Very weird logon problem with Mandatory Profiles.

[maniac]

This one has really got me. Normally I'm pretty good at figuring out problems like this, but I just can't work out what the hell is going on with this one.

 

We run a mandatory profile for all our students now, I've worked with them before and am quite familiar with the ins and outs of setting one up. I set it up weeks ago, and tested a handful of students with it on various machine, and it worked brilliantly, everything as it should be no worries.

 

Come to today, first ICT lesson of the day and I get called to the new Enterprise area which I was kind of expecting. If I hadn't been so busy I'd have been there anyway regardless, but I needed to get on with other jobs if I wasn't actually needed. Students were able to logon, but it was logging them on with a local profile, and half the settings wern't working properly. I watched a couple of students logon, and it wasn't even attempting to load the profile, it was skipping past the 'loading your settings' screen.

 

I've spent all afternoon on this one, and eventually narrowed it down to a specific set of circumstances. If the box for 'change password at logon' is ticked then the logon behaves in the way described above. If it is not ticked then the logon is normal and the profile behaves as it was designed to.

 

Why does it make any difference if the user changes their password at logon? It works fine this way for roaming profiles that staff use, so what's different about the students mandatory one? I've got 5-6 weeks to try and solve it (because I've unticked the box for forcing the password change for now, and the students will just have to change their password manually when they logon) but in 6 weeks time it will prompt all the students to change their password and if they do it at login, it will log them on incorrectly and cause all sorts of problems.

 

Can any help with this? I've never come across it before and I've googled and can't find anything like this mentioned anywhere - it's completely stumped me.

 

(Before anyone suggests it, all the permissions are correct I've double and triple checked this!)

 

 

Cheers,

 

Mike.

[DMcCoy]

When you try to log on to a Windows XP SP3-based computer by using a roaming profile, the roaming profile cannot load.

[oxide54]

2 things,

 

 

1 it might just go away! seriously i had a problem with kids getting logged on with the local profile instead of the mandatory one and it did just dissappear after a few days.

 

2. who is the OWNER of the profile on the server

[maniac]

When you try to log on to a Windows XP SP3-based computer by using a roaming profile, the roaming profile cannot load.

 

How the hell did you find that so quickly!

 

At least it's a known problem, I can fix it now

 

@Oxide54

It won't go away I don't think, it's very consistent when the change password at login option is ticked. For your information, the profile is owned by Administrator but AFAIK it makes no difference, as the students are only reading the profile and nothing else.

 

I think DMcCoy has hit the nail on the head.

Edited September 7, 2009 by maniac

[DMcCoy]

How the hell did you find that so quickly!

 

At least it's a known problem, I can fix it now

 

+1 rep for being so damn quick!

 

Everyone who went to SP3 last year noticed We just had to wait 8 month for the patch :|

[maniac]

Everyone who went to SP3 last year noticed We just had to wait 8 month for the patch :|

 

I've been running SP3 for ages thou, and I've never noticed this issue before, unless somehow I had the patch installed without my knowledge or I just didn't notice the problems.

[oxide54]

@Oxide54

It won't go away I don't think, it's very consistent when the change password at login option is ticked. For your information, the profile is owned by Administrator but AFAIK it makes no difference, as the students are only reading the profile and nothing else.

 

I think DMcCoy has hit the nail on the head.

 

 

Local or domain administrator makes a big difference.

[maniac]

Local or domain administrator makes a big difference.

 

The ownership is irrelevant. All ownership of files and folders dictates is who can control the NTFS security permissions on that file or folder. It's the NTFS permissions which control who has access to it. It's perfectally possible to have a folder that a user can't access, but that user can still be the owner of the object - being the owner does not dictate access rights.

 

Mike.

[oxide54]

The ownership is irrelevant. All ownership of files and folders dictates is who can control the NTFS security permissions on that file or folder. It's the NTFS permissions which control who has access to it. It's perfectally possible to have a folder that a user can't access, but that user can still be the owner of the object - being the owner does not dictate access rights.

 

Mike.

 

Mike

 

the ownership of mandatory profiles is not irrelevant, I have troubleshooted mandatory profile problems before where the user had permission to the profile and windows refused to load it saying that it could not log you with the roaming profile must use local etc.

 

in each case i set the owner to the local administrator of the server the profile was hosted on and they could then load their profile.

 

in an ideal world ownership should not dictate permissions, unfortunately this is windows and microsoft we are dealing with. and many a bug exist in their products producing strange behaviour such as this

[cookie_monster]

Can anyone confirm that they have tested this patch and it works? I've downloaded and installed on several PC's but the lsasrv.dll file is not updated and the flaw still exists. The patch does show as installed.

 

I manually changed the file from 5.1.2600.5834 to 5.1.2600.5827 and profiles still will not load if the user changes their password at logon, it does load 100% of the time otherwise.

 

http://www.buxton.derbyshire.sch.uk/grant/lsasrv.jpg