Windows Forum

Ask something
Discussion Locked

COPYING PROFILE NIGHTMARE

0 helpful
13 replies

by tommymcbrayer

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have several hundred NT 4.0 workstations and a few 2000 workstations. Here is the problem. We are in a full swing migration from netware to win2k. :( All of my workstations have a local account example jdoe. I joined their pc to the domain andthen had the user login to the domain. I then logged them out and I logged back in with full rights to the pc and domain and used the copy profile under the my computer properties. I copied their old local profile to their new domain profile. Problem is that local programs and settings are messed up. The main one being their outlook express. You get the message no identities to manage. So I can't import into the new outlook client. The only thing I found that works is making the user a Domain Admin. Then all of their programs and settings work. I can setup their email and and everything is cool except that this is poor security and I can't do that. Someone please help.

13 replies

by shmaltz

Looks like a permissions issue (since when they have admin rights it works). Make sure that the users have:
1. Full Share permission to the share where the profiles are.
2. Full NTFS permissions to the root folder (not drive) where the profiles are located.
In addition to the above make sure:
1. The domain admins group has full permissions to the folder where the profiles are located.
2. The system user has full permissions to the profile folder.
3. The creater owner group has full permissions to the profile folder.

by tommymcbrayer

Well after many hours on the phone troubleshooting many issues with Microsloth with Exchange, DNS, FRS and permissions the underlying issue was that my AD was corrupt and they actually recomended, A disaster recovery action plan. Had to build a NT 4.0 BDC, promote upgrade, remove yadda yadda ya and rebuild everything and so on. Apparently the consultant firm that setup my original AD didn't do or forgot something. A simple migration in my opinion went to hell and a handbasket real quick. I accept the answer because yes it was a permissions issue. Since my AD was screwed there was more than one thing going on. I was just perplexed because what was suppossed to happen wasn't. Thanks for your help and reseting all the permissions didwork, after I rebuilt my entire AD.

by wim

check the above first, but try putting the domain user in the local admin group.

by jack republic

Sometimes after copying files/folders you need to do the reset permissions to downlevel files to enable inherit of permissions.make sure that the user have full control over his profile folder and the do the reset.

by beermonster

This is a cut and paste from an earlier answer I gave to someone in a similar position. It is my tried and tested method of trapping file \ registry permission issues in win2k, below I focus on regmon but filemon from the same site does the same thing for files : )

"Its usually the case that the user only requires rights to the particular keys that your app creates. The best method I have found is to download regmon from www.sysinternals.com, log in as admin (you have to be admin to run regmon) start regmon (preferably filtered to only look at your apps activity) then use runas to start the app as one of your users. You will see from the regmon gui what registry keys the app is trying to access and what it is being denied access to. These are the keys you need to open (for file access problems do the same thing with filemon). Personally, I have no great issue with opening out specific keys to the users. Mine are very locked down (IE no registry tools etc ) and, as I've said already, the key's I open up are only for that specific piece of software so theres VERY little damage they can do anyway. Now, how to open it up... If you are using GPO then your life is going to be very easy, edit the group policy for the ou that your machines are in (or move them from the computers container to their own OU if you haven't already), the setting is in computer settings, security, registry. Here you can select individual keys and apply security to them, which the pc's will pick up either straight away when rebooted, or after a period of time when they will do a background refresh (you can do the same thing for individual files or folders as well. If no GPO then it's a visit to the machines (to use regedt32) or an automated rollout - a login script won't work as that will run in the users context and fail.Good Luck !

by henrywi

as i can tell you didn't setup the user with any rights, you have to give them rights on the local account

by wburrows

Not sure if this will help but I know when you copy a profile there is a section called 'permitted to use'. The default is the account you are copying. You don't mention if you change this setting to the domain account but it may solve your problems if you are not doing this now.

by tommymcbrayer

Did that, change to doamin user account name and even set the permissions to the original local profile allowing the Domain account full permissions.

This discussion is closed to new replies.