Windows Forum

Ask something
Discussion Locked

Access permissions after domain change

0 helpful
2 replies

by teddyrux

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We just changed our AD Domain. Fortunately, it was mostly painless. The only major problem that we're having is that a few of the profiles don't have access to some programs, unless they're part of the administrator's group. For security reason, this is not acceptable. We've used moveuser.exe to move the profile. We've edited the registry and pointed a new profile to the old one. We also recreated a brand new profile, with the same problem. The user doesn't mave access to certain programs unless they have admin rights.
Any ideas?

2 replies

by beermonster

Hi,
Apps that run only as admins means a permissions problem, which is nothing to do with profiles. go to www.sysinternals.com and download regmon and filemon, these utils monitor file and registry access. log in as an admin, start regmon and filemon and use runas (type runas /? at the command prompt for usage) to start the programs as a normal user. the output of regmon and filemon will show you what areas the app is accessing, and will show an access denied message for any parts of the file system \ registry that the user needs to access but can't. Based on the results, you can open up specific areas of the system enough to allow the apps to run. Mail me at darthurs@hotmail.com if you need help with this.

An alternative is to apply the compatws security template using secedit (assuming you are running win2k or xp). This will revert the security on your machines to the less restrictive NT4 model and probably allow the apps to run, personally I would not favour this option as the tightened security was applied in win2k \ xp to (obviously)make the system more secure. Details on secedit and compatws can be found at microsoft.com/technet

remove any spaces in the urls shown above...

by mr_milo

Look at the ownership rights for the programs they are trying to access. Moveuser does not change ownership rights outside of the users profile after the move.

This discussion is closed to new replies.