Assigning File Rights via DLU can delay user logon

 

 Assigning File Rights to large directory structures significantly slows down DLU logons.

A "Local File Rights Policy" should be the preferred method for assigning file rights on devices for large directory structures.

These rights are not applied each time a user logs into the device and will not result the long delays that can be associated by using DLU assigned file rights, which are reapplied on each logon. 

 

The "Local File Rights Policy" can be configured to create custom local groups to which rights can be assigned.  The DLU policy can then be configured to place users into these groups.

 

This will allow for the fine level control of rights to different users without performance degradation.

Another solution besides the use of a "Local File Rights Policy would be the following:

 

Create a device assigned bundle that automatically created a custom local group using the "net localgroup" command and then call CACLS.EXE or XCALCS.exe to assign the desired permission to the group created.