Roaming Profiles

Hi

I'm studying course 70-290 and I have a question, for creating roaming
profiles I did what the course said, which is creating hidden
shared folder and changing the profile field in the user properties to
\\servername\profiles$\%username% and it worked fine, the problem
that I got is when trying to make that profile mandatory, as administrator
on the server I couldn’t have access to the users folder to change
the .dat extension and if I take ownership then the user who I made his
profile roaming cant have access to his folder so how this problem
can be solved ?

Thank you
Note: i also enabled the GP to add administrators to roaming user profiles ???

In my experience making a profile mandatory it is for sharing with multiple
users. Therefore taking ownership and then granting read to a group and
that including multiple users within this group should provide what you
need.

I do remember there was an issue where a special hot fix had to be applied
since the administrator was granted access to the folder by default.
Unfortunately I can't find my notes on what patch was applied. I will
continue to look and if I find I will post it.

hi

the profiles folder was on the C drive, i removed it and made new one on D
drive, the administrator
already had access seems the group policy worked but maybe it didnt work
when the profiles share was on c

but now when i change the ntuser.dat to ntuser.man and i make the user log
off and login i notice that the extension goes back as ntuser.dat very
strange :)

Does the directory containing the roaming profiles need to be on a DC?
I need to move them off the bdc for maintenance and to a new permanent home.
Thanks

Actually I'd recommend against keeping them on a DC in majority of the
cases. Place them on any file server which is located on the same LAN as the
computers to which your users log on...

Ok. Not a DC, good I was hoping.
Now, this are live profiles, so the correct way to move them to a file
server and not kill the users.
Backup/restore?

I'd use robocopy from the resource kit -

robocopy <source>\ <destination>\ /e /sec /r:1 /w:1

....then share the destination parent folder, unshare the old source one. In
ADUC you can select all your users at once & right-click/properties - change
their profile paths to \\server\profileshare\%username%.

It depends how many profiles you have to move, if only a few manually copy
them when the users are logged out nd repoint the profile in AD. If you have
lots then the most reliable way is to perform a backup and restore, make sure
to restore the same permissions they already have and put them in a folder
with the same permissions they are currently stored in. Obviously do this out
of hours when the profiles are not in use. If you do have a lot of them
consider moving them a few at a time like a rollout so any errors minimize
impact.

I would be inclined to set up DFS and DFS replication, replicate the DFS
share to other server(s), change the profiles to point to the DFS-provided
share, and then deconfigure the DFS replica and share on the DC.

I also like to create my fileserver shares hidden when I intend to make them
available via DFS.

Hello,

Two questions if I may:

1. I have roaming profiles setup for a few users. There is one user in
particular that XP's profile properties says that his profile is 3.2 GB but
the contents of the users folder is only about 300 MB. Well when he logs in
it takes quite a long time. Is there a way I can figure out what is holding
it up? His My Documents folder is redirected so not to cause this problem.

2. If I export users from AD, rebuild the server's OS and them import the
users back into AD do the SIDs travel with the data? The reason I ask is I
have a lot of shares set up and I do not want to have to go back through and
reassign permissions...

Load up WinDirStat and run it against the machine. It is a piece of
freeware that will break down eveything visually. I'm guessing you will
find what is so large that is burning you. Just do a live.com search and
you should be good to go.

I don't think you are asking this correctly. If you have a DC and want to
rebuild it just bring up (Promote) a second dc and make sure to load dns and
make it a GC. Also point the dns clients to this new dns server.
Unfortunately I have a complete set of steps to follow but I am doing a
physical rebuild and my web server is down for now so I can't provide this
for you. But don't drop your dc promote a second and it will hiold all of
you metadata.

Hi
Remember that by default not everything in the user profile is saved in the
server share for that profile, for example, By default, the History, Local
Settings, Temp, and Temporary Internet Files folders are excluded from the
user's roaming profile. For example by default under local settings is where
the outlook pst is saved... And that file can get pretty big depending of
the version that you're using.

It's been my experience lots of different things can lead to slow logons.
I've had my best luck troubleshooting these issues by enabling user
environment debug logging then analyzing the resulting userenv.log.

To enable user environment debug logging to capture details of the logon
process follow the steps in this article -
http://support.microsoft.com/kb/221833.

Sysprosoft has a very useful tool that puts a friendly face on the jumble of
data in that log. Download it for free from here -
http://www.sysprosoft.com/policyreporter.shtml.

Hope this helps.

Well then I suggest you find one. Dig up an old workstation and buy a
second server license if you have too. If you lose this machine do to
hardware failure you lose your domain. It is HIGHLY recommended that all
domains, large or small, have at least two dc's in a domain