Best way to allow administrator to access user folders on Server 2012?

[Thedog]

We setup a new Server 2012 R2 with user-folder redirection. The CEO of the company want to be able to access everyones files ie the "Redirected folder-tree" that contains all user files.

Of course we do not want to change the ownership of all files so what is the best way to achieve this?

 

[TurricanII]

I'd start by removing the tick from 'Grant the user exclusive rights to My Document' on the GPO to catch future folders. And you might have to write a powershell or batch file maybe with icacls.exe to programatically take ownership but grant permission back to the original owner and also grant access to a 'Redirected Folder Admin' group. Then make the CEO a member of that group.

 

[Frick]

Check this article. I have used the scripts with good success

https://www.server-essentials.com/s...-policy-using-grant-the-user-exclusive-rights

 

[Tom_Sand]

if he is a local administrator of the server no permission changes are needed, just drop a shortcut to the root of where you are storing the users folders (even with 'Grant the user exclusive rights to My Document' local administrators continue to have access)

 

[freedomit]

if he is a local administrator of the server no permission changes are needed, just drop a shortcut to the root of where you are storing the users folders (even with 'Grant the user exclusive rights to My Document' local administrators continue to have access)

This is incorrect, admins are locked out of user redirects.

You need to use icalcs to add permissions with psexec which allows you to run it under the system account.

 

[Tom_Sand]

strange, just built a server 2012 R2 server and haven't had to mess around with icalcs to get the admins access into the folders, i will look into how i did it...

 

[Tom_Sand]

maybe because i have domain admins in the share permissions as full control?

 

[freedomit]

Found the link i was looking for...

http://blogs.msmvps.com/bradley/2010/02/28/getting-access-to-the-my-documents-redirected-folders/

 

[YeOldeStonecat]

if he is a local administrator of the server no permission changes are needed, just drop a shortcut to the root of where you are storing the users folders (even with 'Grant the user exclusive rights to My Document' local administrators continue to have access)

By default with proper settings this is not true, the admins (local or domain) do not have access with the default user redirects.