290: Q for server based profiles

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Hi, I am training for the 290 exam with some pools of questions. Some answers that are stated to be true are quite confusing. I hope you don't mind if I ask for it, because I just don't want to learn the answers. I want to understand them.

Here is one question:
Single AD, Servers are 2003 R2, Clients XP
User1 frequently logs on to several different computers.
You need to ensure that the documents and shortcuts User1 stores on his desktop are available on the desktop of each computer he uses.

Which two actions should you perform?

Number one is clear:
From AD modify the properties of the User1 account.

But then:
a) On a file server, create a folder named Profiles and assign the change share permission to Everyone group.
or
b) On a file server, create a folder named Profiles and assign the Full Control share permission to the Everyone group

B) is stated to be true, but I would say A), because the change share permission is the sufficient right, isn't it?

The only reason for Full Control is the ability to change permissions in his profile. Is this usually wanted?

 

That's not exactly correct. Not the NTFS permissions override the share permissions. They override each other to the restrictive one.

I know what you mean. But that "mysteria" only exists, when you create a profile with %username%.

However, I don't see the solution for the problem in the question. Change permissions are sufficient for a userprofile. Also, nothing is said about NTFS permissions. It's all about share permissions. Of course, I can give Full access from the share permission and restrict it through the NTFS permissons. But if no User needs to modify permissions, why should I give it in the share? It is always said not to give more permissions than needed.

 

MS like you to always select full control on shares and then nail the security down at the NTFS folder security level. If you tried to secure everything at the share level then it would not stop someone logging on the server directly and bypassing the share security completely.

If I see any question in a MS exam giving a choice of setting a share to change or full I would go for the full.

 

I too as best practice sometimes give everyone full control on the share permissions and then restrict the access on the NTFS permissions. It makes it easier when troubleshooting permissions.