Folder Redirection GPO Issue (Server 08)

[kamikazekyle]

So, I'm pretty stumped by this one.

At home, I have a small Server 2008R2 domain with integrated DNS, DHCP, and file services. All client machines are running Windows 7 Ultimate or Pro, or my odd OS X MacBook Pro that's also AD integrated (GPO doesn't apply to this laptop). There's nothing really special on the domain -- a simple logon script GPO that maps the NAS drive and that's it. No special OUs, configurations, or anything of that nature.

Recently, I set up a new GPO in order to have users home folders automatically redirect to their home directories on the file server. That way, they can keep easy and transparent access to their files on the desktop or on the laptops.

In a "it works fine on my machine" bit of spiel, the GPO applied, established offline files properly, and migrated existing folders just fine using my account and my workstation (WKS1). I noticed later on, however, that it wasn't doing doodly for my other workstation (WKS2) or a laptop I tested it on (LAP2).

Figuring it might be something with the profiles, I cleared out all local profiles (and I don't use roaming profiles), and tried again. The GPO failed to force redirection on WKS2 or LAP2. I created a new user account in AD (testuser), and logged into WKS1 and WKS2. Nothing happened on WKS2 with the redirection GPO, but on WKS1 the folders were automatically created, redirected, and applied with no issues at all.

GPRESULT indicates that the policy is being read and applied on WKS2 and LAP2. The share and folders on the server were created according to Microsoft's recommended security and settings. All users are in the default Users OU, and only my account is in anything other than the default user groups. Computers are all in the default Computers OU and are identical in domain configuration as far as I can tell. There are no other GPO's applied aside from the one-line login script. Both my admin account and a normal test user account failed to apply redirection on WKS2 and LAP2, but both work fine on WKS1. WKS2 and LAP2 show a sync center icon like they should, but it isn't syncing any offline files.

Anyone have any ideas? As all the AD objects look fine and GPRESULT doesn't show anything whacky, I can't figure out what's up. I even tried Synchronous updates on GPOs so the boxes wait for the network and apply the GPO before logging in, but that didn't make a difference.

Cliffs:
-Fairly default Server 2008R2 AD domain.
-Folder Redirection works fine on WKS1, but not on WKS2 or LAP2 even though it shows as applied in GPRESULT. Admin/non-admin account doesn't matter.
-Computer domain configs are all identical.
-Logon script GPO works fine on all systems.

 

[waffleironhead]

I have had more success using the folder redirection gpo instead of the conventional logon script method.

User Configuration\Policies\Windows Settings\Folder Redirection\UserProfileFolderName

 

[kamikazekyle]

That's actually what I"m doing. The logon script is just a net /use command to map a NAS drive. The redirection is done via standard GPO according to Microsoft's guide.

I probably could try a registry hack in the logon script to get it to work, though that'd be a last ditch effort.

 

[Lifted]

Is the redirection w/ offline files being done to file server or the NAS? I've seen NAS boxes have issues with Vista/7 offline files as they didn't properly (or by default) support this.

Did you let Windows create the home directories? If not, do users have read access to the root of the share (i.e. \home or \users) and do they have ownership of and full access to their home directories?

Are you applying the policy to users or computers (with loopback processing)?

Is your user account in the same OU as the other accounts?

Where is the policy being applied, domain or OU?

Did you leave the policy set to the default of applied to authenticated users, or did you modify it in any way?

 

[kamikazekyle]

-Redirection/offline files are being done with the Server 2008 box via a dedicated CIFS share. All home directories are stored there. Offline files work fine on the one system where the redirection works.

-I've done both: prefab directories and letting Windows create the directories. Users have permissions to the parent home directory folder and their own folders as per Microsoft guidelines. In both instances, on the system that works OK, the prefab folders and the Windows-created folders work perfectly.

-GPO is being applied to users; I haven't configured any loopback processing. Related note, all computer accounts are in the default computer OU.

-All user accounts are in the same OU, the default Users OU created by AD setup. Redirection on my admin account and normal users accounts work fine on WKS1. Redirection doesn't work with any account on WKS2 or the laptop.

-Policy is being applied at the domain level.

-Policy is set to apply to Authenticated Users -- basically totally default.

For the most part, the domain is out-of-the-box default.

 

[GeekDrew]

How is the redirection path specified in the GPO? Via drive mapping or UNC path?

Also, while it doesn't really seem to matter in this specific case, the default "Users" and "Computers" containers in a default ADDS install are not OU's, they're CN's (and therefore cannot have group policies directly associated with them).

 

[Saithegeek]

Check for working DNS on wk2 and laptop.

 

[kamikazekyle]

Ok, now that I'm back from traveling for a week...

Redirection path in the GPO is specified via a UNC path, no mapping. I do have the user accounts map their base home directory to a drive, but the GPO uses plain UNC.

And thanks for the container/OU correction, GeekDrew. Given my Solaris LDAP experience I should have made that connection when I noticed that Users wasn't showing up in gpedit. Guess since we had Computers and Users as OUs in our LDAP structure, I just unconsciously made the connection. I should probably buy a book about AD one of these days in the off chance I find myself in Windows administration land instead of Unix or enterprise storage

Saithegeek, DNS seems to be working OK on all the boxes. I checked various lookups and compared DNS settings between working and non-working systems, and everything matched. I checked the event logs to see if anything DNS, AD, or GPO related was being tossed back, but no luck.

As another aside, my Bootcamp partition on my MacBook Pro works fine with redirection. It's configured identically to LAP2 and was added to the domain in exactly the same way. I haven't had the chance to check WKS2 or LAP2 since I returned.

I might try clearing out my DNS records for testing and general maintenance. Back when I was first setting up the domain, I did have to rename the domain due to an external DNS conflict and change the DNS records. That caused some quirkiness with DNS until I ironed everything out, but it's been working smooth for months. I could also try removing the systems from the domain and readding as a "why not?" test. I've had a few bothersome systems in the past get fixed like that when I was doing workstation admin.

Anywho, since my girlfriend found out that the school system she's going to be teaching at uses OS X exclusively and will be provided will a MacBook for work and home use, the main drive behind this redirection is mostly moot.