WIN2k3: Roaming Profiles & Folder Redirection of Application Data

Hello everybody,

i've setup an AD for testing purposes and noticed some problems.

Server is WinServer2003EntEd and clients are WinXPPro. All with latest SP
and patches. Roaming Profiles are set (\\TEST\PROFILE$\%USERNAME%\).
Additionally Folder Redirection is set up for My Documents
(\\TEST\FILE$\%USERNAME%\) and Application Data
(\\TEST\PROFILE$\%USERNAME%\Anwendungsdaten\).

Everything works great except that most profiles lost all of their
Application Data after some days of use and that the directory Application
Data get synchronized by Offline Files (which is set off in GPO for everyone
and everything).
First i'd setup everything except Folder Redirection for AppData and used
the accounts to fill them with data. After a while i'd setup Folder
Redirection. The whole Application Data directory is like as it never was
existent before but with less data (eg. no Quick Launch directory and
shortcuts). Its like you deleted manually the content of the directory on
the server while the user is logged off and then logged in with the user
(some applications generate their appdata again if none were found bust most
like IE, etc. do this only on account creation/first login).


What did i wrong? Setting up Folder Redirection after the account was "in
use" or using the same directory previously used by Roaming Profiles or both
together?
I hope someone can help me since i need a solution at least on monday
morning (the productive AD has to be running then).

Thank you very much


Regards,
Ben

Ben,
The Special Folders (My Documents, Desktop, Application Data) are already in
the Roaming Profile. Folder redirection is to redirect them Out of the
profile and to a different location. The standard way to do this would be to
set \\Test\Profiles$\%username% as the profile folder, and to redirect
special folders to \\Test\Personal$\%username%\[Special Folder].
Hope that helps,
Anthony,
http://www.airdesk.com



"Ben Humpert" <ben-NOSPAM@an3k.de> wrote in message
news:7grsvnF2qvv0bU1@mid.individual.net...
> Hello everybody,
>
> i've setup an AD for testing purposes and noticed some problems.
>
> Server is WinServer2003EntEd and clients are WinXPPro. All with latest SP
> and patches. Roaming Profiles are set (\\TEST\PROFILE$\%USERNAME%\).
> Additionally Folder Redirection is set up for My Documents
> (\\TEST\FILE$\%USERNAME%\) and Application Data
> (\\TEST\PROFILE$\%USERNAME%\Anwendungsdaten\).
>
> Everything works great except that most profiles lost all of their
> Application Data after some days of use and that the directory Application
> Data get synchronized by Offline Files (which is set off in GPO for
> everyone and everything).
> First i'd setup everything except Folder Redirection for AppData and used
> the accounts to fill them with data. After a while i'd setup Folder
> Redirection. The whole Application Data directory is like as it never was
> existent before but with less data (eg. no Quick Launch directory and
> shortcuts). Its like you deleted manually the content of the directory on
> the server while the user is logged off and then logged in with the user
> (some applications generate their appdata again if none were found bust
> most like IE, etc. do this only on account creation/first login).
>
>
> What did i wrong? Setting up Folder Redirection after the account was "in
> use" or using the same directory previously used by Roaming Profiles or
> both together?
> I hope someone can help me since i need a solution at least on monday
> morning (the productive AD has to be running then).
>
> Thank you very much
>
>
> Regards,
> Ben
>

Anthony [MVP] wrote:
> Ben,
> The Special Folders (My Documents, Desktop, Application Data) are already
> in the Roaming Profile. Folder redirection is to redirect them Out of the
> profile and to a different location. The standard way to do this would be
> to set \\Test\Profiles$\%username% as the profile folder, and to redirect
> special folders to \\Test\Personal$\%username%\[Special Folder].
> Hope that helps,
> Anthony,
> http://www.airdesk.com

Right but i didn't found any information that said i have to redirect them
out of the profile to a different location, thus i used the profile
directory. Normally Windows should sync all folders in the roaming profile
path except the redirected directories.

So do you think that my problem occoured cause i redirected them into the
same directory in which they were previously saved? If so, why didn't the
problem occoured the first time an user logged in/off after setting up the
redirection but some days after? Thanks

Ben

Ben Humpert <ben-NOSPAM@an3k.de> wrote:
> Anthony [MVP] wrote:
>> Ben,
>> The Special Folders (My Documents, Desktop, Application Data) are
>> already in the Roaming Profile. Folder redirection is to redirect
>> them Out of the profile and to a different location. The standard
>> way to do this would be to set \\Test\Profiles$\%username% as the
>> profile folder, and to redirect special folders to
>> \\Test\Personal$\%username%\[Special Folder]. Hope that helps,
>> Anthony,
>> http://www.airdesk.com
>
> Right but i didn't found any information that said i have to redirect
> them out of the profile to a different location, thus i used the
> profile directory. Normally Windows should sync all folders in the
> roaming profile path except the redirected directories.
>
> So do you think that my problem occoured cause i redirected them into
> the same directory in which they were previously saved? If so, why
> didn't the problem occoured the first time an user logged in/off
> after setting up the redirection but some days after? Thanks
>
> Ben

You don't redirect to the profile folder. That would defeat the purpose,
which is to get this data *out* of the profile entirely.

You mention "sync" ...are you talking about offline files? That "feature" is
tangential to folder redirection. I do not enable it for desktop users -
only for laptops (via a special GPO linked only to the laptop computers OU).
That's another story entirely.

Below is my boilerplate on roaming profiles and folder redirection.

********************
General tips:

1. Set up a share on the server. For example - d:\profiles, shared as
profiles$ to make it hidden from browsing. Make sure this share is *not* set
to allow offline files/caching! (that's on by default - disable it)

2. Make sure the share permissions on profiles$ indicate everyone=full
control. Set the NTFS security to administrators, system, and users=full
control.

3. In the users' ADUC properties, specify \\server\profiles$\%username% in
the profiles field

4. Have each user log into the domain once - if this is an existing user
with a profile you wish to keep, have them log in at their usual
workstationand log out. The profile is now roaming.

5. If you want the administrators group to automatically have permissions to
the profiles folders, you'll need to make the appropriate change in group
policy. Look in computer configuration/administrative templates/system/user
profiles - there's an option to add administrators group to the roaming
profiles permissions. Do this *before* the users' roaming profile folders
are created - it isn't retroactive.

********************
Notes:

Make sure users understand that they should not log into multiple computers
at the same time when they have roaming profiles (unless you make the
profiles mandatory by renaming ntuser.dat to ntuser.man so they can't change
them, which has major disadvantages),. Explain that the 'last one out wins'
when it comes to uploading the final, changed copy of the profile. If you
want to restrict multiple simultaneous network logins, look at LimitLogon
(too much overhead for me), or this:
http://www.jsifaq.com/SF/Tips/Tip.aspx?id=8768

********************
Keep your profiles TINY. Via group policy, you should be redirecting My
Documents (at the very least) - to a subfolder of the user's home directory
or user folder. Also consider redirecting Desktop & Application Data
similarly..... so the user will end up with:

\\server\users\%username%\My Documents,
\\server\users\%username%\Desktop,
\\server\users\%username%\Application Data.

[Alternatively, just manually re-target My Documents to
\\server\users\%username% (this is not optimal, however!)]

You should use folder redirection even without roaming profiles, but it's
especially critical if you *are* using them.

If you aren't going to also redirect the desktop using policies, tell users
that they are not to store any files on the desktop or you will beat them
with a
stick. Big profile=slow login/logout, and possible profile corruption.

********************
Note that user profiles are not compatible between different OS versions,
even between W2k/XP. Keep all your computers. Keep your workstations as
identical as possible - meaning, OS version is the same, SP level is the
same, app load is (as much as possible) the same.

*********************
If you also have Terminal Services users, make sure you set up a different
TS profile path for them in their ADUC properties - e.g.,
\\server\tsprofiles$\%username%

********************
Do not let people store any data locally - all data belongs on the server.

********************
The User Profile Hive Cleanup Utility should be running on all your
computers. You can download it here:
http://www.microsoft.com/downloads/d...displaylang=en

********************
Roaming profile & folder redirection article -
http://www.windowsnetworking.com/art...rver-2003.html

Ben,
The aim of redirection is to move the folders out of the profile where they
normally sit, so it makes no sense to redirect them back into it.
The network profile synchronization ("roaming") is a different process from
the offline files synchronization. From XP onwards, redirected folders are
automatically added to the Offline Files synchronization process, although
you also have the option to exclude them
For the network location where profiles are stored you need to disable
Caching on the Share properties so that the profile folder does not
participate in the default Offline Files synchronization behavior
I can't speak for exactly what you experienced, but you will get erratic
behavior if you mix up the two different processes,
Hope that helps,
Anthony
http://www.airdesk.com



"Ben Humpert" <ben-NOSPAM@an3k.de> wrote in message
news:7gvvo2F2rqkkgU1@mid.individual.net...
> Anthony [MVP] wrote:
>> Ben,
>> The Special Folders (My Documents, Desktop, Application Data) are already
>> in the Roaming Profile. Folder redirection is to redirect them Out of the
>> profile and to a different location. The standard way to do this would be
>> to set \\Test\Profiles$\%username% as the profile folder, and to redirect
>> special folders to \\Test\Personal$\%username%\[Special Folder].
>> Hope that helps,
>> Anthony,
>> http://www.airdesk.com
>
> Right but i didn't found any information that said i have to redirect them
> out of the profile to a different location, thus i used the profile
> directory. Normally Windows should sync all folders in the roaming profile
> path except the redirected directories.
>
> So do you think that my problem occoured cause i redirected them into the
> same directory in which they were previously saved? If so, why didn't the
> problem occoured the first time an user logged in/off after setting up the
> redirection but some days after? Thanks
>
> Ben
>

Lanwench [MVP - Exchange] wrote:
> Ben Humpert <ben-NOSPAM@an3k.de> wrote:
>> Anthony [MVP] wrote:
>>> Ben,
>>> The Special Folders (My Documents, Desktop, Application Data) are
>>> already in the Roaming Profile. Folder redirection is to redirect
>>> them Out of the profile and to a different location. The standard
>>> way to do this would be to set \\Test\Profiles$\%username% as the
>>> profile folder, and to redirect special folders to
>>> \\Test\Personal$\%username%\[Special Folder]. Hope that helps,
>>> Anthony,
>>> http://www.airdesk.com
>>
>> Right but i didn't found any information that said i have to redirect
>> them out of the profile to a different location, thus i used the
>> profile directory. Normally Windows should sync all folders in the
>> roaming profile path except the redirected directories.
>>
>> So do you think that my problem occoured cause i redirected them into
>> the same directory in which they were previously saved? If so, why
>> didn't the problem occoured the first time an user logged in/off
>> after setting up the redirection but some days after? Thanks
>>
>> Ben
>
> You don't redirect to the profile folder. That would defeat the purpose,
> which is to get this data *out* of the profile entirely.

I did so to keep the user profile together. I thought Windows wouldn't copy
the whole content of the roaming profile directory
(\\SERVER\PROFILE$\%USERNAME%) to the client/back to the server if a client
logs in/logs out. Especially not if one of the directories in there is the
target of a Folder Redirection. However, Windows does not care and copies
everything in that directory.

Now i understand why the Application Data is lost for each profile. If an
user logs in, the whole content of the directory above is copied to the
client (including the directory Application data). Now there are two copies
for the whole profile (including AppData but except My Documents), one on
the server and one on the client. This is not a problem since the client is
using the local copy of the users profile but the server copy of the users
AppData (the local copy isn't touched cause of Folder Redirection). And this
is the problem!
If the user now logs off, the outdated local copy of the users AppData is
copied (synced, no offline files) to the current version of AppData stored
on the server. Normally Windows knows which files to keep/which version is
the most recent but i guess sometimes it forgets this and deletes
everything.
I've tested this some minutes ago, copied an empty something.txt to
%appdata% (stored on the server) and a something.txt filled with some data
to the local directory. Windows keeps the empty one if i log off. If i copy
a something_new.txt to the local directory, Windows will copy this one to
\\SERVER\PROFILE$\%USERNAME%\Application Data on logoff and back to the
client on login but the file is never used (only by the wrong developed
application which uses hardcoded path' instead of the %appdata% variable.

However its useless to redirect the AppData but let Windows copy it so i'll
change the path.

> You mention "sync" ...are you talking about offline files? That "feature"
> is tangential to folder redirection. I do not enable it for desktop
> users - only for laptops (via a special GPO linked only to the laptop
> computers OU). That's another story entirely.

Yeah, know the difference, just misused the word "sync". Roaming Profiles
are not really synced, they're just copied while offline files are synced.

> Below is my boilerplate on roaming profiles and folder redirection.

Thank you for the helpful and appreciated information and reply.

Ben Humpert <ben-NOSPAM@an3k.de> wrote:

<snip>

>> You don't redirect to the profile folder. That would defeat the
>> purpose, which is to get this data *out* of the profile entirely.
>
> I did so to keep the user profile together. I thought Windows
> wouldn't copy the whole content of the roaming profile directory
> (\\SERVER\PROFILE$\%USERNAME%) to the client/back to the server if a
> client logs in/logs out. Especially not if one of the directories in
> there is the target of a Folder Redirection.

Once the folder is redirected elsewhere, the rest of the stuff left in the
profile *does* get copied up / down properly. So yes, you need to use
redirection, as mentioned, and keep it in an entirely separate tree.

E.g.,

Users' profile paths: \\server\profiles$\%username%

User's my documents path: \\server\users$\%username%\My Documents
User's desktop path: \\server\users$\%username%\Desktop
User's Application Data path: \\server\users$\%username%\Application Data

> However, Windows does
> not care and copies everything in that directory.


>
> Now i understand why the Application Data is lost for each profile.
> If an user logs in, the whole content of the directory above is
> copied to the client (including the directory Application data). Now
> there are two copies for the whole profile (including AppData but
> except My Documents), one on the server and one on the client. This
> is not a problem since the client is using the local copy of the
> users profile but the server copy of the users AppData (the local
> copy isn't touched cause of Folder Redirection). And this is the
> problem!

Yup.

> If the user now logs off, the outdated local copy of the users
> AppData is copied (synced, no offline files)

No; it's copied/updated. No syncing. That word will confuse people in this
context :)

> to the current version
> of AppData stored on the server. Normally Windows knows which files
> to keep/which version is the most recent but i guess sometimes it
> forgets this and deletes everything.
> I've tested this some minutes ago, copied an empty something.txt to
> %appdata% (stored on the server) and a something.txt filled with some
> data to the local directory. Windows keeps the empty one if i log
> off. If i copy a something_new.txt to the local directory, Windows
> will copy this one to \\SERVER\PROFILE$\%USERNAME%\Application Data
> on logoff and back to the client on login but the file is never used
> (only by the wrong developed application which uses hardcoded path'
> instead of the %appdata% variable.
> However its useless to redirect the AppData but let Windows copy it
> so i'll change the path.

Yes indeedy :)
>
>> You mention "sync" ...are you talking about offline files? That
>> "feature" is tangential to folder redirection. I do not enable it
>> for desktop users - only for laptops (via a special GPO linked only
>> to the laptop computers OU). That's another story entirely.
>
> Yeah, know the difference, just misused the word "sync". Roaming
> Profiles are not really synced, they're just copied while offline
> files are synced.

You got it.
>
>> Below is my boilerplate on roaming profiles and folder redirection.
>
> Thank you for the helpful and appreciated information and reply.

You're very welcome. I work a lot with this stuff and have learned a lot of
tricks over the years. :)