How To: Folder Redirection

Here is the Microsoft-recommended production permission model for Folder Redirection in Windows Server 2022 using Active Directory. This setup ensures each user automatically gets their own private folder and prevents users from accessing other users’ data.

This is the standard enterprise configuration used by Microsoft.

1. Create the Root Folder

On your file server create a root folder:

D:\RedirectedFolders

Example final share path:

\\FileServer\RedirectedFolders$

(The $ hides the share from browsing.)

2. Configure Share Permissions

Right-click → Properties → Sharing → Advanced Sharing

Share name:

RedirectedFolders$

Set Share Permissions:

Group	Permission
Authenticated Users	Full Control
Domain Admins	Full Control
SYSTEM	Full Control

💡 Share permissions are intentionally open. Security is enforced with NTFS permissions.

3. Configure NTFS Permissions (Root Folder)

Open Security → Advanced

Disable inheritance and remove existing entries.

Add these:

Principal	Permission	Applies To
SYSTEM	Full Control	This folder, subfolders, files
Domain Admins	Full Control	This folder, subfolders, files
CREATOR OWNER	Full Control	Subfolders and files only
Authenticated Users	Create folders / Append data + List folder	This folder only

Why this works

• Users can create their own folder
• Once created, CREATOR OWNER gives them full control
• Users cannot see inside other user folders

This is the key to secure folder redirection.

4. Configure Folder Redirection GPO

Open Group Policy Management

Edit a GPO:

User Configuration
   Policies
      Windows Settings
         Folder Redirection

Example: Documents

Settings:

Setting: Basic
Target: Create a folder for each user under the root path
Root Path: \\FileServer\RedirectedFolders$

5. Recommended Policy Options

Enable:

✔ Move the contents to the new location
✔ Grant the user exclusive rights to Documents

Disable:

❌ Policy removal → Redirect to local

Recommended:

Policy removal → Leave folder in new location

6. Resulting Folder Structure

After users log in:

\\FileServer\RedirectedFolders$
   ├── jsmith
   │     └── Documents
   ├── adavis
   │     └── Documents
   └── rjohnson
         └── Documents

Each user can only access their own folder.

7. Verify Permissions After Creation

Inside a user folder you should see:

Principal	Permission
Username	Full Control
SYSTEM	Full Control
Domain Admins	Full Control

Other users should not appear.

8. Test from a Client

On a domain PC:

gpupdate /force

Log off / log back in.

Check:

Documents → Properties → Location

Example:

\\FileServer\RedirectedFolders$\jsmith\Documents

9. Enterprise Best Practices

Most organizations redirect:

• Desktop
• Documents
• Favorites
• Pictures

Avoid redirecting:

• Downloads
• AppData

(They cause performance issues.)