win2k roaming profiles

Created new profile for some win2k (upgrade from nt)user who needed to use digital certs, this would not work with mandatory profiles for some reason as idividual users could not import the cert. I got a round this by turning the ntuser.man into ntuser.dat, which is almost a roaming profile except for the fact that the users do not have write access to the profile which is located in the netlogon of out nt pdc.

Anybody any idea why this may be happioning?