EmailRSS

Tag Archives: File Storage

Using Handbrake and PowerShell to Shrink Videos in Redirected Folders

Posted on by

Videos, specifically .MP4s, are probably the largest files on your file servers. In part, this is due to the explosion of cheap cameras that record very high definition video. The latest iPhone can record video at 4K yetI have some projectors that can’t show a resolution greater than 720p! Talk about a waste of space.

So, what is a server admin to do? The same thing we did to pictures, shrink some files with PowerShell! Below, you will see a screenshot of the same video before and after conversion!

The script will:

  • automatically go through a network share that is used for folder redirection / home folders.
  • Convert MP4 files to a 720p resolution. If you want a higher or lower resolution, edit line 255 by changing the preset value.
  • Remove the old file if it is larger than the new file.
  • Reset all ownership and permissions
  • Tag the file so that future conversions run faster.

Continue reading →

Delete Unused Home Folders with PowerShell

Posted on by

I have a bit of an efficiency obsession! Power bills, navigation, and drive space are a few of my focuses. As this is a tech blog, I won’t tell you what to set your heat on in the winter (58) or the quickest way to the line of totality in 2024 (yes, I’m counting down). I will tell you that you should automatically be decommissioning old user accounts and the personal content that they created.

We have covered the first part before. It is fairly easy to add a remove-object line to any decommissioning scripts that you use. In an existing environment, you may have a lot of home folders that have been orphaned. These folders sit on a share but they do not have a corresponding user account attached to them. To fix that, we can use the script below to compare folder names on a home folder/folder redirection share against AD user accounts. If the account does not exist, we can remove the folder (or move it to an offline location).

#This should point to the root of a home folder/FR share. Subfolders in this folder match AD account usernames. 
$Folders = get-childitem \\SERVER\SHARE\FOLDER\

$NamesToIgnore = "Jmoody"


$FoldersToBeRemoved = @()
foreach ($Folder in $Folders){
    $Username = $Folder.Name

    if ($NamesToIgnore -notcontains $Username){

        $UsernameCheck = Get-ADUser -Identity $Username  -Properties * -ErrorAction SilentlyContinue
        if ($? -eq $false -and $Username -notlike $NamesToIgnore){
            
            $FoldersInformation = @{"Folder Name"=$Username;"Folder Path"=$Folder.FullName;"Last Write Time"=$Folder.LastWriteTime}
            $FoldersToBeRemoved += New-Object -TypeName psobject -Property $FoldersInformation
            

            Write-Host $Username
            pause
            Remove-Item $Folder.FullName -Recurse -Force -Verbose -WhatIf
        }
    }
}

$FoldersToBeRemoved | Out-GridView

This script does have a few safety features. First, it will allow you to mark out some folder names (in case you have shared FR folders). Second, it will display the home folder that will be deleted and prompt you to continue the script. Finally, the remove-item line contains a -whatif parameter. Once you are comfortable with this script and have a valid backup, remove the -whatif parameter. When you run this script, you will see errors from Get-ADUser when it can’t find a user account. I left these errors visible as I wanted to see the search being performed.

Enjoy the efficiency!

Delayed Folder Redirection File Screens with PowerShell

Posted on by

File Screens, a feature of the File Server Resource Manager tool, allows administrators to restrict the type of files that can be stored on a share. It is both useful and infuriating. Useful to me as I can enable it on our student’s redirected folder location. Infuriating for students because they can’t save any EXEs in this location.*

Delayed Folder Redirection File Screens with PowerShell

File Screens has a downside though. It is an all or nothing approach to file type filtering. In the example above, users are either allowed or blocked from saving executable files on the HomeFolders location. The result is dependent on if the rule is active or not.

Let’s say that you don’t really mind that a user saves an executable to their redirected downloads folder. You might have asked a user to download an application so you can deploy it. Or a user might need to run a small application once (such as a online meeting plugin).  When file screens are enabled, your users get a nasty accessed denied error. What is needed is something a bit more flexible – say, a PowerShell script (or two).

 

Cleaning up EXEs with PowerShell

Our first script allows a trial run on your share or DFS Namespace. You will need to modify the Get-ChildItem path in the first line to match your environment. The script will search for any file in that location that has an .EXE extension and has a Last Write Time older than 7 days ago. Each file is then marked as hidden. This allows us to simulate a -whatif scenario.**  If you want to see what files will be marked as hidden, run just the $Files line and see what is contained in that variable.

$Files = Get-ChildItem "\\Test.local\data\Staff\" -Recurse | Where-Object {$_.Extension -eq ".EXE" -and $_.Lastwritetime -lt ((Get-Date).AddDays(-7))} | sort Lastwritetime 

foreach ($File in $Files){

$(Get-Item $File.FullName).Attributes = 'Hidden'

}

If your environment is like mine, no one will notice that their EXEs are missing. When you feel confident to actually remove the files (and have a valid backup), run the second script. It has a slightly modified foreach loop that calls the Remove-Item Cmdlet. If the $File item is successfully removed, the file details are written to .\DeletedFiles.csv. The Get-ChildItem and Remove-Item Cmdlets use the additional -force parameter in this script. This parameter allows both Cmdlets to interact with hidden and read-only files. This is needed if you marked all of your EXEs as hidden with the first script.

$Files = Get-ChildItem "\\Test.local\data\staff" -Recurse -Force | Where-Object {$_.Extension -eq ".EXE" -and $_.Lastwritetime -lt ((Get-Date).AddDays(-7))} | sort Lastwritetime 

foreach ($File in $Files){

Remove-Item -Path $File.FullName -Recurse -Force

    if ($? -eq $True){
    $File | export-csv .\DeletedFiles.csv -NoTypeInformation -Append
    }
}

These two scripts saved almost 60GB of storage in my environment and I hope they help your servers out as well! I now use file screens on certain shares and this script on other shares. And if you are getting tired of folder redirection, don’t despair – you only have two more articles in this series to read. 🙂

 

*AppLocker would prevent an EXE from running in this location.

**Though now that I think of it, modifying the ACLs on the EXE to add an deny would have been a better way of simulating the actual delete.

Extending Folder Redirection: Data Deduplication, Volume Shadow Services, and Offline Files

Posted on by

So you enabled Folder Redirection and got pulled off to another 100 projects. Believe me, I completely understand. Though Folder Redirection is working for you, you can take it so much further! Welcome to part three of our Folder Redirection series. To get the most out of Folder Redirection, we will configure three technologies to save you space, time, and a few headaches – in order: Data Deduplication, Volume Shadow Services, and Offline Files.

 

Using Data Deduplication with Folder Redirection

We previously covered data deduplication and used an SCCM primary site server in our example. You can read that guide here. When data deduplication is used with Folder Redirection, you have to make a few extra changes. Go ahead and enable the data deduplication role; then select the data deduplication properties for your volume.

Ensure the data deduplication type is set to General purpose file server. In our environment, we found that the default file age was a bit too aggressive because files changed so often. For our configuration, files won’t be deduplicated until they are 10 days old. We also exclude three file types: pst, xls, and db. When deduplication scrubbing would occur, file corruption errors were being logged in Event Viewer. Oddly, they only involved these three file types.

Extending Folder Redirection: Data Deduplication, Volume Shadow Services, and Offline Files

As a side note, this corruption issue made me explore a way to automatically convert older Office files (.doc, .xls, .ppt) to the Office 2007 format. This prevents the file corruption issue that I saw and saves a ton of storage space (as the new file format is 1/10 the size of the older file format). Expect a write up on that process soon. Data deduplication with folder redirection is simple to setup and very useful with folder redirection. Knowing these caveats will ensure a successful roll out.

 

Using Volume Shadow Services with Folder Redirection

Volume Shadow Services, also known as Shadow Copies, allow users to restore their own files from a previous point in time. The next time a user overwrites a critical document, he can right click on the file – choose Restore Previous Versions – and restore the file without calling the helpdesk. I love saving future me time!

To enable Shadow Copies, launch Explorer and open the properties of your data volume. Select the shadow copies tab and press enable. Select Settings and set a Use limit.

Extending Folder Redirection: Data Deduplication, Volume Shadow Services, and Offline Files

If you prefer more than two snapshots a day, adjust the schedule now. More snapshots allow you a greater amount of flexibility in backups but reduce how far back you can restore. Your staff can now restore their own files and folders – you just have to train them now. 🙂

 

Using Offline Files with Folder Redirection

Offline Files received a bad reputation with XP (and for good measure). It was constantly visible by slowing down logouts, presenting sync errors. Offline Files in Windows 7 and above is nearly maintenance free.

Why would you want to enable Offline Files though? Three reasons: roaming users, insurance, and speed. Users with laptops/tablets are able to work offline and have their changes sync with they are connected to your network. Offline Files also gives you some flexibility when a user’s machine becomes disconnected due to network/power issues or if your file servers are offline. Users are still able to access documents and work.  Finally, Offline Files improves folder redirection speed.

02

When a user first logs in with Offline Files enabled, local files that will be redirected  are moved to the Offline File cache (C:\Windows\CSC\) and are then synced up to your file server. This allows the user to log on faster as the Folder Redirection CSE is able to finish sooner. When Offline Files are not enabled, users have to wait for these files to copy to your server. Copying within disk is always faster than over the network.

The Group Policy settings for Offline Files can be found at: Computer Configuration\Policies\Administrative Templates\Network\Offline Files. Depending on your OS, Offline Files is enabled or disabled by default. To ensure that Offline Files is enabled no matter the OS, find the Allow or Disallow use of the Offline Files feature and set it to enable. In our environment, this setting is applied to primary machines only – labs and common use areas do not get Offline Files.

Redirected folders are automatically cached for Offline Files. You can assign other folders to cache by enabling the Specify Administratively Assigned Offline Files setting. Good candidates for this setting might be folders where software retrieves network data. Setting these folders to cache would allow a user to access this information offline. Locations where many users will write to simultaneously should not be specified here.

And that wraps up post three of our Folder Redirection series. In the next part, we will tackle remote file access for folder redirection.

Configuring Folder Redirection – Part 2 – Group Policy and Security

Posted on by

When properly configured, Folder Redirection manages itself and untethers the user from their computer. With our DFS Namespace created, it is time create our folder redirection structure and configure our Group Policy Object. Navigate to your namespace (ex: \\Test.local\Data\) and create a new folder named “FR”. All redirected folders will be kept in this sub folder.

 

How to Correctly Set Security Permissions for Folder Redirection

Edit the security properties on the FR folder and select the advanced button. Disable inheritance and remove all inherited permissions. You should now have zero permissions listed for this folder. We now need to configure four permission entries:

  • Give SYSTEM Full Control to this folder, subfolders, and files.
  • Give Domain Administrators Full Control to this folder, subfolders, and files.
  • Give CREATOR OWNER Full Control to subfolders and files only
  • Give Authenticated Users Read/Execute, List folder contents, Create folders, write attributes to this folder only.

Configuring Folder Redirection - Part 2 - Group Policy and Security

These permissions allow for any user to create a folder in the root of \data\FR. When a user (with folder redirection enabled) logs in, their account will create their root folder (ex: \data\FR\Joseph\). Because they are the creator of the folder, the CREATOR OWNER permission entry will give them Full Control to that folder, all subfolders (ex: \data\FR\Joseph\Desktop) and all files. Domain Administrators will still be able to access the redirected folder but all other users are denied access.

If you want to create separate redirected folder locations for different departments or users, you would create sub-root folders under \data\FR. For example, you might create the following folder structure:

  •  \\Test.local\data\FR\IT
  • \\Test.local\data\FR\Staff
  • \\Test.local\data\FR\Students

In this case, you would apply the four permission entries on the sub-root folder (ex: IT) instead of at the FR folder level. If you have a dedicated security group for the users, you can remove the authenticated users entry and substitute your dedicated security group. Just be sure to set the Applies to: This folder only setting.

Note: Any distribution group can be changed to a security group. In Active Directory, select the group and change the type from Distribution to Security. That group is now a mail-enabled security group.

 

How to Configure Group Policy for Folder Redirection

Launch the Group Policy Management Console. Create a new GPO under the Group Policy Objects container and name it. Creating the GPO in this container ensures we don’t accidentally roll out settings before we are ready.

Edit the GPO and navigate to User Configuration\Policies\Windows Settings\Folder Redirection. Right click on Desktop and select properties. Change the setting from Not configured to Basic. Under Root path, type the namespace path to your FR folder. See the screenshot below for an example:

Configuring Folder Redirection - Part 2 - Group Policy and Security

Before pressing OK, select the Settings tab and uncheck Grant the user exclusive rights to Desktop. This will allow administrators to view the desktop folder. Press ok and then Yes to the warning. This folder redirection policy will only apply to devices running Windows Vista and above.

Enable folder redirection on any remaining folders that you wish to store centrally. Personally, I make the following exceptions to three specific folder redirection targets:

  • I do not redirect Appdata. I prefer to use UE-V for this feature.
  • I do not redirect the Start Menu
  • I put Pictures, Music, and Videos into their own folders and do not let them follow the Documents folder.

Configure your GPO to apply to a test user and link it to an OU. Folder redirection should be enabled by the second logon. If you want to make the experience happen on the first logon, you can enable the Always Wait on the Network at Computer Startup or Logon group policy setting.

In our next post, we will extend folder redirection by enabling data deduplication, Volume Shadow Services, and Offline Files!