After you have successfully deployed a Folder Redirection Group Policy object (GPO) in your site, you may want to stop Folder Redirection for one or more users. However, before you try to stop Folder Redirection, you must first enable the Redirect the folder back to the local userprofile location when policy is removed Group Policy setting.
Important After you modify a GPO and enable the Redirect the folder back to the local userprofile location when policy is removed Group Policy setting, all users who you want to stop Folder Redirection must log off and then log on again. This is to make sure that the updated GPO settings are applied before you stop Folder Redirection.
To stop Folder Redirection, follow these steps:
Enable the Redirect the folder back to the local userprofile location when policy is removed Group Policy setting. To do this, follow these steps:
Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
In the Active Directory Users and Computers console tree, locate the site, domain, or organizational unit that contains the users who you want to apply the updated GPO to.
Right-click the object, such as the organizational unit, and then click Properties.
Click the Group Policy tab.
Click the GPO that contains your Folder Redirection policy setting in the Group Policy Object Links list, and then click Edit.
In the Group Policy console tree, expand User Configuration, expand Windows Settings, and then expand Folder Redirection.
Right-click Application Data, and then click Properties.
Click the Settings tab.
In the Policy Removal box, click to select the Redirect the folder back to the local userprofile location when policy is removed policy setting, and then click OK.
Repeat steps g through i for the Desktop, My Documents, and Start Menu objects.
Close the Group Policy dialog box, and then close the Properties dialog box for the object that you selected in step c.
Important All users who are affected by your GPO modification must log off and back on to any computers where they have logged on before the changes are applied. You must apply these changes to the user's computer before you go to the next step.
When all users have logged off and then logged back on, and the updated GPO for Folder Redirection has been applied, use one of the following methods to stop Folder Redirection:
Method 1: Remove the user from the organizational unit where the folder redirection GPO is applied to a different organizational unit that does not redirect folders. To do this, follow these steps:
Important Move the user accounts, do not delete the GPO.
In the console tree of Active Directory Users and Computers, right-click DomainName, and then click Find.
Click Users, Contacts, and Groups in the Find box.
Type the name of the user account, and then click Find Now.
In the Search results box, right-click the user account, and then click Move.
In the Container to move object to box, locate a security group that does not have Folder Redirection policy enabled, and then click OK.
Method 2: Modify the security properties of the GPO to deny the user or group Read permissions and Apply Group Policy permissions to that GPO. This enables other GPO's to be applied to the user, while making sure that the folder redirection policy setting is not applied. To do this, follow these steps:
Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
In the Active Directory Users and Computers console tree, right-click the organizational unit object or domain object that has the Group Policy Object whose security properties that you want to change, and then click Properties.
In the Properties dialog box for the object, click the Group Policy tab, select the GPO that you want to change from the list, and then click Properties.
In the GPO Properties dialog box, click the Security tab, and then change the permissions so that only the required users have the Read and Apply Group Policy permissions. For users where the GPO does not apply, make sure that you click to select the Deny check box for the Read and Apply Group Policy permissions. Click OK two times.
Note Make sure that Administrators have Read and Write permissions for the GPO.
After you use one of these methods, Folder Redirection will be stopped the next time that the user processes this GPO. By default, the object is cached on the user's computer and will not be updated unless another change is detected. To force an update, you must follow these additional steps:
Create or modify a GPO that applies to the computers on which users who are affected by folder redirection policies log on.
Edit the GPO.
Under Computer Configuration, expand Administrative Templates.
Under Administrative Templates, expand System.
Under System, select Group Policy.
Double-click the Folder Redirection policy processing setting
Select the Enabled option, and then click to select the second check box. (Process even if the Group Policy objects have not changed.)
Exit the Group Policy Object Editor. Make sure that this new GPO applies to computer accounts for which users are using folder redirection.
After you apply this policy change, the computers can detect the updated folder redirection policy and will honor the changes that have been made to stop using folder redirection.
Note After a Folder Redirection GPO is applied to a user profile, those Group Policy settings are retained locally on the user's computer. Group Policy settings are changed only when a new or modified GPO is applied to the user or computer.
Please refer:-
http://support.microsoft.com/kb/888203
Important After you modify a GPO and enable the Redirect the folder back to the local userprofile location when policy is removed Group Policy setting, all users who you want to stop Folder Redirection must log off and then log on again. This is to make sure that the updated GPO settings are applied before you stop Folder Redirection.
To stop Folder Redirection, follow these steps:
Enable the Redirect the folder back to the local userprofile location when policy is removed Group Policy setting. To do this, follow these steps:
Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
In the Active Directory Users and Computers console tree, locate the site, domain, or organizational unit that contains the users who you want to apply the updated GPO to.
Right-click the object, such as the organizational unit, and then click Properties.
Click the Group Policy tab.
Click the GPO that contains your Folder Redirection policy setting in the Group Policy Object Links list, and then click Edit.
In the Group Policy console tree, expand User Configuration, expand Windows Settings, and then expand Folder Redirection.
Right-click Application Data, and then click Properties.
Click the Settings tab.
In the Policy Removal box, click to select the Redirect the folder back to the local userprofile location when policy is removed policy setting, and then click OK.
Repeat steps g through i for the Desktop, My Documents, and Start Menu objects.
Close the Group Policy dialog box, and then close the Properties dialog box for the object that you selected in step c.
Important All users who are affected by your GPO modification must log off and back on to any computers where they have logged on before the changes are applied. You must apply these changes to the user's computer before you go to the next step.
When all users have logged off and then logged back on, and the updated GPO for Folder Redirection has been applied, use one of the following methods to stop Folder Redirection:
Method 1: Remove the user from the organizational unit where the folder redirection GPO is applied to a different organizational unit that does not redirect folders. To do this, follow these steps:
Important Move the user accounts, do not delete the GPO.
In the console tree of Active Directory Users and Computers, right-click DomainName, and then click Find.
Click Users, Contacts, and Groups in the Find box.
Type the name of the user account, and then click Find Now.
In the Search results box, right-click the user account, and then click Move.
In the Container to move object to box, locate a security group that does not have Folder Redirection policy enabled, and then click OK.
Method 2: Modify the security properties of the GPO to deny the user or group Read permissions and Apply Group Policy permissions to that GPO. This enables other GPO's to be applied to the user, while making sure that the folder redirection policy setting is not applied. To do this, follow these steps:
Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
In the Active Directory Users and Computers console tree, right-click the organizational unit object or domain object that has the Group Policy Object whose security properties that you want to change, and then click Properties.
In the Properties dialog box for the object, click the Group Policy tab, select the GPO that you want to change from the list, and then click Properties.
In the GPO Properties dialog box, click the Security tab, and then change the permissions so that only the required users have the Read and Apply Group Policy permissions. For users where the GPO does not apply, make sure that you click to select the Deny check box for the Read and Apply Group Policy permissions. Click OK two times.
Note Make sure that Administrators have Read and Write permissions for the GPO.
After you use one of these methods, Folder Redirection will be stopped the next time that the user processes this GPO. By default, the object is cached on the user's computer and will not be updated unless another change is detected. To force an update, you must follow these additional steps:
Create or modify a GPO that applies to the computers on which users who are affected by folder redirection policies log on.
Edit the GPO.
Under Computer Configuration, expand Administrative Templates.
Under Administrative Templates, expand System.
Under System, select Group Policy.
Double-click the Folder Redirection policy processing setting
Select the Enabled option, and then click to select the second check box. (Process even if the Group Policy objects have not changed.)
Exit the Group Policy Object Editor. Make sure that this new GPO applies to computer accounts for which users are using folder redirection.
After you apply this policy change, the computers can detect the updated folder redirection policy and will honor the changes that have been made to stop using folder redirection.
Note After a Folder Redirection GPO is applied to a user profile, those Group Policy settings are retained locally on the user's computer. Group Policy settings are changed only when a new or modified GPO is applied to the user or computer.
Please refer:-
http://support.microsoft.com/kb/888203
0 comments:
Post a Comment