S2008 R2 with Windows 7 client logon errors

[talksr]

Hi there,

 

I am helping a school with a poorly configured server and would be grateful of any suggestions on what on earth could be the issue here....

 

We have one domain user account for a teacher, where ever she uses it she gets the following error:

"The group policy client failed the logon. Access denied."

 

Naturally, I have re-created her profile on the server, and this fixes the problem for one logon. As soon as she logs off, and re-logs in, same error again.

 

I have cleared local profiles on the main computer she uses, then reset the server profile, but makes no difference...same problem happens again.

 

If I set up a new domain connected computer, do the above again and log her in on there with a fresh profile on a fresh (never logged into before computer) again, works fine first time, as soon as she is logged off, same error.

 

It only seems to be happening to her. I have even tried deleting her from AD and then re-creating, but same problem. I am at the point of just giving her a local logon for her teaching computer until the school replace the server and get the new one properly configured.

 

Any ideas in the interim?

Server is running Ranger 7.0 -could understand if this was happening to all users, very odd it is just one and it is occurring on any network connected computer. Have tried all the usual things, AD user prof folder, mapped drives etc.

[Davit2005]

Clear both Server and Client profiles and make sure she is not logged on anywhere else.

 

Check their is no AppData in her home drive as well jus in case. Depending wether you are RM or Vanilla network I'd even be tempted to rename their home folder and then recreate a fresh one not copying anything back till they have logged in at 4 times and then be selective on what you put back i.e. no AppData or system created files i.e. Desktop.ini

 

We had same issue at last place whilst using Citrix and just cleared the users CTX Profile folder worked every time.

[mtillbrook]

if you have deleted and re-created her AD account, does she have a roaming profile or did you connect the new AD account to the same profile?

 

Either way, it defintely sounds like a profile problem.

[talksr]

What I noticed was that there was a yellow padlock on her profile folder. For some reason, her profile folder had totally different permissions to any other working user's. I have copied the permissions and so far, so good.

 

The server and client systems are all in a sorry state and need wiping and replacement. Just trying to patch it up to keep it running for the time being.