I ran into this issue where my redirected favorites in IE 8 broke. They broke bad for everyone. IE would list nothing in the favorites drop down and the links bar was also empty. Attempts to add a new favorite would fail. I could not even create a favorites folder from within the favorites manager.
This started out very intermittent. The same user could go from one computer to another. It would work on some and not on others. It would work for our IT group every time. The first common connection I made was the use of offline files. We don’t like offline files. We find it causes us nothing but problems. I will save those for another time. I did find that machines that had offline files off had this issue. If offline files are turned on, the problem went away.
We recently started over with our group policies as we rolled out Server 2008 and Windows 7. We used the new folder redirection feature to redirect documents to the home folder and set favorites to fallow the home folder. By default this enabled offline files to sync those locations. There was a registry setting that disabled this default behavior that we later found and set. But this still left offline files running. It may be on by default. I don’t remember any more.
Because offline files was on for most people this problem was fairly rare. We finally had enough problems with offline files that we decided to kill it for everyone. The resulting problem was everyone lost favorites. So I set out to find a solution. The better I wrapped my head around this the stranger it felt.
The other important detail was that our network administrators did not have this problem. So that led me to permissions. Our users only have security to home folders, not the folder structure under them. Before we would map the UNC path of the profile to the N: drive. Then we would point everything to N: including documents. The new way to do it in group policy wants to use the UNC path as the redirection point. That is introducing issues with some apps. IE favorites included.
The problem goes away if I give the user full access all the way from the root of the share to the home folder location. This is a bit much but it does work. With this information in mind, I set out to see the minimum permissions that I needed to grant the users for this to work. If I get the user just read access to the folders it worked. Here is the list of minimum permissions that those sub folders needed to have.
List folder / read data
Read attributes
Read permissions
That looked like a simple enough solution but something still didn’t feel right. If that is what the issues was, then I should have been able to find lots of other people with this problem. For as much as I searched for this and as little as I was able to find, I knew something else was strange. After some more experiments, I narrowed this down to be a very rare and unusual bug.
I found that I only had to set those permissions on the folder under the home folder. None of the other parent folders needed any permissions at all.
I also found that the depth of the home folder made a difference. If I moved the users home folder up just one directory location (with out any special permissions) the problem went away. I even created a new folder structure of the same depth on the same root share to test this out. It had the same results.
I also found that not using DFS (distributed file system) would also make this problem go away. Same folder depth but not located on a dfs share.
So if we left Offline Files on, or used a folder structure that was one folder shallower, or did not use DFS, or did not redirect favorites with the server 2008 redirection policy, or did not use IE, then we never would have had this problem. I can see why it was so hard for me to find information on this. I hope that the next person dealing with this is able to find this post and something in here will give them a glue to solve whatever issue they have. I expect I am missing some simple detail but I was able to get it working in the end.
If you wanted to know how deep our home folders are, they UNC path looks something like this: \\domain.name\rootshare\home\depart\username