Solved

Roaming Profiles with Kerberos Login and domain accounts

Posted on 2004-09-14
3
351 Views
Last Modified: 2012-05-05
Hello,

We have a computing lab here that we are trying to integrate with Active
Directory and Kerberos logins.  Currently we have the following setup:

We are trying to set up a lab with mandatory profiles (read-only roaming
profiles), where the users log into the windows machines using their Kerberos
accounts.
However, we have found that when a user logs in directly to our domain -
they get the roaming profile.  But, when we use the Kerberos realm, the user
can log in, but does not use the roaming profile.

We have created a required Mandatory profile (roaming profile that is read
only) that all user profiles must use when logging on to our lab machines.
We have a one-to-one mapping from the Kerberos account to a corresponding
domain account – which we create programmatically using ASP.NET/C#.

This works fine if the user chooses our domain when logging in with the
Active Directory account.

However, as soon as we change the user to log into the Kerberos Realm
(domain) then the account no longer uses the mandatory profile specified in
the profilePath of the Active Directory account.  (Note the only change is
the domain drop down on the login screen of the lab machine – no changes at
all to the account in Active Directory).

Does anyone have ideas on how to get the account to use the mandatory
profile while choosing the Kerberos Realm for authentication?

Thank you for any comments you may have.
0
Comment
Question by:mrichmon
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 35

Author Comment

by:mrichmon
ID: 12067184
The solution :

Set this GPO on your AD:
Computer Configuration-->Administrative Templates-->System-->Group Policy Allow Cross-Forest User Policy and Roaming User Profiles - Enabled
0
 

Accepted Solution

by:
ee_ai_construct earned 0 total points
ID: 12068294
Please read entire thread.  Asker solved or content important.
Closed, 500 points refunded.
ee_ai_construct (replacement part #xm34)
Community Support Moderator
0
 
LVL 21

Expert Comment

by:pinaldave
ID: 12074894
hello,
Clifford Neuman is most authentic person at the moment to address the issues of Kerberos. If you need more help in future you can also contact him through this web page...
http://www.isi.edu/people/bcn/ . You can find his email address on that page.
I am happy that I was able to study under him.
Regards,
---Pinal
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Sometimes clients can lose connectivity with the Lotus Notes Domino Server, but there's not always an obvious answer as to why it happens.   Read this article to follow one of the first experiences I had with Lotus Notes on a client's machine, my…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question