Prev: Does the Domain SID linger after being removed from the domain?
Next: logoff script via command line
From: Chris Miller on 4 May 2010 16:41
Hi Folks,

I have a case where the same person is a member of two domains: DOMAIN\user
and LOCAL\user. I have modified the registry so the profile list for both
now identifies "C:\Documents and Settings\user" as the path and I have
modified the permissions on "C:\...\user" so the DOMAIN\user and LOCAL\user
have the same permissions.

DOMAIN\user is NOT a roaming profile user, but has been in the past and was
created before LOCAL\user. LOCAL\user is a local user on the machine, and
is the same person as DOMAIN\user and would like access to the same profile.

If DOMAIN\user logs in, everything is fine. If LOCAL\user logs in, he is
unable to undertake even trivial modifications to the profile -- such as
changing the folder view options, or unlocking the taskbar. I conclude that
this is a registry permissions problem but I can't find it and I'm not sure
how to look for it. Can anybody advise me?

Chris.



From: Shenan Stanley on 4 May 2010 16:47
Chris Miller wrote:
> I have a case where the same person is a member of two domains:
> DOMAIN\user and LOCAL\user. I have modified the registry so the
> profile list for both now identifies "C:\Documents and
> Settings\user" as the path and I have modified the permissions on
> "C:\...\user" so the DOMAIN\user and LOCAL\user have the same
> permissions.
> DOMAIN\user is NOT a roaming profile user, but has been in the past
> and was created before LOCAL\user. LOCAL\user is a local user on
> the machine, and is the same person as DOMAIN\user and would like
> access to the same profile.
> If DOMAIN\user logs in, everything is fine. If LOCAL\user logs in,
> he is unable to undertake even trivial modifications to the profile
> -- such as changing the folder view options, or unlocking the
> taskbar. I conclude that this is a registry permissions problem
> but I can't find it and I'm not sure how to look for it. Can
> anybody advise me?

Slightly overdone on the cross-post.

Creat a new profile, point both to it (permissions, etc all) and copy the
stuff you need from the old profile to it. Done.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


From: Chris Miller on 4 May 2010 17:28
> Chris Miller wrote:
>> I have a case where the same person is a member of two domains:
>> DOMAIN\user and LOCAL\user. I have modified the registry so the
>> profile list for both now identifies "C:\Documents and
>> Settings\user" as the path and I have modified the permissions on
>> "C:\...\user" so the DOMAIN\user and LOCAL\user have the same
>> permissions.
>> DOMAIN\user is NOT a roaming profile user, but has been in the past
>> and was created before LOCAL\user. LOCAL\user is a local user on
>> the machine, and is the same person as DOMAIN\user and would like
>> access to the same profile.
>> If DOMAIN\user logs in, everything is fine. If LOCAL\user logs in,
>> he is unable to undertake even trivial modifications to the profile
>> -- such as changing the folder view options, or unlocking the
>> taskbar. I conclude that this is a registry permissions problem
>> but I can't find it and I'm not sure how to look for it. Can
>> anybody advise me?
>
> Slightly overdone on the cross-post.
>

The beauty of cross-posing, is that you only have to see it once. It
probably won't happen again today. :-)



> Creat a new profile, point both to it (permissions, etc all) and copy the
> stuff you need from the old profile to it. Done.
>

I'm a little confused. No, I'm very confused. Create a new profile in
which domain? How do I "point both to it" -- I mean that what I did
already, right? "Copy the stuff you need from the old profile" -- O.K., I
get that part.

Thanks for the help,

Chris.


From: Shenan Stanley on 4 May 2010 22:15
Chris Miller wrote:
>> Chris Miller wrote:
>>> I have a case where the same person is a member of two domains:
>>> DOMAIN\user and LOCAL\user. I have modified the registry so the
>>> profile list for both now identifies "C:\Documents and
>>> Settings\user" as the path and I have modified the permissions on
>>> "C:\...\user" so the DOMAIN\user and LOCAL\user have the same
>>> permissions.
>>> DOMAIN\user is NOT a roaming profile user, but has been in the
>>> past and was created before LOCAL\user. LOCAL\user is a local
>>> user on the machine, and is the same person as DOMAIN\user and
>>> would like access to the same profile.
>>> If DOMAIN\user logs in, everything is fine. If LOCAL\user logs
>>> in, he is unable to undertake even trivial modifications to the
>>> profile -- such as changing the folder view options, or unlocking
>>> the taskbar. I conclude that this is a registry permissions
>>> problem but I can't find it and I'm not sure how to look for it. Can
>>> anybody advise me?
>>
>> Slightly overdone on the cross-post.
>>
>
> The beauty of cross-posing, is that you only have to see it once. It
> probably won't happen again today. :-)
>
>
>
>> Creat a new profile, point both to it (permissions, etc all) and
>> copy the stuff you need from the old profile to it. Done.
>>
>
> I'm a little confused. No, I'm very confused. Create a new
> profile in which domain? How do I "point both to it" -- I mean
> that what I did already, right? "Copy the stuff you need from the
> old profile" -- O.K., I get that part.
>
> Thanks for the help,


Create a new profile on the local machine.

Sign in as that local user.
Sign out.
Reboot.
Log in as an administrator - but none of the three accounts involved now
(Old Local, Old Domain and New Local.)
Make your registry changes under ProfileList and your Permission changes to
the two other profiles (Old Local and Old Domain) so they point to and have
full permissions over the new Profile Directory.
Log Out.
Log in as the Old Local user - to verify they load the new profile.
Log out.
Log in as the Old Domain user - to verify they load the new profile.
Log Out.
Reboot.
Log in as an administrator (none of the three involved accounts.)
Copy whatever you need from the two "Old" accounts to the new profile
directory. My Documents contents, Favorites, Desktop, Start Menu - etc. Do
not touch any NTUSER.* files, no Application Data directory stuff (unless
you have to worry about Outlook/Outlook Express stuff.

Essentially - you want a clean fresh profile (local) for the other two to
point to.

No more weird mixing. I'm not even sure which you pointed everything to
before (the old local or old domain account directory.)

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html


 | 
Pages: 1
Prev: Does the Domain SID linger after being removed from the domain?
Next: logoff script via command line