Roaming Profiles RDS 2008R2 permissions issue
Hi,
We have 2x Win 2008 R2 servers running the RDS role that our users log into daily. We have set up roaming profiles for RDS only. Recently I migrated all of our companies data from our old SAN to a new SAN using Robocopy. I had enabled the option to retain
NTFS permissions during the copy, but for some reason there was an issue with the profiles folder and the permissions were lost.
I've read articles on these forums on what the correct permissions should be and I have tried to apply them but every time a user logs on they get a balloon advising there was a problem with the user profile service and that a local copy of their profile
had been loaded.
It's the standard error in event viewer, as below. I have even gone as far as giving "Everyone" modify permissions on the entire profiles folder. It is also shared correctly and if a user logs in to the RDS session they can access and modify their profile
folder at \\filesvr\profiles$\username & username.V2. They are able to delete, update, save etc. However when they log on they are getting the error. Is there something I have missed?
Thanks in advance.
Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you log off. This error may be caused by network problems or insufficient
security rights.
DETAIL - Access is denied.
(Event ID 1521, Source User Profile Service)
June 19th, 2012 10:50pm
Give NTFS Permission for Everyone as Read / Write only and Check the status . Let me know if you have any issues .
Anoop
Free Windows Admin Tool Kit Click here and download it now
June 20th, 2012 3:40am
Hi Anoop,
I currently have the following NTFS permissions set on the entire profiles folder. (I also went and replaced all child object permissions with these):
Everyone - Modify
LOCALMACHINE\Administrator - Full control
CREATOR OWNER - Full control
SYSTEM - Full control
Domain Admins - Full control
I still have the same issue.
Regards,
Blake
June 20th, 2012 3:49am
Can you please uncheck the modify permission for Everyone.
step :
go >> properties >> security >> edit permission for everyone >> unckeck modify , check read , write only . Please try this and let me know the status .
Anoop
Free Windows Admin Tool Kit Click here and download it now
June 20th, 2012 3:58am
Hi,
I would like to confirm what is the current situation? If there is anything that I can do for you, please do not hesitate to let me know, and I will be happy to help.
Regards,
Clarence
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support,
contacttnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
June 25th, 2012 10:09pm
Hi Clarence,
Unfortunately I still have the same issue. I have attached a screenshot that shows everyone should have sufficient access to their profile. Every profile inside the folder inherits this exact same permission.
So technically every user should have access to every other users profile as it currently stands.
Do you have any other suggestions on how I can resolve this issue?
Thanks
http://i.imgur.com/JAb2r.jpg
Free Windows Admin Tool Kit Click here and download it now
June 26th, 2012 12:49am
Hi,
I think it is the NTFS permissions issue.The original profiles folder and the permissions were lost.You need to take it back with the precise advanced security setting.In your JPG,with the everyone permission is not an acceptable configuration.
Pls try the following:
1.right-click your profiles folder,share the folder with
everyone full control.
2.Then go to the Security tab,add users(domain\users), edit the advanced security settings for the
users(domain\users),add allow permissions for (Traverse folder/excute file, list folder/read data,read attributes,read extended attributes,createfiles/write data,create folder/append data,read permissions).
3.Inside the profiles folder,add the full control
permission for every user in the seucrity tab of the every created profile.(For example, add
full control permission for test1 user for the test1.domain.v2 folder)
4.test again.
regards,
Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
June 26th, 2012 6:27am
Hi,
I think it is the NTFS permissions issue.The original profiles folder and the permissions were lost.You need to take it back with the precise advanced security setting.In your JPG,with the everyone permission is not an acceptable configuration.
Pls try the following:
1.right-click your profiles folder,share the folder with
everyone full control.
2.Then go to the Security tab,add users(domain\users), edit the advanced security settings for the
users(domain\users),add allow permissions for (Traverse folder/excute file, list folder/read data,read attributes,read extended attributes,createfiles/write data,create folder/append data,read permissions).
3.Inside the profiles folder,add the full control
permission for every user in the seucrity tab of the every created profile.(For example, add
full control permission for test1 user for the test1.domain.v2 folder)
4.test again.
regards,
Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
June 26th, 2012 6:31am
What Clarence Zhang said plus make the user owner of the respective profile folder. See
http://technet.microsoft.com/en-us/library/cc737633(WS.10).aspx .
June 26th, 2012 7:15am
Thank you Clarence and C. Pfeiffer, that has resolved my issue - I tested it on 1 profile. Now I have another 70 to change!
Free Windows Admin Tool Kit Click here and download it now
June 27th, 2012 12:27am