Academic Services Exeter IT Desktop Support Manage Filespace with the ARS Console Document reference: Document type: Document status: Review period: DS021 Desktop Support Procedure Live Six months Next review date: 13 July 2015 DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 1 of 13
1 TABLE OF CONTENTS 1 Table of Contents... 2 2 Document History... 3 2.1 Document location... 3 2.2 Revision history... 3 2.3 Approvals... 3 2.4 Review... 3 3 Overview... 5 4 Installing the ARS Console... 5 5 Creating Groups... 7 6 Setting File Permissions... 9 7 Appendix A - Managing Files and Folders... 11 8 Appendix B - NTFS File Permissions... 13 DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 2 of 13
2 DOCUMENT HISTORY 2.1 DOCUMENT LOCATION This document can be accessed from the following location: \\isad.isadroot.ex.ac.uk\uoe\ps\as\shared\exeteritpolicies&procedures\procedures\desktopsupportprocedures 2.2 REVISION HISTORY The latest revision can be found at the top of the list: Revision Date Author Version Summary of Changes 8 Jan 2015 B Lambert 1.6 Removed ref to ver. 6.0 installer and XP 12 Jun 2014 B Lambert 1.5 No Change 01 Aug 2013 B Lambert 1.5 Added how to sever inheritance on windows 7 30 Oct 2012 C Dominey 1.4 Inserted file permission authorisation details 4 Dec 2011 B Lambert 1.3 Added map network drive procedure 10 Dec 2010 B Lambert 1.2 Related to College structure 20-Oct-2009 M Moore 1.1 Installation Server name change 4-Mar-2009 M.Moore 1.0 First Live Release 2.3 APPROVALS This document requires the following approvals: Name Title Version Date of approval Bill Lambert Senior Desktop Support Consultant 1.6 8-Jan-2015 Bill Lambert Senior Desktop Support Consultant 1.5 12-Jun-2014 Matt Coppell Desktop Support Team Leader 1.5 13-Aug-2013 Paul Grogan Incident Response Manager 1.4 31-Oct-2012 Paul Grogan Incident Response Manager 1.3 20-Jan-2012 Paul Grogan Incident Response Team Leader 1.2 16 Dec 2010 Paul Grogan Desktop Support Team Leader 1.1 24-Dec-2009 Paul Grogan Desktop Support Team Leader 1.0 11-Mar-2009 2.4 REVIEW This document was reviewed on the following dates and needed no changes: DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 3 of 13
Name Title Version Date of approval DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 4 of 13
3 OVERVIEW All Services and Colleges have access to a shared storage area accessed from a PC as drive N. It is expected that a Service/College will want to sub-divide this shared space into separate folders, some of which may have restricted access and some of which can be used for general access. To manage your shared file space; first create the groups of users in your Service/College that you wish to access folders in your file space, then create the folders in the file space to match the groups and finally grant the access rights (file/folder permissions) to each of these groups. Groups are created and managed using the Active Roles Server (ARS) Console. This document describes how to install and run the ARS Console and how to set file permissions for your folders and files. You need an ISAD admin account to run the ARS console and manage your shared file space. Only designated members of staff in each Service/College will be given the access to do this. Your ISAD admin account should already have been organised for you prior to receiving your ARS training. 4 INSTALLING THE ARS CONSOLE The ARS Console must be installed on a PC running Windows XP. 1. From the Start button choose Run. 2. In the Run dialog box type \\vmars02\install, then click OK. 3. In the window that opens, double-click AutoRun to start the installation. 4. Click on Quest ActiveRoles Server and choose Console (MMC Interface), (select either x86 MMC or x64 MMC), to install the ARS console. Take care when doing this as it is essential that this is the ONLY link in this window that you click. This will install ActiveRoles Server version 6.7. DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 5 of 13
5. Click on next, accept the Licence agreement, and then provide your User information when prompted. 6. Click next and when prompted for which feature you wish to install, choose the MMC interface. 7. Click next to complete the installation; this should only take a couple of minutes. 8. Click Finish to close the installation. DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 6 of 13
5 CREATING GROUPS 1. Click on Start/All Programs/Quest Software/ActiveRoles Server/ActiveRoles Server Console to connect to the ActiveRoles Server. The following window will open: 2. If you have logged into ISAD with your ISAD admin account you will be connected to the ActiveRoles Server. If you have logged in with your usual account, right-click on Active Roles Server and choose Connect. Click on Options, then in the new window that opens, check Connect as The following user and enter your ISAD admin account details. 3. Once connected, expand Active Directory and navigate to your Service/College and then Groups. DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 7 of 13
4. Right-click Groups, then New and choose Group. 5. In the dialog box that opens, type in the name of your group, retaining the prefix, and enter a description. Care should be taken when naming groups and writing descriptions, particularly if you are managing a large number of groups. The prefix identifies your Service/College and should not be removed. 6. Click next twice and then click Add from the dialog box that opens. 7. In the next dialog box choose Browse, and then expand Managed Units. Navigate to the list of users you want to select from and then click OK. 8. Click on the members you wish to add to the group, then click Add. The members you have selected will appear in the lower part of the window. Click OK, then next and Finish. DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 8 of 13
Once a group has been created, new members can be added and removed by doubleclicking on the group to open the group dialog box again and clicking on the Members tab. To see which groups each user is a member of, right click on the user s name in the Members list, choose Properties then click on the Member of tab. You can also rename the group and description; click on the General tab to do this. To delete a group, right click on Group and choose Properties from the drop-down menu. Care should be taken when doing this as once a group has been deleted it can t be recovered. When a new member of staff joins your Service/College they should be added to the following groups: General_Access Login_Script_Shared The General Access group gives staff in your Service/College permission to browse their filespace. The Login_Script_Shared group maps their Drive N when they login to their computers. When a member of staff leaves your Service/College, you will need to remove them from these groups and any other group they belong to. 6 SETTING FILE PERMISSIONS Authorisation - Any changes to file permissions must be authorised by either an ARS Admin for the area, or by a senior member of staff in the service or College. Where there is any doubt about the identity of someone authorising a change then an email from them confirming what changes / additions should be made is normally sufficient. Any authorisation emails, etc, should be retained for at least 12 months in case evidence is needed of who authorised a particular change. You need to be logged onto ISAD with your ISAD admin account to set File Permissions. When logged with your domain admin account you map the shared drive as follows: Double-click My computer, Click on the Tools menu and choose Map Network Drive. Choose drive letter N: and folder \\isad.isadroot.ex.ac.uk\uoe\{shared area}. Tick the reconnect at logon box and click Finish. To add groups and users to the file permissions for a folder or file: 1. Navigate via My Computer to the folder or file you wish to set the permissions for. 2. Right-click on the folder or file, and from the Properties box that opens, choose the Security tab. The dialog box that opens displays the groups and users who have access to the folder and the permissions that have been granted to each of these. See Appendix B for details about the default groups in the top level of your file space. 3. Click Add to add users and groups. DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 9 of 13
4. In the Select Users, Groups or Computers dialog box, enter the name in the Name text box of the group or user you wish to set permissions for. To easily see all the Groups and users in your Service/College, enter your Service/College pre-fix, followed by a hyphen, then click Check Names. 5. Continue to add groups or names until you have selected all those that you require. The lower list will contain those groups and users you have selected or entered. 6. Click OK to add these to the list on the Security property sheet. To set file permissions: 1. Click on the group or user that you wish to set permissions for. 2. To allow a permission, select the respective Allow check box. It is generally not advisable to give Full control to groups or users as this would enable them to change file permissions for other users. Use Deny with caution as it over-rides Allow permissions. If you give all your users MODIFY access at the top level of the shared area, the area will quickly become unmanageable. In addition you will give all your users the capability to delete the contents of your shared area, along with potentially compromising the security of private folders. Please take extra care with this access. Further detail about File Permissions is given in Appendix B. How inheritance affects file and folder permissions: DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 10 of 13
After you set permissions on a parent folder, new files and sub-folders that are created in the folder inherit these permissions. If you do not want the files and sub-folders to inherit these permissions, click This folder only in the Apply onto box when you set up special permissions for the parent folder. If you want to prevent only certain files or subfolders from inheriting permissions, follow these steps: 1. Right-click the file or sub-folder 2. Click Properties 3. Click the Security tab 4. Click Advanced 5. Click Change Permissions 6. Untick Include inheritable permissions from this object s parent 7. Click the Add button on the popup window (to leave the groups but break inheritance). 8. OK, OK 9. Back on the <folder name> Properties window click Edit button. 10. Select XXX-General_Access and click Remove. Note: until the group members log off then back on again they will not be able to access the folder as their access up to this point is based on the General_Access group and not the new group of which they are a member. 7 APPENDIX A - MANAGING FILES AND FOLDERS Each Service/College will have an allocation of 200GB of shared file space. This is a considerable amount of file space and needs to be well managed. Good housekeeping is essential when managing both groups and networked file space and if managing groups for more than one Service/College, to keep these properly discrete. File management is the system by which you organise your data, it might help to think of it as a filing cabinet or card index where you can categorise your work so that it is stored logically and is easy to find. How you structure your storage system and categorise your data is up to you but you will need to give it careful consideration. Organising your data with a consistent approach will make it easier to locate a file or folder. You can create a hierarchy of folders within your file space to suit your own needs. It is a good idea to locate work with common aspects in one folder and then a series of sub-folders if required. For example, an IT Department might create a folder at the top level of their file space called Purchasing. This in turn could contain sub-folders for Software Purchasing and Hardware Purchasing. Each of these folders and sub-folders can contain any number of documents (files). It is a good idea to limit the number of folders that you create in the root directory (top level) as this creates a better structure. Remember to give files and folders meaningful names as it will make your file space much easier to search and navigate, to find what you are looking for. DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 11 of 13
Since each folder is created below an existing folder, the location of a file in a folder creates what is referred to as a path. The path is simply the sequence of folders required to reach the file. The path is written using a slash (\) to separate folders. The path to your file space will always start with \\isad.isadroot.ex.ac.uk\uoe\ followed by either PS or Colleges, then your Service\College pre-fix. A clear view of your Drive N file structure can be seen using Windows Explorer. To open Windows Explorer, hold down the Windows key and then the letter E; alternatively use My Computer. DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 12 of 13
8 APPENDIX B - NTFS FILE PERMISSIONS The NTFS File Permissions define how a folder or file can be accessed or used. The following Table lists the standard NTFS permissions and the access that each provides: NTFS Folder Permission Full Control Modify Read and Execute List Folder Contents Read Write Allows the user to Change permissions, take ownership of the folder, delete subfolders and files and perform actions permitted by all other NTFS folder permissions Delete the folder plus perform actions permitted by the Write permission and the Read & Execute permission Navigate folders to view other files and folders, even if the user does not have permission for those folders, and perform actions permitted by the Read permission and the List Folder Contents permission See the names of files and subfolders in the folder See the contents of files and subfolders in the folder and view folder ownership, permissions, and attributes (such as Read-only, Hidden, Archive, and System) Create/edit files and subfolders within the folder, change folder attributes, and view folder ownership and permissions The top of your shared area should have permissions along the lines of: Domain Admins as FULL CONTROL permission College/Service ARS Admins as FULL CONTROL permission IT FPS Controllers as FULL CONTROL permission College/Service-General_Access as LIST permission DS021 - Manage Filespace with the ARS Console - v1.6 - Master.docx Page 13 of 13