Help needed in creating roaming Profiles in AD

[Steve]

Hi
I have set the user profiles in AD so that the users are
mapped with a home directory as well as a roaming profile. The roaming
profiles are mapped to a shared folder called Profiles on a member
server.

The Profiles folder share is called Profiles$ and has only the Domain
Users group with Change and Read share rights. The Domain Admin group
has Full share rights.

On the security tab of the Profiles share there is no inherit from
parent rights. The Domain Admin group has Full Control and the Domain
Users has all other rights but not Full control.

When I log in as a Domain user all seems OK.

But when I try to access the profile folder of a Domain user and as
Domain Administrator I get access denied even though the user has been
logged off.

I am trying to create a secure environment but I am unsure as to
whether this is due to rights or just a feature of Win2K as I would
like to enable access for Domain Admins to modify or even delete the
Domain Users profile in the event of problems which I was able to do
when using NT4.

Thanks

Steve

 

[Guest]

I think for your share permission of profiles$ you can retain it as Everyone
Full Control. For a specific user profile folder, you can set the NTFS
permission with that user Full Control. For admins, you can set all
permissions as Full Control as well.

BR,
Denis

 

[Lanwench [MVP - Exchange]]

Hi
I have set the user profiles in AD so that the users are
mapped with a home directory as well as a roaming profile. The roaming
profiles are mapped to a shared folder called Profiles on a member
server.

The Profiles folder share is called Profiles$ and has only the Domain
Users group with Change and Read share rights. The Domain Admin group
has Full share rights.

On the security tab of the Profiles share there is no inherit from
parent rights. The Domain Admin group has Full Control and the Domain
Users has all other rights but not Full control.

I always set up the parent profiles folder with domain users=full control as
well. Good that you're using a hidden share, BTW.

When I log in as a Domain user all seems OK.

But when I try to access the profile folder of a Domain user and as
Domain Administrator I get access denied even though the user has been
logged off.

Normal behavior - things have changed since NT4. See
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q268019&

I am trying to create a secure environment but I am unsure as to
whether this is due to rights or just a feature of Win2K as I would
like to enable access for Domain Admins to modify or even delete the
Domain Users profile in the event of problems which I was able to do
when using NT4.

You'll need to take ownership of the profiles folder/s as Administrators
(the *group*, not Administrator the user) and reset the NTFS permissions. Or
not. Up to you....depends whether you need full access to the users' profile
folders.