Windows 7 Roaming Profile Permissions

[loustarrrr]

There comes a time where roaming profiles need to be backed up, however, Windows 7 and Server 2008R2 does not allow you to access the roaming profile folder unless the user has specifically given access.

 

Here is a quick logon script I wrote to deal with this issue.

 

'This Script Sets the Permissions on Windows 7 Roaming Profiles so that we in ICTS can back them up
'It runs in user context 
'If something goes wrong....Seek Louis, he may know how to fix it. 
'Another thing.... you need to use ObjNetwork.Username to get the username 

On Error Resume Next

Set objNetwork = wscript.CreateObject("wscript.network")							'Allows the Script to Access Username
Set Command = Wscript.CreateObject("Wscript.Shell")  								'Allows the Script Access to the shell (CMD)
SetPerms = "icacls.exe \\atuin\louis\test\icaclcs_test /grant administrators:(F) /T"  				'File Path which Administrator needs permissions to should be Example: \\Servername\Profiles$\" & ObjNetwork.Username & "_profile.v2"
Dim objFSO 
Set objFSO = CreateObject("Scripting.FileSystemObject")								'Allows the script to create a file or folder
strPermsFldr = "\\atuin\louis\" & ObjNetwork.Username & "_profile.v2\appdata\Roaming\.PermsChk\"		'Where the folder will be stored to check permissions. Should be Example: \\Servername\Profiles$\" & ObjNetwork.Username & "_profile.v2\appdata\Roaming\.PermsChk\"


If objFSO.FolderExists(strPermsFldr) Then

'	MsgBox "The folder exists! The Journey Ends Here"										'Debugging Line, this can be commented out.

Else

'	MsgBox objNetwork.Username										'Debugging Line, this can be commented out.
'	MsgBox "The folder does not exist! Please wait a moment whilst it is created"				'Debugging Line, this can be commented out.
objFSO.CreateFolder strPermsFldr
'	MsgBox "Permissions Will now be set, this may take a while"						'Debugging Line, this can be commented out.
Command.Run (SetPerms)
'	Msgbox "Permissions Have Now Been Set"									'Debugging Line, this can be commented out.

End If

'Wscript.Echo "Permissions Successfully Set!"									'Debugging Line, this can be commented out.

 

This script should be saved as a VBS and the file paths should be set to match your network environment.

 

Hope this is of use to anybody.

 

Louis

[gshaw]

Does this still happen even if you a) set ACLs on the profile share to allow Administrator access and b) set the GPO that's meant to add Administrators to the profile folder security?

[glennda]

Personally I've always told users there profiles are not backed up. Do not save any data into your profile as you risk loosing it. It helps with logon's/logoffs etc

[SYNACK]

Personally I've always told users there profiles are not backed up. Do not save any data into your profile as you risk loosing it. It helps with logon's/logoffs etc

Depends on how thick and oblivious your users are.

[SYNACK]

Oh there is also a gpo to add the administrators group to the roaming profile folder that should fix the ops issue outright.

[glennda]

Depends on how thick and oblivious your users are.

 

The Words tough or you have lost it come to mind when that happens.

 

Alternativly you can run this as a batch file on the file server it will assign the correct permissions to the folders (you need to take ownership first).

 

for /d %%1 in (*) do echo y|cacls %%1 /t /g %%1:F administrators:f " "domain admins":f system:f "A N OTHER GROUP":f

[loustarrrr]

Yeah, this is the same that happened to me, we tend to back everything up, Roaming Profiles and Home Directories.

The group policy to allow administrators never resolved this, however, I decided to write a script that changes the permissions from the user it is running at, running this as a login script seemed to solve the problem