Converting Roaming Users To Redirected Folders

How to convert roaming users to redirected folders in active directory

Particular users in an active directory environment were have long login times anywhere between 5 - 15 minutes.  While troubleshooting this issue, from the server to the client, switches, cables, and network cards were all replaces with no success.  Upon further investigation the common thing that the users having the logon issues had in common were large profiles.  This AD environment was already in place and setup with roaming user profiles which when get to large cause issues much like long login times and file syncing issues.  To mitigate these issues I determined that a conversion to redirected folders was in order to resolve the issues.

Now depending on your companies data policies, the clients technical level, what is wanted or required by the client and level of trust given to you this can be easy or hard.  The scope of the project I was working on needed to include the transfer of the user data from the roaming profile to the new redirected folder setup.

There are really 2 ways to transfer the data.

1. The administrator could move/migrate the user data after the new redirected user directories are created.  (Still involves users backing up bookmarks, some files from 3rd party apps like firefox)
2. The user can backup and restore their files.

The organization I was working with chose to go with option 1.  They are small and some extra time can be used to verify redirected folder policy and data verification.  Users were required to backed up Firefox, Chrome and other third party app data into a backup folder in their directories folder the day the notice that their data migration would be.  The data migration would be the next day and they got what their new password would be.  This was done to ensure AD properly applied the redirected folders policy.

Example of Notice:

Hi $USER,

To ensure the best and most efficient working experience possible, the IT has been working on improving our infrastructure and it required us make some changes with how your login profile works.  We would like to make the changes to your profile $DATE after hours so this will be in effect for $DATE2.

Please feel free to contact IT services by email, phone or chat with any issue or concerns you might have regarding IT.

Your username has remained the same but your new temporary password will be $NEW_TEMP_PASSWORD

To login to a staff computer, login as you normally would but put in your new temporary password $NEW_TEMP_PASSWORD.  Then you will be prompted to change your password; before you are able to continue

To login a staff computer:

your username is $USER or $USER@DOMAIN.CA your password is $NEW_TEMP_PASSWORD

After your first login, you will be prompted to change your password.

You can change your password any time by pressing ctrl + alt + del on your keyboard and select "change password".

Converting Roaming users to Redirected Folders

This part is easy, the trick is doing it and allowing the users to keep access to their data.  Now at least in this situation our roaming users paths are in two places in AD.

Location 1 for the data is \\servername\data\$user
Location 2 for the profile: \\servername\profile\$user

Now if the server goes down that kinda makes using the DFS in AD useless.  So we want the redirected folder to use a local based profile, and point to the domain for the user pathing so that if the server does go down it uses DFS until the server comes back online.

The profile path is easier to fix, you right click on the user and get the Properties, here we want to blank the profile path.  Also make sure you remove any AD settings that move the users data to another place other then where you want it to be.

Once we reset the user profile path.

So we reset the user.  Remove the pathing for the profile and the data directory because we have already set our pathing in our ad settings to avoid conflicts.  To have more control of our ad setting I created additional OUs to apply AD settings per department.

The OU layout is setup as follows

1. Human Resources (HR)
2. Information Technology (IT)
3. Customer Service 1 (CS1)
4. Customer Service 2 (CS2)
5. Customer Service 3 (CS3)
6. Laptop Users (LU)
7. Purchasing and Receiving (PR)
8. Board Members (MB)
9. New Users (NU)
10. Test OU (TOU)

The AD settings for the OU are setup as follows.

Computer Configuration

Administrative Templates -> Network -> Offline Files

Subfolders  always available offline = Enabled | No additional Settings

Administratively assigned offline files = Enabled | Files and Folders -> Value Name = \\domain\dfs\$USERDATA\%username% | Value = “BLANK”

Configure Background Sync = Enabled

Background Sync Configuration

Limit Disk space used by offline files = disabled

Allow or disallow use of Offline Files Feature = enabled

Action on server disconnect = enabled | Set Action = Work offline

Enable Transparent Caching = enabled | Network latency value in milliseconds = 32000

Turn on economical application of administratively assigned Offline Files = enabled

Synchronize all offline files before logging off = enabled

Synchronize all offline files when logging on = enabled

Synchronize offline files before suspend = enable | Action = full

User Configuration

Network -> Offline Files

Administratively assigned offline files = enabled |

Files and Folders | Value Name = \\domain\dfs\$DATA\%username% | value = “blank/nothing”

Administratively Assigned Offline Files

Non-default server disconnect actions = enabled

Customize actions | Value Name = Work offline = 0

Action on Server Disconnect = enabled | Action = Work Offline

Synchronize all offline files before logging off = enabled

Synchronize all offline files when logging on = enabled

Synchronize all offline files before suspend = enabled | Action = Full

Administrative Templates -> Policies -> Windows Settings -> Folder Redirection

AppDATA = \\Domain\dfs\$DATA

DESKTOP = \\Domain\dfs\$DATA

Documents = \\Domain\dfs\$DATA

Pictures | Music | Video = Follow Documents Folder

Favorites = \\Domain\dfs\$DATA

Contacts = \\Domain\dfs\$DATA

Downloads = \\Domain\dfs\$DATA

Links = Not Configured

Searches = \\Domain\dfs\$DATA

Redirected Folders Pathing

Now with these settings in place we can make the changes to the user profiles.  I like to run a gpupdate on the server and on the client (if it's a current in use workstation the user uses regularly) just to make sure the policy gets applied.  I then login as the user and have the AD recreate all the proper folders in the new $DATA directory.

Then logout of the client computer.  On the server you need to take ownership of the old directories and the new directory (in this case I am using an administrator account) and then copy the data from the old directories into the new one.  Once your finished then give ownership back to the user; update your group policy on the server and on the client.

The user should now be setup using roaming profiles and at least in my AD environment all users that have been moved over to redirected folders have a typical login time of 5 to 10 seconds and commonly used files are synced and available in offline mode in case the system does have to work in an offline capacity.