How to setup Windows Server 2019 Work Folders

Accessing data and working remotely has become more important with today's mobile workforce and response to covid-19. Given this, it makes sense that more and more technologies are being designed to allow access to data from more devices and locations accross the world. This is what Work Folders in Windows Server 2019 allows you to do. It is a way to securely publish access to files and folders to the multiple device types that users may use. These files are accessed via a web listener that is configured on the Work Folders file server, which enables this data to be accessed from inside or outside the corporate network, from both domain-joined and non-domain-joined computer systems.

Configuring a full-fledged Work Folders environment with all the different moving parts and components can be difficult for some to setup. In this How To, we will focus on the steps that are needed on the file server in order to make it ready for hosting Work Folders. Once you are setup with Work Folders you will realize the many benefits that it can provide your business. In later How To's, will show you how to use Group Policies to assist in using Work Folders.

Microsoft Server 2019: Setting up Work Folders

Below are the steps to follow:

1. Log into your file server and launch Server Manager.
2. Choose the link for Add roles and features. Walk through the role installation wizard until you get to the Select server roles screen.
3. Navigate to File and Storage Services | File and iSCSI Services. Then, check the box next to Work Folders. When you receive a pop-up message about adding the additional IIS feature required, make sure to click on the Add Features button.
4. Finish the wizard in order to install the Work Folders role on this server.
5. Once the role has finished installing, head back to Server Manager and navigate to File and Storage Services | Work Folders.
6. Drop down the TASKS menu and choose New Sync Share
   
7. Choose or enter a path where you want the new Work Folders to be stored. This is the location on our file server that will be populated by folders that are named after our users. If you have already set up a folder and shared it, you will see it in the list to choose from. I have not set up any such folder yet, and so I am going to type in the location where I want the wizard to create a new folder for me:
8. Click Next. If you entered the location of a folder that does not yet exist, you will be prompted with a confirmation box asking whether you want the new folder to be created. Go ahead and click OK on that message.
9. On the User Folder Structure screen, you can choose how the user's folders will be named within our Work Folders sync share. Each user that utilizes Work Folders will get their own folder set up inside our share. These individual username folders will be named via either their username alone or by their username@domain. In a lot of environments, you can get away easily enough with only the username alias. If you have users that will be accessing Work Folders from multiple domains, then you have the potential for conflict between usernames and should choose alias@domain. Additionally, on this screen, you can opt to sync only a particular subfolder for the users. For example, if you want their Documents folder to be synced across all of their devices but don't care about the other folders, such as Pictures and Music, you could specify only Documents on the line here.
10. Specify a name for Sync Share and click Next again.
11. For the Sync Access screen of the wizard, we need to define which users and groups have access to use this sync. I created an Active Directory Security Group called Work Folders and placed my users inside that group. So, on this screen, I will simply specify my Work Folders group:
12. Click Next, Next, then Create. With that, your new WorkFolder Sync Share will be created and ready for use.
13. Client devices will connect to Work Folders on this file server via HTTPS. In order to make that happen successfully, we need to configure a DNS record that points at this file server, and an SSL certificate to be bound to the web listener on the server.
14. On your public DNS, set up the name Work Folders. <yourdomain> and point it at the IP address that will flow to this file server. For example, the best way to do this is to publish the web listener with a reverse proxy server of some kind; let's say that proxy server is running on the internet IP address 198.51.100.210 You would configure a DNS record for Work Folders.company.com and point it at 198.51.100.210, then let the reverse proxy server bring that traffic inside the network and submit it to the file server where we have Work Folders running.
15. Install an SSL certificate that contains the appropriate Work Folders. company.com name – replacing company.com with your domain name, of course – and bind it to the default website on the Work Folders server. Since the full IIS Management Console is not installed with the Work. Folders role, you can utilize the IIS Management tools from another server in your network in order to bind the certificate to the default website. Alternatively, you can use the netsh command in order to bind the certificate to the site:
    
    netsh http add sslcert ipport=<IP address>:443 certhash=<Cert thumbprint>
appid={CE66697B-3AA0-49D1-BDBD-A25C8359FD5D} certstorename=MY.
16. Now, Work Folders has been configured and listening on our file server. The next step is to configure our client computers to tap into this Work Folders sync share. The process for accomplishing this is different, depending on what client devices you are connecting to, but the starting point for Windows 10 and 8.1 machines is Control Panel | System and Security | Work Folders.