none
Document / Desktop Redirection - updating GPO

    Question

  • I have about 300 workstations in my environment -mostly Windows 7 SP1 and some Windows 10.  For these workstations, I have document redirection configured for their Desktop and Documents folders.  This is working fine.

    Because of the age of the server where the redirected documents lives, I would like to move the shares to a different server and update the GPO.

    I attempted this last night - I robocopied all of the files from the users share to my new server, unshared them from the old server.  Updated my GPO to go from \\oldserver\users to \\newserver\users.  Replicated my DC to make sure that all DCs had the updated GPO.

    I then rebooted some machines and the change didn't seem to happen.  I dug into the registry - under HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer -- both ShellFolders and UserShellFolders -- the paths were still pointing to \\oldserver\users.

    I then did a gpupdate /force, rebooted again and still had the same problem.

    What am I missing here?  Does the document redirection tatoo the registry?

    Thanks in advance

    sb

    Wednesday, February 10, 2016 4:52 PM

Answers

  • > already exist.  I think the access is denied is coming from the fact
    > that it is trying to create it, but it is already there.
     
    No, it is denied due to the fact that ACLs prevent "something". Did you
    uncheck "grant user exclusive access"? If not, FR AFAIK tries to make
    the user the owner of the target folder, and it tries to remove all
    other ACL entries. Does the share itself allow "Full Access" for the
    user, or is it "Write" only? If it is not Full Access, FR cannot change
    ACLs.
     
    • Marked as answer by stephenmbell Friday, February 26, 2016 7:46 PM
    Friday, February 26, 2016 10:37 AM

All replies


  • Hi SB,

    Did all of computers not update new GPO?

    Would you run the command line GPresult /h <file path>  on these not update new GPO computers and post it?

    Here is a similar thread for your reference.

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/dcf5fd74-6e89-41e4-8e41-c161b7cbb695/steps-to-move-folder-redirection-for-my-documents-to-different-file-server?forum=winserverGP

    Thank you,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Thursday, February 11, 2016 8:06 AM
    Moderator
  • I don't have any machines still configured this way.  Once it didn't work after a few gpupdate commands issued - i rolled the GPO back.

    Interesting accepted answer in the link that you provided - 

    a) I did not create a new GPO - I simply modified the existing one.  I could try creating a new one without too much trouble.

    b) I have already copied over all of the data.  I am not necessarily looking for the data to be copied the next time the users logs in.  I would rather do it all at once and be able to de-commission the server.

    I will try with a newly created GPO and post back results.  If I see the same thing, I will run the gpresult on the client machine.

    Thanks for the reply

    Thursday, February 11, 2016 4:56 PM
  • Hi SB,

    Are there any updates?

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, February 25, 2016 1:49 AM
    Moderator
  • I have attempted two times and failed both attempts.  

    When I ran the GPResult I see the following:

    Folder Redirection failed due to the error listed below.

    Cannot complete this function.

    Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between 2/16/2016 9:10:49 PM and 2/16/2016 9:10:50 PM.

    I look in the event viewer and I see:

    Failed to apply policy and redirect folder "Desktop" to "\\server\users$\thomas.roberts\Desktop".
     Redirection options=0x1210.
     The following error occurred: "Can not create folder "\\server\users$\thomas.roberts\Desktop"".
     Error details: "Access is denied.
    ".

    In my new GPO I have it set to: Basic - Redirect everyone's folder to the same location.  Target location = Create a folder for each user under the root path.  In addition, I have the checkbox UNCHECKED for Move the contents of the Desktop to the new location.

    I found a few things - number 1, from: 

    http://blogs.technet.com/b/netro/archive/2013/12/23/how-to-change-the-file-server-share-for-folder-redirection-in-a-way-that-the-w7-client-can-still-access-the-data-on-the-users-share-and-not-to-have-the-complete-data-synced-over-the-wire.aspx

    My shell32.dll needed to be updated.  I went ahead and took care of this.  Still had the same result.

    I am wondering if I need to change the target to "Redirect to the following location" and use the %username% variable?

    Ideally I would like to do this without copying the data down to the client and back up.  I am planning on testing in a lab environment today / tomorrow.  Will post updates.

    Thanks,

    sb

    Thursday, February 25, 2016 7:35 PM
  • Hi SB,

    Failed to apply policy and redirect folder "Desktop" to "\\server\users$\thomas.roberts\Desktop".
     Redirection options=0x1210.
     The following error occurred: "Can not create folder "\\server\users$\thomas.roberts\Desktop"".
     Error details: "Access is denied".

    >>>The folder need be shared with users and these users could access the folder from other machine.

    I am wondering if I need to change the target to "Redirect to the following location" and use the %username% variable?

    >>>Yes, you need use the %username% variable.

    Here is an article below may be helpful to you.

    Redirecting Folders

    https://technet.microsoft.com/en-us/library/cc977970.aspx

    In additional. Based on my experience, if you want to redirect folders from one location to another, you need Redirect to the local userprofile location first. And then you should redirect the folder to the location you want.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, February 26, 2016 1:56 AM
    Moderator
  • Hi Jay,

    The folder is already shared.  In this situation, all of the folders already exist.  I think the access is denied is coming from the fact that it is trying to create it, but it is already there.  Some of my users have 20+GB in their my docs / desktop directories - would it be reasonable to have a machine copy 20+ GB from a share locally during login?  And then again to push back to the new server?

    http://blogs.technet.com/b/netro/archive/2013/12/23/how-to-change-the-file-server-share-for-folder-redirection-in-a-way-that-the-w7-client-can-still-access-the-data-on-the-users-share-and-not-to-have-the-complete-data-synced-over-the-wire.aspx

    I am hoping this is the solution and I am just missing some of the relevant hotfixes. If not, I may have to go the route of re-creating the entire server rather than using an existing one like I had originally planned.  

    Thanks again.  This is proving to be more of a challenge than I originally anticipated.

    sb

    Friday, February 26, 2016 2:08 AM
  • > already exist.  I think the access is denied is coming from the fact
    > that it is trying to create it, but it is already there.
     
    No, it is denied due to the fact that ACLs prevent "something". Did you
    uncheck "grant user exclusive access"? If not, FR AFAIK tries to make
    the user the owner of the target folder, and it tries to remove all
    other ACL entries. Does the share itself allow "Full Access" for the
    user, or is it "Write" only? If it is not Full Access, FR cannot change
    ACLs.
     
    • Marked as answer by stephenmbell Friday, February 26, 2016 7:46 PM
    Friday, February 26, 2016 10:37 AM
  • > already exist.  I think the access is denied is coming from the fact
    > that it is trying to create it, but it is already there.
     
    No, it is denied due to the fact that ACLs prevent "something". Did you
    uncheck "grant user exclusive access"? If not, FR AFAIK tries to make
    the user the owner of the target folder, and it tries to remove all
    other ACL entries. Does the share itself allow "Full Access" for the
    user, or is it "Write" only? If it is not Full Access, FR cannot change
    ACLs.
     

    This seemed to do the trick!!  I tested this on my lab machine today for a handful of users (some new and some that have left the company).  I will move this into production next week.

    Thanks again for all the help!

    sb

    Friday, February 26, 2016 7:45 PM