Setting up Shared Permissions and NTFS Permissions for FSLogix Container and Logs

FSLogix is a tool widely used in VDI environments to save profile data (such as desktop, downloads, documents, etc.) to a centralized and shared location.

There is a lot of confusion, and the official documentation is not very clear about the permissions. Below are the details on how to set the sharing and security permissions (NTFS) properly.

This article focuses primarily on permissions and does not cover the installation or configuration of FSLogix.

It is assumed that there is already a shared folder (which can be from a Windows Server or within Azure's network).

FSLogix Container Folder Permissions:

Create a folder named "Container" inside the folder intended to store FSLogix-related data (it can be named "FSLogix") and apply the following permissions:

Sharing Permissions:

As shown below, add "Authenticated Users" and provide them with the sharing permissions for "Change" and "Read."

Security Permissions (NTFS Permissions) as per the following:

• Domain Users – Modify – This folder only

• CREATOR OWNER – Modify – Subfolders and files only

• Desktop Admins – Full Control – This folder, subfolders, and files

If the Logs folder is required to be in a shared path, otherwise, by default, the logs will be found on the machine running FSLogix in the following location:

C:\ProgramData\FSLogix\Logs

If a Logs folder is created and the logs need to be saved to a UNC path, the following permissions must be applied to that UNC path:

Sharing Permissions:

• Authenticated Users – Change and Read

NTFS Permissions:

• Domain Computers – Modify – This folder, subfolders, and files

• Desktop Admins – Full Control – This folder, subfolders, and files

We have already tested this. If you have any questions, feel free to leave a comment in the comment box, and we will reply as soon as possible.