Group-Policy Not Applied: Access Denied - Folder Redirection Issue

Group Policy Not Applied: Access Denied - Folder Redirection Issue

Folder redirection is a common feature used in Active Directory (AD) environments to redirect special folders, such as Documents and Desktop, to a network share. This can be useful for centralizing user data and making it accessible from any device.

Folder Redirection in Group Policy

Folder redirection can be configured in Group Policy by creating a new Group Policy Object (GPO) and navigating to the User Configuration → Policies → Windows Settings → Folder Redirection node. From here, you can select the folder you want to redirect and specify the target location.

Security Filtering in Group Policy

By default, a new GPO will apply to all authenticated users in the domain. However, it is often necessary to restrict the scope of a GPO to a specific group of users. This can be done using security filtering.

To apply a GPO to a specific group of users, you can add the group to the Security Filtering tab of the GPO. This will allow the GPO to be applied only to members of the group. In this case, the original Authenticated Users group should be removed from the Security Filtering tab to prevent the GPO from being applied to all users in the domain.

Folder Redirection Access Denied Issue

If you have created a new AD group and added users to it, and have then removed the Authenticated Users group from the Security Filtering tab of the GPO, you may encounter an issue where the folder redirection policy is not applied and users receive an Access Denied error when attempting to access the redirected folder.

This issue can occur if the users do not have the necessary permissions to access the network share where the redirected folder is located. To resolve this issue, you will need to ensure that the users have the necessary permissions to access the network share.

Resolving the Access Denied Issue

To resolve the Access Denied issue, you can follow these steps:

1. Verify that the users are members of the correct AD group.
2. Verify that the AD group has been added to the Security Filtering tab of the GPO.
3. Verify that the users have the necessary permissions to access the network share where the redirected folder is located.
4. If necessary, modify the permissions on the network share to grant the users the necessary access.

References

• Folder Redirection CSP
• Group Policy processing order
• How to plan for access control