Microsoft Windows 2000
Server Administrator's Companion

by Sharon Crawford & Charlie Russel
copyright (c) 2000 by Microsoft Corporation
all rights reserved


Home
Articles
Utilities
Software

Electronic Book

Roaming Profiles - Desktop Settings Lost

Symptom:

The desktop settings are lost with a user's roaming profile.

Scenario:

There are two computers and two accounts involved.   One account is an Administrator account and another is a user account, each with the appropriate rights. Both accounts are to roam.

  1. A "\Roaming\Profiles" directory was created with sharing enabled on "Profiles".
  2. Both the user and administrator directories are created here.
  3. The user and "SYSTEM" have full control of the user directory.
  4. No other users or groups have access to these directories.
  5. On both machines, the user and administrator profiles point to the appropriate directories.
  6. Whenever the user account is accessed with "user" rights, the desktop setting changes are lost as soon as explorer is closed.
  7. Whenever the user account is accessed with "administrator" rights, the desktop setting changes remain in effect.
Problem Defined:

In this case, there are two users with two different identifying authorities; one workstation cannot resolve the GUID of a user from another workstation.  The reason it works if the accounts are administrators is because the permissions within the NTUSER.DAT file give the Administrators group full control, and that group, because it is built-in and well known, has the same RID on both workstations.

Possible Solutions:

  1. If both users are administrators, the Administrators group already has permissions on the profile and can use it.
  2.  

  3. If you don't want your regular user account to be an administrator, then you should grant "Everyone" full control over the profile.  Like Administrators, "Everyone" is built-in and well known, and also has the same SID from machine to machine.

    You can accomplish this by using the User Profiles tab in the My Computer > Properties dialog to copy your profile to your shared location, and modifying the permissions.  Specifically:

       

    1. Log on as the local Administrator on the desktop
    2. Secondary click My Computer, select Properties, and then select User Profiles
    3. Highlight the PBENDER profile and select Copy
    4. Enter the destination directory, and change the Permitted to Use to "Everyone"
    5. Select OK
Once you've done this, both accounts on the workstations should be able to use the profile.