Failed to set Security on the Destination Profile.error-Access is denied.

OS is XP-Home
User has been using the default "user" called Owner even though they changed their username to FirstnameL.
I created new use called Temproary with full admin rights.  Logged on and then off as this new user.
Closed down machine and restarted.  Logged on as Admin.
Attempted to copy settings from "Owner" to newley-created username.  Make it most of the way through and then get the "Failed to set Security on the Destination Profile.error - Access is denied" message.

I feel like I've tried everything but am hoping one of you has a suggestion.
Please feel free to ask a question for clearification.

Thanks.
OregonJay
JayMulkeyAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sirbountyCommented:
Boot up into Safe mode and log in as the Admin.
Right-click the profile folder, and take ownership of it - applying the changes for all folders.
sirbountyCommented:
Fatal_ExceptionSystems EngineerCommented:
You might need to unhide all Hidden Folders and System Files...  Then take ownership, or configure the proper permissions on the Folder..

Also, how are you trying to copy the profile over?  Proper way is to use the User Settings from Advanced tab of the My Computer window...

http://www.petri.co.il/copy_user_profiles_in_windows_xp.htm

FE
Introduction to R

R is considered the predominant language for data scientist and statisticians. Learn how to use R for your own data science projects.

JayMulkeyAuthor Commented:
FE

I feel like we're getting closeer to the solution.  Here is a re-cap.  What am I missing?
Created new user called Temporary.  Loggfen on and then off as temporary.
I booted in safe mode.  Went to System Properties > User Profiles > Settings.  Highlighted the profile I wanted to copy (in this case "Owner").   Selected Copy To and browsed to:  C:\documents and settings\Temporary

Selected OK > OK > got the warning that Temporary already existed and did I want to continue.  I said Yes.

Got the same error message:  Failed to set Security on the Destination Profile.Error - Access is Denied.


I'd REALLY like to get this figured out.  Any help would be MOST appreciated.

OJ
Dmitri FarafontovLinux Systems AdminCommented:
Ok let me get this traight. There is a new user temprorary. Go to the properties of this folder C:\documents and settings\Temporary. On the Security Tab >> Advanced >> Make sure thats the group Administrators (Not administrator is present) >> Give Full Control >> Tick the Box Replace Permissions on Child Objects >> OK OK >>

Cheers
JayMulkeyAuthor Commented:
DeltaFire

I'm logged on as administrator in safe mode. Went to properties for the folder of Temporary. Administrators already had FULL CONTROL so I checked the box 'Replace Permissions on Child Objects" and ok-ed out.

Then went back to try again to copy the profile called Owner to the new profile called Temporary.  Got the same error message again. Under 'permitted to use' I even entered the new user profile local_machine\Temporary.

Any other ideas?

OJ
Dmitri FarafontovLinux Systems AdminCommented:
Thats strange, the only reason that is happening is because one user is not present on the ACL of the folder in question. How about this ACL Layout:

On the Temprorary:
Yourmachine\Administrators ~>>Full Control
Yourmachine\Temprorary ~>>Full Control
Yourmachine\SYSTEM ~>> Full Control

On the Owner:
Yourmachine\Administrators ~>>Full Control
Yourmachine\Owner ~>>Full Control
Yourmachine\SYSTEM ~>> Full Control

Make sure you Re-Tick Replace Child Permissions each time you OK out of the Security Tabs
Dmitri FarafontovLinux Systems AdminCommented:
Make sure you take ownership of both folders as an ADmin and Turn off Simple File sharing :)
Dmitri FarafontovLinux Systems AdminCommented:
Alternatively you can try [User State Migration in Windows XP]:
http://www.microsoft.com/technet/prodtechnol/winxppro/deploy/usermigr.mspx
JayMulkeyAuthor Commented:
DeltaFire

(I've included actual name of computer in case it helps solve problem)

Temporary:
Allow Administrators(WENDYP_01\Administrators) Full Control
Allow SYSTEM                                                    Full Control
Allow Temporary (WENDYP_01\Temporary)         Full Control

Owner:
Allow SYSTEM                                                    Full Control
Allow WendyP(WENDYP_01\Owner)                      Full Control

Then I added:
Allow Temporary(WENDYP_01\Temporary)           Full Control

but got error message when trying to leave with 'Replace permission entries ...' checked.  So I ok-ed out without that checked.

Another attempt to copy settings from profile Owner to profile Temporary returned original error message.


Not clear about your suggestion: "take ownership of both folders as ad Admin and turn off simple file sharing"

I'll look into the User State Migration idea.
(thought this would be simpler than it's turning out to be)   :(

OJ



Fatal_ExceptionSystems EngineerCommented:
Did you also Unhide all System Files and Folders, including Protected Operating System Files?  (two different ckboxes)
Dmitri FarafontovLinux Systems AdminCommented:
Owner:
Allow SYSTEM                                                    Full Control
Allow WendyP(WENDYP_01\Owner)                      Full Control

^It is missing an entry for Administrators Group (Not Administrator). The way Access Control Lists work, if you dont have an ACL entry on an object, you are not getting in period. What you need to do here, is add  Administrators group and give them full control. If you are unable to manipulate the ACL, you will need to take ownership of the whole folder. On the "Owner" folder (Security >> Advanced >> Owner >> Double Click Administrators Group >> Press OK >> OK). Than repeat my first sentence, and try again. Hope it will work :)

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Dmitri FarafontovLinux Systems AdminCommented:
Hey FE,

I think he has, since he pasted the entries from Security >> Advanced Tab

:)
JayMulkeyAuthor Commented:
I think we're getting closer.

I created a new entry ...
Allow   Administrators (WENDYP_01\Administrators)  Full Control
I checked "Replace permission entries on all child objects ..."
I selected OK >> Yes

Went back to System >> Advanced (tab) >> User Profiles: Settings >> highlighted WENDYP_01\Owner >> Copy To >> browsed to C:\Documents and Settings\Temporary >> OK >> OK >> Yes  got "User Environment" error message.  "Windows can not copy file ...or insufficient security rights..."

(at least it's a DIFFERENT error message.  That's progress, right?)   :)
Fatal_ExceptionSystems EngineerCommented:
I wonder if the System Security Account is the one causing all the problems..  But if you have placed your admin in every folder object, this still should not be a problem..  never seen anything like this before!
Dmitri FarafontovLinux Systems AdminCommented:
I think SYSTEM should be left on Full Control. You can always try taking ownership of the Owner Folder
http://support.microsoft.com/?id=308421
Fatal_ExceptionSystems EngineerCommented:
Absolutely, I never intended my comment to read that it shouldn't...  
Dmitri FarafontovLinux Systems AdminCommented:
Provided this is an ACL on both objects

On the Temprorary:
Yourmachine\Administrators ~>>Full Control
Yourmachine\Temprorary ~>>Full Control
Yourmachine\SYSTEM ~>> Full Control

On the Owner:
Yourmachine\Administrators ~>>Full Control
Yourmachine\Owner ~>>Full Control
Yourmachine\SYSTEM ~>> Full Control

I see absolutely no reason for it not working. I am pretty sure it is the way tha Owner account was originally setup in the store, where they messed up one of the ACLs. Taking ownership at this point would be my best bet.
Fatal_ExceptionSystems EngineerCommented:
Agreed!
JayMulkeyAuthor Commented:
DeltaFire & Fatal Exception

Good News!  After adding an entry in both folders, it finally worked.  Settings copied over completely and user is working fine.  You are the best!

Now, as a newbie here, I do not know how to assign points. Is there a "learn how to use EE" tutorial?

OregonJay
Dmitri FarafontovLinux Systems AdminCommented:
Cheers you got your ACLs to work :)
Fatal_ExceptionSystems EngineerCommented:
Very good!

and Thanks!

FE
JayMulkeyAuthor Commented:
DeltaFire and/or Fatal Exception

Please may I ask a favor?

I have several (18 to 20) computers on my network that are running XP-Home (just like the one you helped me with).  All are having trouble now accessing resources (printers, files, folders) on our domain - although a few weeks ago they did not!

My goal is this:  configure their machines to work on our network (allowing them Internet access, printing to network printers, access to programs on our Servers - basic network stuff).

I've been adding their UserName and password to Active Directory.  I'm just now adding their Computer name to the Computers Folder of A.D. too.

The problem is this:  often the UserName they have been using for a long time is not in line with our domain policy:  FirstnameL  or FirstnameLastname.  Many have been working as: Firstname Lastname (with a space).   So I have added a new user to their machines, following the domain policy, and attempted to copy over all the setting from their old profile to the new profile.

This used to work seamlessly.  Recently though I've been getting access denied errors starting with: settings on the destination folder have not been set properly.


Could you (would you) lay out the steps I should be using to easily create a new user and to migrate all the settings over from the old profile to the new (complete with the ownership issues)?

Thanks, in advance!

OJ

PS:  the following information may/may not be pertinant to the discussion but I'll add anyway.  It seems as though the "ceiling of acceptability", for wether you can participate on our network or not, has risen recently.  Users whose machines were not set up "properly" but who could still access all the resources in our domain, all-of-a-sudden were NOT permitted to do certain stuff (like print to a network printer through our print Server).  The user then has to logon with their Username and password before access is granted.  It's as though we updated our server with a new update from Microsoft that changed the level of security to a 'tighter' level.
Fatal_ExceptionSystems EngineerCommented:
Jay, since this question has been closed, we really need to open a new thread for this discussion.  This way, other experts can get a chance to join in, and the database is kept to one problem at a time.

When you do, post a link here and we will try to come in and help!

Thanks!

FE
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.