Windows – Creating a Network Place Folder via a script

The "Share Permissions" can be "Everyone / Full Control"-- only the NTFS permissions really matter. (Cue religious arguments from people who have an unhealthy attachment to "Share Permissions" here...)

In the NTFS permissions on the folder on ServerB you could get by with either "DOMAIN\ServerA - Modify" or "DOMAIN\ServerA - Write", depending on whether it needed to be able to modify existing files or not. (Modify is really the preferred because your application may re-open a file after it creates it to write further-- Modify gives it that right, but Write does not.)

Only the "SYSTEM" and "Network Service" contexts on ServerA will have access, assuming you name "DOMAIN\ServerA" in the permission. Local user accounts on the ServerA computer are different from the "DOMAIN\ServerA" context (and would have to be named individually if you somehow did want to grant them access).

As an aside: Server computer roles change. You may want to create a group in the AD for this role, put ServerA into that group, and grant the group rights. If you ever change ServerA's role and replace it with, say, ServerC, you need only change the group memberships and you never need to touch the folder permission again. A lot of admins think about this kind of thing for users being named in permissions, but they forget that "computers are people too" and their roles sometimes change. Minimizing your work in the future (and your ability to make mistakes) is what being efficient in this game is all about...

In notepad, open %appdata%\Microsoft\Windows\Libraries\Documents.library-ms
The contents of the file should look something like this, you can also edit the file easily (Windows is pretty forgiving of users directly editing the file).

<?xml version="1.0" encoding="UTF-8"?>
<libraryDescription xmlns="http://schemas.microsoft.com/windows/2009/library">
  <name>@shell32.dll,-34575</name>
  <ownerSID>S-1-5-21-xxxxxx-{The uers's SID}-xxxxx</ownerSID>
  <version>11</version>
  <isLibraryPinned>true</isLibraryPinned>
  <iconReference>imageres.dll,-1002</iconReference>
  <templateInfo>
    <folderType>{7d49d726-3c21-4f05-99aa-fdc2c9474656}</folderType>
  </templateInfo>
  <propertyStore>
    <property name="HasModifiedLocations" type="boolean"><![CDATA[true]]></property>
  </propertyStore>
  <searchConnectorDescriptionList>
    <searchConnectorDescription>
      <isDefaultSaveLocation>true</isDefaultSaveLocation>
      <isSupported>true</isSupported>
      <simpleLocation>
        <url>\\myserver\users\JohnDoe</url>
      </simpleLocation>
    </searchConnectorDescription>
    <searchConnectorDescription>
      <isSupported>true</isSupported>
      <simpleLocation>
        <url>\\anotherserver\JohnsFiles</url>
      </simpleLocation>
    </searchConnectorDescription>
  </searchConnectorDescriptionList>
</libraryDescription>

Notes:

• The user's actual SID has to be put in the file.
• The folderType field in this example is for the built-in "Documents" folder. There's all kinds of interesting things you can do with folders and their types, but that's beyond the scope of this question.
• This example has two locations. Notice the first one has the DefaultSaveLocation set to true, and the second doesn't have this field at all. You can have just one folder, or up to 50 folders; exactly one must have the default folder field.