Does taking ownership of profile prevent user from updating it?

[dany2010]

Hi,

 

We didnt make the GPO change to add administrators to the profile security so whenever we want to delete a profile we are going to have to take ownership.

 

This removes all users and only adds the administrator. Will this deny the user from being able to update their profile? We have alot of accounts to do this to and would like to do it on the parent folder.

 

Many thanks,

 

Dan

[Mcshammer_dj]

Make sure that the user is not logged on. then take ownership and add the admin account full control, the user full control and the system account full control. Finish off with transfering the ownership to the user and all should be fine

[AngryTechnician]

Yes. The user needs Full Control rights on their roaming profile directory. You will need to add these rights back if you seize ownership.

 

Under Vista/7 you will probably also find that without that GPO setting in place, the owner information and ACL is reset back to the default next time the user profile is updated. I seem to recall this wasn't the case in XP, but it has been nearly 5 years since I looked after an XP network so I can't quite remember!

[Mcshammer_dj]

found this when looking....

 

Roaming Profile - Add Administrators rights to profile folder without taking ownership

 

Taking the above ideas and combining them I placed the following into our users logon script to run once.

 

icacls \\servername\profiles$\%username% /grant administrators:(F) /T

 

As the user has full access to their own profile they can grant permission by using the above command. In this case the administrators group is given Full (F) Access and /T for subdirectories and files.

[john]

There is a GPO you can set to tell the system to ignore the owner of the Profile and just use it if they have rights to access it thus solving the owner issues for the roaming profile. I am on the road atm so cannot get to a server to look for the GPO but it exists and is a great one to just set to ignore the owner.

[dany2010]

Thanks for your answers. Have updated the gpo for new users and will soon get the other profiles sorted

[nicklec]

This confused me for far too long, thought someone else might find it useful:

 

You need to add the .v2 to the username manually as it seems icacls is only working with raw directories and not aware of 'windows' things such as this...

icacls \\servername\profiles$\%username%.v2 /grant administrators:(F) /T