Tag Archives: icacls

Windows – Users Home Drives Renamed to ‘My Documents’

Posted on by

KB ID 0000783 

Problem

This problem was originally identified by Microsoft here. But none of the fixes recommended by them were really practical in my clients situation.

I did read one promising post that said, if you disable offline file caching by GPO this problem would cease. However this particular client HAD TO have that feature enabled (for Ranger Offline).

Someone else had written a PowerShell script that ran through and changed the permissions on the offending file (see below), but what about new users?

Solution

I’ve got three options either, setup an FSRM screen and set it to remove the offending file, use a group policy preference, or add the following to the users login script (or run as a script with GPO);

[box]%windir%system32icacls.exe %homedrive%Desktop.ini /deny “Domain Admins”:r[/box]

Option 1 – Remove Desktop.ini with Group Policy Preference

1. This is the file in question ‘desktop.ini’, it changes the icon and display-name of the folder (on Windows Vista and newer). You will notice the actual name of the folder does not change (see the example I posted above), which you can see by turning on the filename column in Windows Explorer.

Note: desktop.ini is a system and a hidden file.

2. I’m creating a GPP to remove the desktop.ini file. On a domain controller Start > Administrative Tools > Group Policy Management Console > Navigate to where you want to create your policy, or edit an existing one > Navigate to;

[box]
User Configuration > Preferences > Windows Settings > Files[/box]

Select New > File > Action = Delete > Source Files N:desktop.ini > Tick ‘Suppress errors on individual file actions’ > Common Tab > Tick ‘Run in logged-on-users’s security context (user policy option)’ > Apply > OK.

3. It should now look like this.

Option 2 – Use a File Screen

1. You need to have the ‘file services’ role installed, open the ‘Server and Storage Management’ Snap-in > File Group > Create File Group > Give it a name > Add in desktop.ini > OK.

2. Right click ‘File System Templates’ > Create File Screen Template > Give it a name > Select Active Scanning > Tick desktop.ini > OK.

3. Right click ‘File Screen’ > Create File Screen > Browse to the volume or Folder > Select your file screen template > Create.

Locate and Remove ALL instances of Desktop.ini

Download and run this PowerShell Script to remove all instances of Desktop.ini from a folder and subfolders.

Related Articles, References, Credits, or External Links

Original Article Written 11/03/13

Can’t Delete a File or Folder or Take Ownership

Posted on by

KB ID 0000887 

Problem

I have a portable drive that I carry in my laptop bag that has all the service packs and iso images that I might need. The problem is when I install service packs and updates on clients servers and PC’s, they have a habit of creating folders on my portable drive that are a pain to delete. While tidying up the drive today, it was telling me I did not have the rights to do so. When I tried to take ownership of the folder this happened;

An error occurred while applying security information to
{Foldername}
Failed to enumerate objects in the container. Access is denied.

Solution

1. Open a command window (Note: Ensure you select ‘Run As Administrator‘).

2. Issue the following commands, replace the ‘Path’ to the foldername, with your own.

[box]

takeown /f F:foldername /r /d y
icacls F:foldername /grant administrators:F /T
rmdir F:foldername /S /Q

[/box]

Related Articles, References, Credits, or External Links

NA