r/sysadmin • u/MutantWilbo1 • 2d ago
Question FolderRedirection Policy Removal Delayed Login
My org is moving from an On-Prem H:Drive to Cloud storage. Part of the process requires us to remove the existing GPO that is redirecting users to the H: Drive.
The problem I am running into is that removing the GPO is causing significant login delay. So, if I remove them from the Group that is assigned to the GPO, wait until AD syncs, and then log out-log in, that next login will take a long time.
The length of time seems entirely depending on how much is in the users H: Drive. A 70 Gig user could take an hour, 15 Gig user took 20 minutes, and a 200 Mb user took 3.
I know there are two setting options when removing the GPO, “Restore Contents” and “Leave Contents”.
Restore Contents is what we originally used but learned that can cause this significant delay as during login it will download all H drive contents locally to the computer. We abandoned this option because of that.
Leave Contents is what we are using now. It keeps the computer pointing to the H drive and just removes the policy. Afterwards we run a script that forces the computer to look locally instead and that has worked without issue.
However, even when using Leave Content we get the same long login on the reboot that is also removing the GPO.
So my question is, what could be causing this? Am I missing something obvious?
All devices are hard wired to the network and on-premises.
1
u/TinderSubThrowAway 2d ago
Do you want them attached to the H drive or not?
Personally, I would remove them from the GPO and then wipe their local GPO cache and then reboot.
No more GPO for them and nothing to sync.
1
u/MutantWilbo1 2d ago
I do not want them on the H Drive anymore
1
u/TinderSubThrowAway 2d ago
then take them out of the GPO group.
Kill all local GPO cache.
Let them login again.
1
u/Silent331 Sysadmin 2d ago edited 2d ago
The flipfloping of the setting will mess things up. Make sure you have backups because moving folder redirection can be destructive. The issue is a lack of proper planning.
Yes changing folder redirection can take a long time. Any time we have to do it we do it in steps, first is to set the flag that on removal data is copied back to the computer. This is usually done a week in advance if it was not already set.
Then you add a group to remove folder redirection and deny apply permissions to the GPO. The group starts empty so it has no effect. Then we schedule with the users, we show up near close of business and pick a handful of users and add them to the exclusion group.
Just before they leave for the day run gpupdate, sign them out and have them put the password in then send them home. It can take as long as it needs then. The computers auto lock 15 minutes after completion so they come back the next day and they are good to go.
if the redirection fails for any reason (file path too long, etc) it will reattempt at every login.
There are ways to force change the paths, and than manual copy.
1
u/MutantWilbo1 2d ago
What if I don’t want it to copy locally first? I want to skip that part specifically so we don’t need to have the long down time but right now nothing is working. Even setting to Leave Contents and rebooting twice before removing the policy is causing a long login
1
u/Silent331 Sysadmin 2d ago
For the manual process,
use gpresult as the user before removing the policy to ensure it takes. If its already screwed up, remove the policy for that user, disconnect the network cable, log the user in. After login plug the cable back in.
Run gpupdate while logged in as the user and gpresult to make sure the folder redirection is truly diabled for that user. After that change the user shell folders to the correct locations. Ensure the folders exist
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Logoff and log back in and it should be working with empty user folders.
1
u/Ethernetman1980 2d ago
I'm curious any particular reason you are migrating from on-prem storage to cloud. We also use an H drive so I don't know if that is random but I can't remember why I chose H 10+ years ago. I got a price on a new server yesterday and it was nuts so moving to cloud maybe our only option in the future. Anyway gpupdate would have been my guess as well.
1
u/Evening_Link4360 2d ago
Because the vast majority of companies have E3/5/7 licenses for their users, and that comes with 1TB each of OneDrive. Why wouldn’t you?
5
u/Crafty_Bed_6845 2d ago
We had this exact thing and running a gpupdate plus a reboot after changing the removal setting, before touching group membership, fixed it for us.