Active Roles 7.2 - Administration Guide

Configuring the Home Folder Location Restriction policy

When creating home folders, Active Roles operates in the security context of the service account under which the Administration Service is running, so the service account must have sufficient rights to create home folders. Normally, the service account has administrative rights on an entire file server, which enables Active Roles to create home folders in any folder on any network file share that exists on that server. The Home Folder Location Restriction is used to restrict to a certain list the network file shares and folders in which Active Roles is authorized to create home folders.

The Home Folder Location Restriction policy determines the folders on the network file shares in which Active Roles is allowed to create home folders, and prevents Active Roles from creating home folders in other locations. The restrictions imposed by this policy do not apply if the home folder creation operation is performed by an Active Roles Admin role holder (normally, these are the users that have membership in the Administrators local group on the computer running the Active Roles Administration Service). Thus, when an Active Roles Admin role holder creates a user account, and a certain policy is in effect to facilitate home folder provisioning, the home folder is created regardless of the Home Folder Location Restriction policy settings.

By default, no network file shares and folders are listed in the policy. This means that Active Roles cannot create a home folder unless the user management operation that involves creation of the home folder is performed by the Active Roles Admin role holder. In order to allow delegated administrators to create home folders, you have to configure the policy so that it lists the folders on the network file shares in which creation of home folders is allowed. You can do this by using the Active Roles console as follows.

To configure the Home Folder Location Restriction policy

1. In the console tree, expand Configuration | Policies | Administration, and select Builtin under Administration.
2. In the details pane, double-click Built-in Policy - Home Folder Location Restriction.
3. On the Policies tab, double-click the list item under Policy Description.
4. On the Allowed Locations tab, view or modify the list of folders on the network file shares where creation of home folders is allowed.

When adding a folder to the list, specify the UNC name of the folder. If you specify the name in the form \\<Server>\<Share>, home folders can be created in any folder on the network file share specified. If you specify the name in the form \\<Server>\<Share>\<PathtoFolder>, home folders can be created in any sub-folder of the folder.

Scenario: Creating and assigning home folders

In this scenario, you configure a policy to create home folders when creating user accounts. The policy assigns home folders to newly created accounts and grants the users change access to their home folders.

To implement this scenario, you must perform the following actions:

1. Verify that the network file share on which you want the policy to create home folders is listed in the Home Folder Location Restriction policy.
2. Create and configure a Policy Object that defines the appropriate policy.
3. Apply the Policy Object to a domain, OU, or Managed Unit.

As a result, when creating a user account in the container you selected in Step 3, Active Roles creates the user home folder and assigns that folder to the user account.

The following sub-sections elaborate on the steps to implement this scenario.

Step 1: Verifying the Home Folder Location Restriction policy

Step 1: Verifying the Home Folder Location Restriction policy

The network file share to hold home folders must be listed in the Home Folder Location Restriction policy. Use the Configuring the Home Folder Location Restriction policy instructions to verify that the policy allows creation of home folders on the network file share.

Step 2: Creating and Configuring the Policy Object

Step 2: Creating and Configuring the Policy Object

You can create and configure the Policy Object you need by using the New Provisioning Policy Object wizard. For information about the wizard, see Creating a Policy Object in the Policy Object management tasks section earlier in this chapter.

To configure the policy, click Home Folder AutoProvisioning on the Policy to Configure page of the wizard. Then, click Next.

On the Home Folder Management page, set up the following options:

• In the Connect box, select the drive letter to assign to the home folder (for example, Z:).
• In the To box, type the path in the form \\server\share\%username% where \\server\share is a valid UNC path to a network file share. For example, if you have a network file share set up on the server comp, with the share name set to home, you might specify the following path: \\comp\home\%username%
• Select the Apply this home folder setting when user account is created check box.

As a result, the Home Folder Management page should look as shown in the following figure.

Figure 61: Policy Object:Home folder management

Click Next and follow the steps in the wizard to create the Policy Object.