Roaming Profiles Problem

[Ambient]

Hi everyone

 

For quite some time now, i've had issues with roaming profiles. This could have all stemmed from when i moved the said profiles from one server to another.

 

Anyway, when i create a new user account for a teacher (as these are the only users which have roaming profiles), i create the path for the home folder, and also the profile path. When i log on as the said user, i get an error saying "Your profile (read only) is not available. You are logged on with the locally stored profile".

 

I thought this was down to permisisons...in that they were wrong. However, i've created a whole new structure for profiles (used for only testing), and at every level in the structure right down to the individual profiles its self...i've specified that the "Everyone" group has "Full Control".

 

Any ideas where to start on this one?

 

I've tried to add an image of the error message to this thread...which i hope will work.

 

Many thanks to anyone who can provide any ideas.

 

Aaron

[Ambient]

I should add at this point that the users in question have no issues what so ever saving work back to their home folders...which is odd...meaning that atleast some permissions are working as they should

[JAB1a]

not sure if this is relivent, but have you made sure you have a default user profile within your netlogon folder so the PC knows what structure you want for the profiles. Might help but not sure.

 

Make sure in the profiles field within the AD for the users is using unc path and not a mapped drive (i.e \\fileserver\profiles$\JBlogs and not x:\profiles\jblogs) and that the user have read/write access to the profiles folder. Via a GPO you can set the owner of the profile to have exculsive rights aswell.

 

Also I would delete all local profiles from the workstation you are trying except your administrators one then restart and try and logon with the new user.

[Ambient]

not sure if this is relivent, but have you made sure you have a default user profile within your netlogon folder so the PC knows what structure you want for the profiles. Might help but not sure.

 

Ah, i dont have a profile in the Netlogon folder...but i'll give it a go. What would i call the folder?

[itwasntme]

Ah, i dont have a profile in the Netlogon folder...but i'll give it a go. What would i call the folder?

Just 'Default User'

i.e.

\\domain\netlogon\Default User

 

Build the profile up on a workstation and copy it over

[Ambient]

Yeah i've just tied that, and the issue remains I'm going to stay here late tonight to try and crack this one.

[itwasntme]

Yeah i've just tied that, and the issue remains I'm going to stay here late tonight to try and crack this one.

 

As a thought, you aren't doing something a little silly, like pointing to an admin share like d$ or something right? Your user's profile folder is like \\server\profiles$\students\2009\name.of.student ?

[prad]

Check the permissions again:

 

Correct permissions for roaming profiles directory

[Ambient]

As a thought, you aren't doing something a little silly, like pointing to an admin share like d$ or something right? Your user's profile folder is like \\server\profiles$\students\2009\name.of.student ?

 

Yeah its a full UNC

 

I've only just noticed that there are a number of realted threads about this issue on this forum...and most if not all of them appear to be exactly the same issue as mine. So, i'm going to look through these too

 

Keep the ideas coming though guys

[itwasntme]

Sorry aaron, the importance was that it was not pointing to a share such as d$, e$ which are created usually just as administrative shares, check the full unc path - what is your profile path?

[Spitfire]

does not the "everyone" group only get permissions to the root, to go further to folders and sub folders you need to have domain users or something like that added to the the security permissions

[Ambient]

Sorry aaron, the importance was that it was not pointing to a share such as d$, e$ which are created usually just as administrative shares, check the full unc path - what is your profile path?

 

The profile path of a user i'm testing with is "\cooperdata\cooper-users\hc_staff\ProTest\Profile"

[Ambient]

I should point out at this stage that all current users work fine...but when i try to make new ones, i get this error.

[prad]

I should point out at this stage that all current users work fine...but when i try to make new ones, i get this error.

 

Really does sound like the users don't have 'Create Folders/Append Data' permissions on the root folder

[Ambient]

Really does sound like the users don't have 'Create Folders/Append Data' permissions on the root folder

 

I'll check that permission...as i think you're right. However, the users have no issue with creating folders in their home folders manually (because if they couldnt, the school would go into meltdown)

Edited May 25, 2010 by aaronjwilkinson

[prad]

I'll check that permissions...as i think you're right. However, the users have no issue with creating folders in their home folders manually (because if they couldnt, the school would go into meltdown)

 

That's because when you create the user, Active Directory User and Computers creates the home folder and sets the permissions explicitly. However it never does this for the profiles folder.

[Ambient]

That's because when you create the user, Active Directory User and Computers creates the home folder and sets the permissions explicitly. However it never does this for the profiles folder.

 

Thats an interesting point...and it was going to be my next question.

 

So when i make the home folder for the user, the path to it is "\\cooperdata\cooper-users\hc_staff\username" (i didnt pick that path, it was the guy before me...and i dont like it)

 

Then, when i make the profile path, its \\cooperdata\cooper-users\hc_staff\username\Profile". The only difference in this path of couse it the folder called "profile"...where the roaming profile should be stored. Now, should i then go into the newly created home folder by AD and manually create the "Profile" folder? or should it be made when the user logs on for the first time?

[Ambient]

its permissions...it has to be.

 

I've come home from work tonight and re-created the scenario on my domain (also 2003 and XP...just like at work) and its worked fine. However, the permissions on my home domain aren't as locked down etc...so i now need to figure out exactly where abouts in the file structure that the problem is.

[ajbritton]

Wrote this a while ago now. IIRC, Microsoft suggest setting permissions on roaming profile root such that end users create their own roaming profiles. In this way, individual users become the 'owners' of their profiles.

[Ambient]

Interesting update:

 

I was working on it all last night until about 11:30, and then i got into work at 7:30 this morning and picked it up where i left off. I still haven't got any further (and thats after changing LOADS of permission settings and even going as far as creating a complete new folder structure)

 

Now, just this morning, i've added a profile path to the domain administrator account (its actually a copy of the "Administrator" account called "Siteadmin"), logged on, and i've got the same seemingly permissinos error????

 

I think this issue could well be a tad more then just regular permissions. I think there's something silly that i'm forgetting to do

Edited May 26, 2010 by aaronjwilkinson

[prad]

Thats an interesting point...and it was going to be my next question.

 

So when i make the home folder for the user, the path to it is "\\cooperdata\cooper-users\hc_staff\username" (i didnt pick that path, it was the guy before me...and i dont like it)

 

Then, when i make the profile path, its \\cooperdata\cooper-users\hc_staff\username\Profile". The only difference in this path of couse it the folder called "profile"...where the roaming profile should be stored. Now, should i then go into the newly created home folder by AD and manually create the "Profile" folder? or should it be made when the user logs on for the first time?

 

Morning. The roaming profile directory is created when the users logs on for the first time. This is why the user needs the create folder permission on the root folder. But considering the roaming profile folder is under the home folder (not good practice btw; I know you mentioned it was the previous guy) the premissions should be okay.

 

Have you tried creating a seperate share and setting the permission how i mentioned in my previous post and pointed the users roaming profile to the new share?

[prad]

Interesting update:

 

I was working on it all last night until about 11:30, and then i got into work at 7:30 this morning and picked it up where i left off. I still haven't got any further (and thats after changing LOADS of permission settings and even going as far as creating a complete new folder structure)

 

Now, just this morning, i've added a profile path to the domain administrator account (its actually a copy of the "Administrator" account called "Siteadmin"), logged on, and i've got the same seemingly permissinos error????

 

I think this issue could well be a tad more then just regular permissions. I think there's something silly that i'm forgetting to do

 

Sorry, just seen this. Have you checked share permissions? (rather than regular permissions) when you create a share in windows 2003 and above, the 'Everyone' group only has read access by default.

[Ambient]

Aye, Everyone has "Full Control", and has done since pretty much the start of this issue I wish it was as simple as that.

[Ambient]

Have you tried creating a seperate share and setting the permission how i mentioned in my previous post and pointed the users roaming profile to the new share?

 

I've sort of tried this yeah...but making a totally new folder structure using the permissions stated by yourself and other. However, when i did this, i made the home folder the same too. So, what i think i'll do now is create a new share, and use it just for profiles...and i'll leave the home folder where they are at the moment.

 

I'll report back

 

Thanks for everyones help on this by the way.

[Ambient]

Nah, still no joy.

 

I think there is something seriously wrong here...and it goes beyond that of just NTFS and Share permissions. I've just created a folder called "Profiles" on the server and given the access you suggested...and i got the same error...and, i was using the administrator account to test with! :(