Product Line:  VERDE

ISSUE:

VERDE offers built-in document redirection functionality in the virtual desktop (guest), by default the Windows "Document" folder will automatically be redirected to the virtual desktop D: drive. Some customers may need to redirect the Windows “Documents” to a shared network drive. The information below gives Windows administrators information on how to proceed.

SOLUTION:

1. Set the NTFS permissions

Create the folder in the desired location (i.e. X:\usershare)

From the new folder properties, disable inheritance of permissions from the parent and remove all inherited permissions by clicking the appropriate button.

One entry will already be in the DACL: Local Administrators.

1. Alter Local Administrators: Full Control: This folder, subfolders and files.
2. Alter or Add SYSTEM: Full Control: This folder, subfolder and files.
3. Alter or Add CREATOR OWNER: Full Control: This folder, subfolders and files.
4. Add Authenticated Users: List folder / read data, Create folders / append data: This folder only.
5. Add Domain Admins: Full Control: This folder, subfolders and files.
6. Click OK.

These permissions enable users to create their redirected folder in the root folder, but restrict the ability to browse the contents of other folders. Best practice dictates that you should allow the redirected folder locations to create themselves as users log on.

2. Create the share and add share permissions

Share the root folder created earlier as \\SERVER\usershare (or if you want to hide it, \\SERVER\usershare$\)

Adjust the share permissions as follows:

1. Remove Everyone.
2. Grant Authenticated Users Full Control.
3. Grant Domain Admins Full Control (Not necessary but useful for completeness).

3. Configure the Group Policy Object (GPO)

1. Open the Group Policy Manager.
2. Create a new GPO or edit an existing one.
3. Open User Configuration > Policies > Windows Settings > Folder Redirection.
4. Right-click Documents and click Properties.
5. Choose Basic - Redirect everyone's folder to the same location.
6. Under Target folder location choose Create a folder for each user under the root path.
7. Set the Root Path: to  \\SERVER\usershare. 
8. As the path is entered, an example location is displayed to show how the folders will be created as users log on.
9. On the Settings tab, uncheck Grant the user exclusive rights to Documents.
10. Under Policy Removal, select your preferred option depending on your requirements.
11. Link the GPO at the appropriate OU.

Once the user logs in (for example:juser) then the following folders (in bold) will be created on the shared drive c:\usershare\juser\Documents and “Documents” that used to redirect to \\host\Shares\Documents (default) will be redirected to \\SERVER\usershare\<user>\Documents.