J
Jérôme Tremblay
[GoogleBlog, It took me quite a while to solve this problem, here are the
results of my investigations.]
Scenario:
I created a new user, installed my applications and made sure everything was
working using UserA. I then copied this profile in another directory,
renamed NTUSER.DAT into NTUSER.MAN to make this the mandatory profile of
UserB.
Problem:
The profile was not applied to the user, event log recorded EventID 111 &
1085, and userenv.log contained the following:
USERENV(1e0.cc0) 13:09:09:606 ProcessGPOList: Entering for extension Folder
Redirection
USERENV(1e0.cc0) 13:09:09:606 LogExtSessionStatus: Successfully logged
Extension Session data
USERENV(1e0.cc0) 13:09:09:622 GetHkeyCU: RegOpenKey failed with error 5
USERENV(1e0.cc0) 13:09:09:622 CreateEnvironmentBlock: Failed to open
HKEY_CURRENT_USER, error = 5
USERENV(1e0.cc0) 13:09:09:622 ProcessGPOList: Extension Folder Redirection
returned 0xcb.
USERENV(1e0.cc0) 13:09:09:622 ProcessGPOList: Extension Folder Redirection
was able to log data. RsopStatus = 0x0, dwRet = 203, Clearing the dirty bit
USERENV(1e0.cc0) 13:09:09:622 ProcessGPOs: Extension Folder Redirection
ProcessGroupPolicy failed, status 0xcb.
Solution:
Error 5 is "Access Denied". Therefore, before copying UserA profile to
UserB, make sure you grant sufficient rights to HKEY_CURRENT_USER to UserB.
In my case, I granted Read/Write to "Domain Users".
Use the program "regedt32" to access registry permissions (it's not
available in regedit).
Note: Granting read-only access is not enough since folder redirection needs
write access to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User
Shell Folders
No write access to those keys results in EventID 106. Maybe granting Write
only to those two keys would be enough, but i had issues with other
installed software, so I decided to grant Read/Write to the whole thing from
HKCU. It is re-copied from the server every login anyway.
And that's it. I hope that this information will someday be useful to
someone.
Jérôme Tremblay
results of my investigations.]
Scenario:
I created a new user, installed my applications and made sure everything was
working using UserA. I then copied this profile in another directory,
renamed NTUSER.DAT into NTUSER.MAN to make this the mandatory profile of
UserB.
Problem:
The profile was not applied to the user, event log recorded EventID 111 &
1085, and userenv.log contained the following:
USERENV(1e0.cc0) 13:09:09:606 ProcessGPOList: Entering for extension Folder
Redirection
USERENV(1e0.cc0) 13:09:09:606 LogExtSessionStatus: Successfully logged
Extension Session data
USERENV(1e0.cc0) 13:09:09:622 GetHkeyCU: RegOpenKey failed with error 5
USERENV(1e0.cc0) 13:09:09:622 CreateEnvironmentBlock: Failed to open
HKEY_CURRENT_USER, error = 5
USERENV(1e0.cc0) 13:09:09:622 ProcessGPOList: Extension Folder Redirection
returned 0xcb.
USERENV(1e0.cc0) 13:09:09:622 ProcessGPOList: Extension Folder Redirection
was able to log data. RsopStatus = 0x0, dwRet = 203, Clearing the dirty bit
USERENV(1e0.cc0) 13:09:09:622 ProcessGPOs: Extension Folder Redirection
ProcessGroupPolicy failed, status 0xcb.
Solution:
Error 5 is "Access Denied". Therefore, before copying UserA profile to
UserB, make sure you grant sufficient rights to HKEY_CURRENT_USER to UserB.
In my case, I granted Read/Write to "Domain Users".
Use the program "regedt32" to access registry permissions (it's not
available in regedit).
Note: Granting read-only access is not enough since folder redirection needs
write access to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User
Shell Folders
No write access to those keys results in EventID 106. Maybe granting Write
only to those two keys would be enough, but i had issues with other
installed software, so I decided to grant Read/Write to the whole thing from
HKCU. It is re-copied from the server every login anyway.
And that's it. I hope that this information will someday be useful to
someone.
Jérôme Tremblay