Migrated account needs admin access

[JonathanL]

I recently migrated some XP SP3 PCs from a workgroup to a 2003 domain. After
logging in to each PC with the newly created domain user account, then
rebooting, I logged in as me (domain admin) and copied the user's old local
profile over the new domain profile on each PC.

Upon logging in as the user after copying the profile, I found that some of
them had messed up desktops. This consisted of the wallpaper not showing
(blank background was all there was), the theme looking like Windows 2000
with the theme not being changeable.

These users did not have local admin rights on the PCs before migrating nor
after. So I gave the local admin rights and lo and behold, now everything
loads up and looks right. Their wallpaper displays and the theme is the
standard XP blue theme.

This only happened with a few of them. I don't want them to have local admin
rights but if I remove that, then I don't know what all else will be messed
up for the users besides how their desktop looks.

Why would this happen and what can I do to fix it so I can put them back to
non-admin users? I've re-applied the security on the profiles so it's not
that they don't have access to the entire profile. This only happened with a
few users. The others acted normally without admin access.

 

[Shenan Stanley]

I recently migrated some XP SP3 PCs from a workgroup to a 2003
domain. After logging in to each PC with the newly created domain
user account, then rebooting, I logged in as me (domain admin) and
copied the user's old local profile over the new domain profile on
each PC.

Upon logging in as the user after copying the profile, I found that
some of them had messed up desktops. This consisted of the
wallpaper not showing (blank background was all there was), the
theme looking like Windows 2000 with the theme not being changeable.

These users did not have local admin rights on the PCs before
migrating nor after. So I gave the local admin rights and lo and
behold, now everything loads up and looks right. Their wallpaper
displays and the theme is the standard XP blue theme.

This only happened with a few of them. I don't want them to have
local admin rights but if I remove that, then I don't know what all
else will be messed up for the users besides how their desktop
looks.

Why would this happen and what can I do to fix it so I can put them
back to non-admin users? I've re-applied the security on the
profiles so it's not that they don't have access to the entire
profile. This only happened with a few users. The others acted
normally without admin access.

When you say, ", I logged in as me (domain admin) and copied the user's old
local profile over the new domain profile on each PC", do you mean that
literally - or did you use F.A.S.T. or the U.S.M.T.?

If literally - I'd say it is no surprise that failed.

 

[JonathanL]

I logged in as me, went to My Computer properties, Advanced tab, User
Profiles section, Settings, then selected the old local profile and said to
Copy To the new domain profile. This is an established, documented method for
migrating user profiles when migrating a PC from a workgroup to a domain. So
I don't know why you say you are not surprised it failed. Actually it didn't
fail. It's just that a couple of the accounts have to have local admin rights
in order to work properly. All of the other PCs and user accounts I migrated
did not experience this problem. The rest don't have local admin rights and
everything looks and works just fine after migration.

So there's something about these few accounts (or maybe the PC) that is
causing this and I'd like to know what it is and how to fix it.

 

[Shenan Stanley]

I logged in as me, went to My Computer properties, Advanced tab,
User Profiles section, Settings, then selected the old local
profile and said to Copy To the new domain profile. This is an
established, documented method for migrating user profiles when
migrating a PC from a workgroup to a domain. So I don't know why
you say you are not surprised it failed. Actually it didn't fail.
It's just that a couple of the accounts have to have local admin
rights in order to work properly. All of the other PCs and user
accounts I migrated did not experience this problem. The rest don't
have local admin rights and everything looks and works just fine
after migration.

So there's something about these few accounts (or maybe the PC)
that is causing this and I'd like to know what it is and how to fix
it.

My bad - I mistook what you were doing.

Same workstation, from workgroup to domain.

I think you would be better off (save yourself a lot of trouble) just
letting them use a new profile (default profile) and copy their "My
Documents", "Favorites" and "Desktop" over (as well as perhaps - if needed -
their emails.)

If that fails - then you have larger permission issues on said machine.

 

[JonathanL]

Unfortunately it's too late for that. They've been using their new account
for 2 weeks now. I don't want to put up with the complaints I'd get if I
tried that now. I guess I'm stuck unless someone comes up with a solution.

Jonathan

 

[Shenan Stanley]

Unfortunately it's too late for that. They've been using their new
account for 2 weeks now. I don't want to put up with the complaints
I'd get if I tried that now. I guess I'm stuck unless someone comes
up with a solution.

What specific things do you need the admin rights for - seldom is it
everything...?

 

[JonathanL]

As stated in my original post, if the user doesn't have local admin rights
when logging in with their new domain account, the background is blank (i.e.
their wallpaper won't load) and the theme (as seen on the taskbar/start menu)
looks like Windows 2000; and you can't change either of them. I didn't
investigate further after finding I couldn't modify anything seen on the
desktop.

Once I gave the domain account local admin rights, then their custom
wallpaper displayed and the theme (as evidenced on the taskbar/start menu)
was the standard XP blue theme.

The other odd part is that these people did not have local admin access when
their PC was in the workgroup. They were standard users which is why at first
I didn't give their domain accont admin access on the PC either.

 

[Shenan Stanley]

As stated in my original post, if the user doesn't have local admin
rights when logging in with their new domain account, the
background is blank (i.e. their wallpaper won't load) and the theme
(as seen on the taskbar/start menu) looks like Windows 2000; and
you can't change either of them. I didn't investigate further after
finding I couldn't modify anything seen on the desktop.

Once I gave the domain account local admin rights, then their custom
wallpaper displayed and the theme (as evidenced on the
taskbar/start menu) was the standard XP blue theme.

The other odd part is that these people did not have local admin
access when their PC was in the workgroup. They were standard users
which is why at first I didn't give their domain accont admin
access on the PC either.

Did you verify the path in the registry for their profile was pointing to
the proper directory (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\ProfileList\S-xxxxxxxx --> ProfileImagePath) and that
their domain account has full rights (file and folder permissions) to said
local profile directory?

Also check the "All Users" profile directory and give "Users" permissions to
that on these few computers.

Be sure you propogate the perms when you apply them (file & folder.)

 

[JonathanL]

Just checked the path in the registry and it's pointing to the proper
location. As for the permissions, as I stated earlier, I had re-applied
permissions to each domain profile on the PC to ensure that their account had
Full Control to all files and folders. I've done it again and will remove
their local admin access and see how their desktop looks the next time they
login.

As for the All Users profile folder, the Everyone and localPC\Users groups
have Read & Execute, List Folder Contents, and Read permissions for the
folder. Should it be different? I don't see why it would be.