DonWilliams

Below are the commands that we use with Robocopy to move kids from year to year. We also run a fixpermissions powershell afterwords. C:\Users\admin.MCKEESPORT>robocopy \\masd-filesrvr\southhall\users\office\amendolar \\masd-filesrvr\foundershall\users\office\AmedolaR /E /ZB /DCOPY:T /COPYALL /R:1 /W:1 /V /TEE /LOG:Robocopy.log Hope this helps.

Try running this powershell script...usually corrects any issues with permissions. # Variables #Put quotes around homedrives directory and domain name. This will be your UNC path # Where is the root of the home drives? $homeDrivesDir= # Report only? ($false = fix problems) $reportMode = $false # Print all valid directories? $verbose = $false # What domain are your users in? $domainName = # ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? # Save the current working directory before we change it (purely for convenience) pushd . # Change to the location of the home drives set-location $homeDrivesDir # Warn the user if we will be fixing or just reporting on problems write-host "" if ($reportMode) { Write-Host "Report mode is on. Not fixing problems" } else { Write-Host "Report mode is off. Will fix problems" } write-host "" # Initialise a few counter variables. Only useful for multiple executions from the same session $goodPermissions = $unfixablePermissions = $fixedPermissions = $badPermissions = 0 $failedFolders = @() # For every folder in the $homeDrivesDir folder foreach($homeFolder in (Get-ChildItem $homeDrivesDir | Where {$_.psIsContainer -eq $true})) { # dump the current ACL in a variable $Acl = Get-Acl $homeFolder # create a permission mask in the form of DOMAIN\Username where Username=foldername # (adjust as necessary if your home folders are not exactly your usernames) $compareString = "*" + $domainName + "\" + $homeFolder.Name + " Allow FullControl*" # if the permission mask is in the ACL if ($Acl.AccessToString -like $compareString) { # everything's good, increment the counter and move on. if ($verbose) {Write-Host "Permissions are valid for" $homeFolder.Name -backgroundcolor green -foregroundcolor white} $goodPermissions += 1 } else { # Permissions are invalid, either fix or report # increment the number of permissions needing repair $badPermissions += 1 # if we're in report mode if ($reportMode -eq $true) { # reportmode is on, don't do anything Write-Host "Permissions not valid for" $homeFolder.Name -backgroundcolor red -foregroundcolor white } else { # reportmode is off, fix the permissions Write-Host "Setting permissions for" $homeFolder.Name -foregroundcolor white -backgroundcolor red # Add the user in format DOMAIN\Username $username = $domainName + "\" + $homeFolder.Name # Grant the user full control $accessLevel = "FullControl" # Should permissions be inherited from above? $inheritanceFlags = "ContainerInherit, ObjectInherit" # Should permissions propagate to below? $propagationFlags = "None" # Is this an Allow/Deny entry? $accessControlType = "Allow" try { # Create the Access Rule $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($username,$accessLevel,$inheritanceFlags,$propagationFlags,$accessControlType) # Attempt to apply the access rule to the ACL $Acl.SetAccessRule($accessRule) Set-Acl $homeFolder $Acl # if it hasn't errored out by now, increment the counter $fixedPermissions += 1 } catch { # It failed! # Increment the fail count $unfixablePermissions += 1 # and add the folder to the list of failed folders $failedFolders += $homeFolder } } #/if } #/if } #/foreach # Print out a summary Write-Host "" Write-Host $goodPermissions "valid permissions" Write-Host $badPermissions "permissions needing repair" if ($reportMode -eq $false) {Write-Host $fixedPermissions "permissions fixed"} if ($unfixablePermissions -gt 0) { Write-Host $unfixablePermissions "ACLs could not be repaired." foreach ($folder in $failedFolders) {Write-Host " -" $folder} } # Cleanup popd

I know this is an old thread, but my guess would be that your ISP has set timeouts on the logins for inactivity??

Check the group policy settings on the remote computer (the computer you're connecting to)! There's a remote session policy that controls whether or not the desktop background (wallpaper) is displayed when a client connects to the host. The name of this policy is "Enforce Removal of Remote Desktop Wallpaper". http://i.stack.imgur.com/MrYS7t.png Press Win+R Type gpedit.msc and press Enter. Click Yes if you get a prompt to allow the program. Navigate to Local Computer Policy, Computer Configuration, Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Session Host, Remote Session Environment. Right click on "Enforce Removal of Remote Desktop Wallpaper" and then click Edit. Change the setting to Disabled, or Not Configured. Click Apply and then OK. Now close the (Local Group Policy Editor) window. Done! You should now be able to see and change the desktop background on the remote computer, from the local computer. But you will still have to enable the option "Desktop background" in the RDP (remote desktop protocol) client (i.e. RDC on XP/Vista/7/8) when you connect to the remote. Only this time, the remote computer will not be preventing you to see and change the desktop background. To connect with desktop background enabled in RDC on XP/Vista/7/8 do the following. Press Win+R Type mstsc.exe and press Enter. Click on Options. Click on Experience tab and check the option Desktop background. Click on General tab. Provide your computer name or IP, your credentials and click on Connect.

We use Manage Engine's Active Directory Manager. Works quite well. You can create templates for user accounts etc. The reporting portion of it also does rather well, and if you need a custom report they can help you get that accomplished. Active Directory Managemement Tool; Effect Bulk Changes On Your Active Directory; Create and Modify Users in mass using CSV import via ADManager Plus's Web-Based Console.

Thank you for your replies. I probably should have done a google search for Skydrive migration instead of One Drive...since OneDrive is still somewhat new. Myles, do you recommend ADFS for SSO when it comes to Office 365? Or make the users continue to sign in? Thanks from across the pond... Don

Hi all, So, my boss met with Microsoft today in regards to our EES agreement and they told her that we are eligible for A2...(which I knew, since we are already using Lync for teachers.) Now, the next question out of her mouth was "Since the users have been created for Lync, can we move everyone's home directories to OneDrive?" Now, theoretically, I could ask the teachers to move everything for themselves, but that will cause chaos and mass confusion. Is anyone aware of a way to use powershell to move the folders from their share on premises to Onedrive? This has to be done seamlessly otherwise I am going to be buying a new SAN. Thanks in advance. Don

Are the computers getting the same policies at the computer level? What does gpresults show?

Did you make sure that in the user properties in AD that the user has Dial in permissions set to true? We just played around with a radius server here not even two weeks ago and we were having some of the same issues. I wish Microsoft would change some of the labels inside AD....we didn't even think to check Dial In....who "dials in" anymore?

Tell me about it. I am all for Windows 7 etc, but these carts were given as part of a grant so I am being forced to make them work.

Here goes nothing, Matt! Good thing there isn't school on Saturday. Thank you both for responding, I will keep this post open to post results. Don

They are separated from the rest of the network in their own vlan with no trunking. We have five of the netbook carts, with approximately 30 netbooks per cart that cannot print or even see the print server. I can't believe that I did not specify that yesterday or today for that matter. It has been a rough week.

Startup script for what? I already have my domain computers attached to printers via GPO. What I am asking is if I try to utilize IPP so the non-domain computers can see printers, will it affect my GPO deployed printers?

Hello from Pittsburgh! OK, so we have our print server running on our Windows 2008 R2 box, which seems to be running just fine. We currently use GPOs to control who can print to what etc. Now, we have "found" some old netbooks running XP Home which cannot be joined to the domain (and I am not going to reimage them as Windows 7.) My question is: If I enable Internet Printing Protocol on our print server, is there any chance that it will interfere with the GPO deployed printers? I have approximately 250 printers/copiers deployed via GPO. Thanks, Don

Have you tried running gpupdate /force ? Would it be possible that the original group policy is cached on the local machine? GP is a wild beast that we can only hope to tame.