If you're dealing with remnants of a legacy (NT 3/4) environment with individual shares for the user home folders, I would follow Microsoft's recommendation for securing the Users folder at the NTFS level - Remove the Users access, then grant Users Read/Execute to the Users Folder, subfolders, & files; Create Folders/Append Data to the folder and subfolders; Create files/write data to subfolders only. (sounds counter-intuitive). Make sure that each folder follows the user's login ID. Modify the user profile to remove their home folder definition & save. Modify the user profile again to add the user profile as \\server\users\%USERNAME% (with the environment variable). You will be notified that the home folder(s) exist and be prompted to set the permissions/take ownership - say Yes.
This will set the permissions on each folder, granting the user Full Control (the ONLY time a non-admin account should ever be given Full Control!) The other Users permissions will be removed, leaving only the user, Administrator, and SYSTEM - all with Full Control. (Creator Owner may be present with special permissions.)
This folder will be mapped automatically during logon without any login script assistance. I actually wrote significant code around this to NOT map the home folder during logon, but look it up in AD and map it when run after a logon (like manually invoking the logon script after making a VPN connection).
You can then script the removal of all of the shares. If the folders don't follow the userID names, that can be scripted as well - just prior to the profile updates. I've done this for large organizations - over 25,000 users - over a day or 2.
Glenn
_________________________
Actually I
am a Rocket Scientist!
