrong access rights for moved user shell folders

Recommended Posts

I successfully move the My Documents folder for each user to a specific directory by importing a REG_EXPAND_SZ value at T-12 as described in this post:


At the end of that post, an ACL problem is mentioned when reinstalling Windows because new user IDs are generated. Other posts I've read seem to content themselves with moving folders and do not even mention any ACL problems.

However, I do not even get that far. The folders that are created provide full access to the Everybody group and to that group alone. The corresponding user isn't even listed. This happens, although the folders

- are residing on an NTFS drive

- are being created by Windows itself during the first logon of each user (so Windows should know which user it creates the folder for and hence be able to set the access rights properly)

In addition, it would of course be nice to know how to get rid of the "ghost" user IDs during a reinstall, but for now I would be happy if anybody could help me with my current problem.

Every user being able to manupulate every other user's files is of course inacceptable. I wonder why Microsoft enables custom placements of these folders without setting the access rights accordingly. For any serious application this is unusable - but then again, you'd probably use a domain and a server hosted profile anyway for a "serious" application.

One thing I could imagine to be the reason is that access rights are inherited from the parent folder, i.e. the profiles directory. So if I move My Documents, there is no folder there to inherit the rights from. Again: Where's the sense in being able to move the folder then? I am not familiar enough with ACLs to verify this hypothesis, but I thought I'd still mention it.

Link to post
Share on other sites

If you move your folders to a different drive, i.e. D:\%USERNAME%\My Documents, they inherit the settings of the drive, [D:], as their parent folder.

The only way to prevent other users from accessing others folders without changing the permissions is to make them all 'Limited Users'.

It's all a bit of a mess really!

Best solution I've found to date is to ensure that the redirected folders are on FAT32 drives/partitions and don't have multiple users

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    No registered users viewing this page.

  • Create New...