Home / server / Questions / 179520
In Process
HannesFostie
Asked: 2010-09-10 05:06:26 +0800 CST

Opening My Documents prompts for credentials in redirected environment

  • 772

We have a class infrastructure with classes consisting of "user" pc's and a single "teacher" pc. The fileserver has a folder for the teacher's "my documents", in which there are folders for each of the student users. Both types of accounts have their "my documents" redirected to these folders.

We use this nested structure so that the teacher has access to their documents in an easy way, allowing him for instance to put new shortcuts on their desktop or collect files.

The problem is that (only recently, apparently) whenever a user tries to insert files from My Documents into a powerpoint for instance it will prompt for credentials to the server. You can press cancel and re-enter the folder and it will work fine. Restart powerpoint (or whatever Office application) and you get prompted again. Apparently it's the same for their desktop, which is also redirected. Browsing to My Documents in explorer should work fine.

It's a bit vague, but the teachers aren't the best in supplying feedback. I tried to explain as best I could.

EDIT: removed link to the other issue as it was unrelated and now solved

Thanks a bunch

folder-redirection

2 Answers

  1. Even though this post is old, I came across the same thing today with Windows 7 clients accessing redirected folders on a Windows Server 2012R2 with Excel 2013. So the problem is still there.

    Problem Reproduction

    Since the original description was a bit vague here is the exact way to reproduce the problem:

    • "my documents" (or probably any other library) is redirected to a server share
    • "my documents" contains an MS Excel (probably any MS Office) document.
    • create a link to that document in another redirected library, for example on the "desktop".
    • trying to open the document by double-clicking the link will prompt for the user's credentials, while a double-click directly on the file in "my documents" works fine.

    It is interesting to note that this only happens when creating the link from within a redirected library like "my documents". If you access the same shared folder directly by its UNC path and create the link from there, everything works fine as well.

    The Solution that worked for me

    It is a permission problem on the redirected folders share, even though it looks fine at first and is perfectly accessible for other programs than MS Office.

    The shares that host redirected folders need exactly these permissions, as documented by Microsoft (as early as Windows Server 2003):

    on the share:

    EVERYONE:F (or at least F for the users that access the share)

    in the file system:

    CREATOR OWNER - Full Control (Apply onto: Subfolders and Files Only)
System - Full Control (Apply onto: This Folder, Subfolders and Files)
Domain Admins - Full Control (Apply onto: This Folder, Subfolders and Files)
Everyone - List Folder/Read Data (Apply onto: This Folder Only)
Everyone - Read Attributes (Apply onto: This Folder Only)
Everyone - Traverse Folder/Execute File (Apply onto: This Folder Only)
Everyone - Create Folder/Append Data (Apply onto: This Folder Only)

    I was missing the last 2 permission entries, thinking I could get away with just read access. Adding those 2 entries, which seem totally unrelated, solved the problem.

    • 2

  2. To clarify:

    C:\users\Teacher\Documents is shared, and contains

    user1\
user2\
.
.
usern\

    Recall that Windows authentication is based on "most restrictive" so if you've a Deny in the mix it will trump any Allow for the same resource to the same entity. User folders also typically have very restrictive access by default.

    I would recommend that you redirect to a network share outside of the \users\ folder (or \Documents and Settings\ for pre-Vista/Server 2008 environments). Instead, create a new folder off the root or on a file server if you've one available, share that, and give the teacher Read access. Each user folder under that can then inherit that Read, and be assigned Full Control to the person it's assigned to. That SHOULD allow a single sign-in when Windows starts and re-establishes the persistent mapped share, rather than when each app is started and hooks the My Documents redirect.

    • 0