Access denied roaming profile folder

[Jackd]

When a certain user logs on i get a message saying

The roaming profile cannot be loaded
Cannot copy \\gossip\UserData\Profiles\Family\Joe\Cookies to C:\Documents and Settings\Joe\Cookies
Possible problems include network issues or access rights.

The problem appears to be access rights because on the server if i go to F:\Users\Profiles\Family\Joe\ i cannot see the cookies folder in the folder list (ive got hidden files enabled) but if i type into the address bar F:\Users\Profiles\Family\Joe\Cookies i get access denied, if i set the permissions on the folder F:\Users\Profiles\Family\Joe\ and make it apply to child objects and folders i just get another access denied message while trying to set permissions.

So how can i change the permissions to make this work again.

Thanks
Jack

[rhyds]

Have you tried taking ownership of the folder/subfolders to make the permissions changes? This is usual problem that comes up with me on my network.

[Jackd]

Ive tried taking ownership of the folder that the folder Cookies should be in then i get a error saying

Error while applying security permissions to F:\Users\Profiles\Family\Joe\Cookies
Access Is Denied

Ive also now tried using cacls.exe to change the permissions but still access denied im going to try rebooting the server and a linux boot disk if that doesnt work.

Any other suggestions to try?

Thanks
Jack Dunn

[Jackd]

Well ive managed to fix this by booting into a live linux cd mounting the partiton and then just navigating to the folder then deleting.

Does anyone know why it occured i hadnt even touched the permissions so i dont know what could of done it

Thanks
Jack

[Poohberry]

This tool has helped me out a ton. Use the setowner action then sometimes you have to play with it. One method after using setowner is to

right click on the folder > properties > security tab > advanced > owner tab > other users or groups > even if its there type administrator > check replace owner on subdirectories > ok out of it all

right click on the folder > properties > security tab > add whatever permissions you want > click advanced > replace permissions on child objects

SUBINACL

Display or modify Access Control Entries (ACEs) for file and folder Permissions, Ownership and Domain.

Access Control Lists apply only to files stored on an NTFS formatted drive, each ACL determines which users (or groups of users) can read or edit the file. When a new file is created it normally inherits ACL's from the folder where it was created.

Syntax
SUBINACL [/noverbose] /object_type object_name [/action=parameter] [/help]

Key
object_type: service e.g. /service Messenger \\ServerName\Messenger
keyreg e.g. /keyreg HKEY_CURRENT_USER\Software
/keyreg \\Srv\HKEY_LOCAL_MACHINE\KeyPath
file e.g. /file *.obj /file c:\test.txt
/file \\ServerName\Share\Path
subdirectories manipulate files in specified directory and all subdirectories

object_name : This will vary according to the object_type - see the examples above

action : setowner=owner
will change the owner of the object e.g. /setowner=MyDomain\Administrators

replace=SamName\OldAccount=DomainName\New_Account
will replace all ACE (Audit and Permissions) in the object
e.g. /replace=MyOldDomain\Finance=NEWDOM\Finance

changedomain=OldDomainName=NewDomainName
will replace all ACEs with a Sid from OldDomainName
with the equivalent Sid found in NewSamServer
e.g. /changedomain=MyOldDomain=NEWDOMAIN
This option requires a trust relationship with the server containing the object. Examples:

subinacl can do everything that cacls and xcacls can do and more besides.

List permissions to log file:
subinacl /noverbose /nostatistic /outputlog=my.log /subdirectories "C:\Program Files\My Folder" /display

Restore Permissions:
subinacl /nostatistic /playfile my.log

Change owner :
subinacl /file C:\demofile.doc /setowner=MYDOMAIN\BillG

Bugs

Running subinacl against a subfolder, as in the example above will affect just that folder and it's contents. However if you run subinacl against a folder in the root of the drive it will scan the entire drive for folders matching that name (which can take some time).
e.g.
subinacl /subdirectories "C:\Spud"
Will also match
C:\Program Files\Spud
C:\Documents and Settings\Spud etc