When creating home folders, Active Roles operates in the security context of the service account under which the Administration Service is running. This means that the service account must have sufficient rights to create home folders. Normally, the service account has administrative rights on an entire file server, which enables Active Roles to create home folders in any folder on any network file share that exists on that server. To restrict Active Roles to create home folders only on a specific list of network file shares and folders, use the Home Folder Location Restriction policy.
For a detailed description of this policy, see Home Folder Location Restriction in the Active Roles Feature Guide.
To configure the Home Folder Location Restriction policy
-
In the Console tree, expand Configuration > Policies > Administration, and select Builtin under Administration.
-
In the Details pane, double-click Built-in Policy - Home Folder Location Restriction.
-
On the Policies tab, double-click the list item under Policy Description.
-
On the Allowed Locations tab, view or modify the list of folders on the network file shares where creation of home folders is allowed.
When adding a folder to the list, specify the UNC name of the folder. If you specify the name in the form \\<Server>\<Share>, home folders can be created in any folder on the network file share specified. If you specify the name in the form \\<Server>\<Share>\<PathtoFolder>, home folders can be created in any sub-folder of the folder.
In this scenario, you configure a policy to create home folders when creating user accounts. The policy assigns home folders to newly created accounts and grants the users change access to their home folders.
To implement this scenario, you must perform the following actions:
-
Verify that the network file share on which you want the policy to create home folders is listed in the Home Folder Location Restriction policy.
-
Create and configure a Policy Object that defines the appropriate policy.
-
Apply the Policy Object to a domain, OU, or Managed Unit.
As a result, when creating a user account in the container you selected in Step 3, Active Roles creates the user home folder and assigns that folder to the user account.
The following sub-sections elaborate on the steps to implement this scenario.
The network file share to hold home folders must be listed in the Home Folder Location Restriction policy. Use the Configuring the Home Folder Location Restriction policy instructions to verify that the policy allows creation of home folders on the network file share.
You can create and configure the Policy Object you need by using the New Provisioning Policy Object Wizard.
To configure the policy, click Home Folder AutoProvisioning on the Policy to Configure page of the wizard. Then, click Next.
On the Home Folder Management page, set up the following options:
-
In the Connect box, select the drive letter to assign to the home folder (for example, Z:).
-
In the To box, enter the path in the following format:
\\server\share\%username%
In the above format, \\server\share is a valid UNC path to a network file share. For example, if you have a network file share set up on the comp server, with the share name set to home, specify the following path:
\\comp\home\%username%.
-
Select the Apply this home folder setting when user account is created check box.
As a result, the Home Folder Management page should look like the following figure.
Figure 31: Policy Object: Home folder management
Click Next and follow the steps in the wizard to create the Policy Object.
