AD profile path problem

Posted on 2009-02-10
Last Modified: 2012-05-06
Scenario: W2K3 Ent Ed server with TS, AD and GPO. Each user has a profile path in AD of d:\profiles\company.  GPO limits the icons on the desktop and menu as well as access to the control panel, run and shutdown commands.

Problem: The user logs in and picks up a copy of the profile from the correct path and GPO appears to be working correctly, BUT only if the user is a member of the Administrators group.  If not, then the user picks up a default profile and GPO doesn't seem to apply any restrictions.

The d:\profiles directory has full access to all users.  We are moving this new server in the next couple of days and need to get this issue resolved soon.  The AD, GPO and profilespaths  are identical to the server we are migrating from which works fine but it's not Ent Ed.
Question by:dananorman
    LVL 5

    Expert Comment

    Check the permissions on the .dat or .man file.
    Not sure why GPO will not apply.
    LVL 3

    Expert Comment

    This is permission related issue
    First give "Everyone" read,write "share level permission to Ur profile share.Then when you updatethe profile path please use the below syntax
    If you add %username%,when the user logs in the new profille will be created and the logged in user will be the owner of that folder.


    Author Comment

    The .dat file has full control permission to everyone, domain users and users.  The profile path directory is not set up as a share and I am not creating individual directories for roaming profiles.  There are only 5 profile directories and each user picks up one of them depending on the company they work for.
    LVL 3

    Expert Comment

    then this is not roaming profile....bit confused of U have only one computer????????..roaming profile means the profile settings are stored n one central location and users will pullout it from that share..any way let me try to find a work around...change the ownership of the profile directories to corresponding can use subinacl to change the ownership
    refer for subinacl syntax

    Accepted Solution

    Sorry for the delay on this question.  I ended up calling (and paying for) Microsoft to troubleshoot the profile/GPO policy.  As it turns out, Group Policy Management had to be reinstalled, the default policy re-generated and then reapplied to the authenticated users.  Also, need to make sure the profile paths are populated by using the 'Copy to' button under System Properties\User Profiles in My Computer.  Be sure to set the correction group or user in the permissions before hitting the copy button!  Do no just copy the files from directory to directory.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Join & Write a Comment

    I've always wanted to allow a user to have a printer no matter where they login. The steps below will show you how to achieve just that. In this Article I'll show how to deploy printers automatically with group policy and then using security fil…
    I'm sure that every Windows systems administrator has written, or at least used, a batch or VBS login script at some point in their career, whether it is to map network drives, install printers, or set some user preferences.  No more! With Window…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
    This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now