win2k3 roaming profile directory sharing

[luna_s]

need to share the roaming profile directory so that admins can also admin
any profile (for backup purposes)
on win2k server you could just take ownership and there wouldbe no problems
in win2k3 as soon as you take ownership (as an admin) people can no longer
accesss their roaming profile with an access denied error
you cant share as user/admin with full permissions as you still get access
denied locally
anything i should know ?

mark

 

[David Fisher [MSFT]]

Hello Mark.

You are encountering a new security feature of Windows Server 2003. We now
check for exclusive ownership of the profiles by the user.

There is a policy setting that can allow the Administrator access to the
user's profile:
Computer Configuration\Administrative Templates\System\User Profiles\Add the
Administrators security group to roaming profiles

This setting will only affect new roaming profiles. If you want to modify
existing profiles, you can safely assume ownership as you have been and
grant the needed permissions if you also enable:
Computer Configuration\Administrative Templates\System\User Profiles\Do not
check for user ownership of Roaming Profile Folders

Best Regards,
David Fisher
Enterprise Platform Support