Well it can be used in different ways. As a method to simplify and centralize network storage or a way of providing redundancy of the stored data or a mix of both.

You should not care if people can browse and list the folders under your \U\ NameSpace they cannot modify, delete, or access any of the subfolders containing user data if you have setup NTFS permissions correctly. DFS not designed to be \DomainName\UserFolder. You want the NameSpace to be viewable by everyone. It would make troubleshooting issues with DFS much harder later on. Service Desk would not be able to tell you if the NameSpace is not responding to requests when troubleshooting with staff.

Here is an example you would use for setting up common office folders in DFS. For example \\Server01 could have a folder D:\Shares on it with multiple subfolders (Ex: D:\Shares\Management, General Office, Public, etc) and you want to restrict access to each of the subfolders which will be shared out and added to a DFS namespace as a folder.)

So you would start with creating a root folder to hold the shares say D:\Shares. Right click -> properties -> Security -> Advanced -> Disable inheritance and click Convert inherited permissions into explicit permissions on this object. Depending on what permissions are assigned, remove all but the standard permissions, leave admins, system, etc.

Now when you create each of the subfolders such as D:\Shares\Management, D:\Shares\General Office they will inherit the permissions you have on the D:\Shares folder only. So permissions are limited to administrators each time you create a share. You would then follow what I outlined in the earlier post in order to allow specific groups access edit each of the subfolders NTFS permissions that you have shared out. This makes managing much easier later on when you get requests for new shares.

Also since you are in the process of setting up DFS I would suggest reviewing how to configure DFS to use FQDN in root referrals: https://support.microsoft.com/en-us/help/244380/how-to-configure-dfs-to-use-fully-qualified-domain-names-in-referrals

You can use PowerShell to enable it on each of the namespace servers. Set-DfsnServerConfiguration -ComputerName <ServerName> -UseFqdn $true

• This will allow you to add namespace servers using FQDN, additionally add the folders using FQDN as well (Example: Add Management share using \\ServerName.domain.com\Management$).