Folder Redirection: Specifying a target share

Now that the User Files Folders have been covered, it's time to get fancy and start discussing Folder Redirection. In short, Folder Redirection is a feature which redirects the locally stored User Files Folders to a network share. I touched on Folder Redirection in a previous blog article titled Introducing the User Files Folders!.

I have no plans to give you a complete education on Folder Redirection. Rather, my intent is to highlight issues that I have encountered in order to save you gobs of time configuring your environment. If you are unfamiliar with Folder Redirection you should read the Microsoft primer on Folder Redirection and Roaming Profiles. It has the most detail Microsoft has ever provided on the topic - it turned out to be my bible. For purposes of this article, you will want to pay close attention to the section titled Basic Redirection and Advanced Redirection. For those of you without a large network who wish to configure workstations individually, you need to know about Manual Folder Redirection.

Now that you have read the articles mentioned above, we need to talk about specifying a target network share for your redirected folders. Here is the most important bit of this entire article - you can only provide a UNC path when specifying a target. This may not sound like a big deal to those managing a small environment, but it was devastating to us.

As a large, distributed organization we have almost 50 servers hosting user-specific shares. Naturally, we expect to redirect the User Files Folders to a location within a user's personal share space. In the XP days we simply mapped the H: drive to the user's share wherever it might be and then simply redirected the 'My Documents' folder to H:\. Simple.

You won't see any mention in the lengthy Microsoft articles I linked to, but the fact is that this simple implementation is no longer possible in Vista. You can only specify a drive letter as a target if the drive is a local device. If it is a network device, a UNC path must be used. The explanation from Microsoft is that Folder Redirection occurs much earlier in the logon process - before any drive mappings are established. I suspect this is because Vista can now redirect the Desktop and Start Menu so it must find its way back to the network locations that store that data as early as possible.

Remember I mentioned 50 servers for user shares? That translates into 50 UNC paths! Microsoft expects me to abandon Basic Redirection and happily sign on to Advanced Redirection. The way Advanced Redirection works is that you list all the possible UNC targets and associate a security group with each one. This is, of course, assuming I have already grouped my thousands of users into 50 individual groups - if not, it's time to get to work.
Not crazy enough for you yet? Try this next bit of math... In the XP days I basically had one folder to redirect, the 'My Documents' folder. Vista now has 11 User Files Folders - plus 2 additional folders in the user's profile - which must be redirected individually. There is absolutely no way to redirect a single parent folder like you did in XP. We now have 50 X 13 (650!) folder redirection UNC targets that we must specify. Can you say 'nightmare'? Can you imagine the maintenance headache if you ever choose to change one of those UNC paths in the future?

I decided to attack the problem from a different angle. Decide for yourself if it is better, but so far I am happy with the results...

If you read Microsoft's primer you might have overlooked the small note that they inserted which says 'Folder redirection only supports %USERNAME%, %USERPROFILE%, %HOMESHARE%, and %HOMEPATH% environment variables.'. This note is accurate - and key to my solution! It turns out that %HomeShare% is a valid UNC path for the Folder Redirection GPO! If your user's H: drive isn't mapped to an individual user share, then %HomeShare%%HomePath% is an equally valid UNC path. By utilizing these environment variables, it is possible to revert back to Basic Redirection and have only one UNC target per folder - 13 UNC targets definitions in all. -- phew.

What? You say those variables don't return any values? I now need to show you how to populate them with valid UNC paths. For those of you who do get UNC paths out of those variables, this concludes my first article on Folder Redirection. Much more nastiness to come - so check back often!

Alright you nul variable bums, now that we have gotten rid of those lucky UNC laden admins, let's finish the rest of this ugly tale.


The %HomeShare% and %HomePath% variables pick up their values from each user's profile properties in AD (see pic). The Home Folder path is split into those two variables. The server and share specified in the path make up the UNC path stored in %HomeShare% and remaining folders in the path are put into %HomePath%. The choice to use a Local Path or Connect to a specific drive letter is yours and doesn't affect Folder Redirection (hence the reason for this article :-)

Now I know what some of you are thinking "But Gord, we abandoned that setting years ago in favour of more modern ways of mapping - like GPO logon scripts." Trust me, I did to. But it is necessary to go back if you want to save yourselves loads of work. I even had Microsoft support argue with me on this one until he realized what he was asking for. In fact, you will also notice from the attached screen cap that I have also reverted back to launching the logon script from the AD profile rather than from GPO. This is another Vista necessity that I will cover in a future article.

Now, before you start thinking that modifying the path for thousands of user accounts leaves you no further ahead than using the Advanced Redirection option, I need to remind you about LDAP queries. I won't teach you about LDAP queries, but a short reminder is in order. DO NOT modify all your user accounts individually/manually. Active Directory Users and Computers (ADUC) allows you to perform LDAP queries/searches which enable you to target the objects you need so that you can make changes en masse. You can filter users on almost any property you wish such as group or OU membership. When you get a resultant list of users, you can simply highlight all of the objects and make one change.

Now, you may be worried that this won't be possible for you since each user's path must include the user's name. ADUC also happens to behave well in this regard. The path I have specified in my example '\\Server\Share\GMartin' is not the path I had provided. Instead I had provided the path '\\Server\Share\%Username%. ADUC automatically substituted the appropriate username for each user object (thank goodness it didn't put my name in all the paths).
LDAP is also the feature you will rely on to manage these paths in the future when changes are necessary. In the future you can do a search for all users who use a specific share and then change them again en masse - so learn LDAP!

That is all. Have I failed to anticipate one of your questions? Drop me a message and I'll do my best to improve it.