Roaming Profile Security

[minion]

My office LAN has a single Windows 2003 Standard Server as PDC, with 5
workstations, all Windows XP Pro SP2.

Our main software application is hosted on the Server in a shared
folder. On each workstation, the application is started from a shortcut
directly to the main EXE file in this shared folder.

After a domain logon and using local profiles, the application starts
without any security warnings.

However, after changing to new roaming profiles, the application will
not start without the option to either "run" or "save" the EXE file.
Selecting "run" starts the application as normal.

The roaming profiles were created by first logging on locally to the
Server itself, so I imagine that this explains the higher security
level.

Of course this is only a small problem, but I would like to run this
application without the security warning. Could anyone advise me how to
achieve this?

Thanks

 

[Lanwench [MVP - Exchange]]

In

My office LAN has a single Windows 2003 Standard Server as PDC, with 5
workstations, all Windows XP Pro SP2.

Our main software application is hosted on the Server in a shared
folder. On each workstation, the application is started from a
shortcut directly to the main EXE file in this shared folder.

After a domain logon and using local profiles, the application starts
without any security warnings.

However, after changing to new roaming profiles, the application will
not start without the option to either "run" or "save" the EXE file.
Selecting "run" starts the application as normal.

The roaming profiles were created by first logging on locally to the
Server itself, so I imagine that this explains the higher security
level.

Actually, that might explain a *lot* of things - that's not the way to
create
roaming profiles. User accounts should never be able to log into a DC
directly! If they can, they are either members of groups they shouldn't be
in, or someone has mucked with the default policies....either way, that
needs to be addressed.

The way you create roaming profiles is to specify the profile path in the
users' ADUC settings - such as \\server\profiles$\%username%. Then, when the
user logs in, and logs out, he has a roaming profile - if there was a
locally cached profile already on that workstation, that's the profile they
get.

(unrelated note - make sure you've got folder redirection policies for My
Documents, at the very least - and keep the profiles *tiny*.)

Try a test with a new user account, created via this method, and see what
happens.