Jump to content

Admin access denied to view roaming profiles

Guest lynnaungko

By Guest lynnaungko
in Windows 2003 Server

 Share

Recommended Posts

Guest lynnaungko

Guest lynnaungko

Posted
Posted

Hello All

 

I am a fairly new here, so if this topic has been posted here, I am so

sorry for that.

And I am a IT student so please bare with me question.

 

My question is

 

" How to access to the roaming profile as admin without access

denied?"

 

" How to grant the admin without taking ownership from the particular

profile folder ?? because afterwards that particular account can't not

log on anymore as roaming profile"

 

 

My server is MS 2003 server and client PC is xp pro.

 

"Profiles" folder is shared and full control for everyone.

 

When I log in from my client PC, each individual Profile folder is

created as logon name(secuser1) in "Profiles" according to the profile

path "\\lynnserver\profiles\secuser1" in the Profile property in User

Account.

 

 

Not working

Even after user logged out, still access denied for the admin to view.

 

I tried GPO, Computer Configuration, Admin Templates, Add Admin group

to roaming user profiles.

 

And also, Computer Configuration, Admin Templates, Do not check for

user ownership of Roaming Profile Folder - Not working as well

 

Last step, Take ownership from pecific profile folder, "secuser1" and

grant full control to the admin account - then - I can access the

profile and view all these folder in there such as favourite, local and

deskstop etc.

 

BUT that roaming account is somehow not working anymore when I attempt

to log on again and lead me to log on as local profile.

 

I did try with several user profile account such as secuser2,3,4 but no

luck whatsoever!

 

Please help me from this mess, I just want to get in those profile

without restrictions or any demage to the accounts for the back-up

purpose.

 

Thanks millions in advance

Reply With Quote

 

 

--

lynnaungko

------------------------------------------------------------------------

lynnaungko's Profile: http://forums.techarena.in/member.php?userid=35303

View this thread: http://forums.techarena.in/showthread.php?t=854543

 

http://forums.techarena.in

  • Replies 8
  • Created
  • Last Reply

Popular Days

Popular Days

Guest Pegasus \(MVP\)

Guest Pegasus \(MVP\)

Posted
Posted

Re: Admin access denied to view roaming profiles

 

 

"lynnaungko" <lynnaungko.307r3c@DoNotSpam.com> wrote in message

news:lynnaungko.307r3c@DoNotSpam.com...

>

> Hello All

>

> I am a fairly new here, so if this topic has been posted here, I am so

> sorry for that.

> And I am a IT student so please bare with me question.

>

> My question is

>

> " How to access to the roaming profile as admin without access

> denied?"

>

> " How to grant the admin without taking ownership from the particular

> profile folder ?? because afterwards that particular account can't not

> log on anymore as roaming profile"

>

>

> My server is MS 2003 server and client PC is xp pro.

>

> "Profiles" folder is shared and full control for everyone.

>

> When I log in from my client PC, each individual Profile folder is

> created as logon name(secuser1) in "Profiles" according to the profile

> path "\\lynnserver\profiles\secuser1" in the Profile property in User

> Account.

>

>

> Not working

> Even after user logged out, still access denied for the admin to view.

>

> I tried GPO, Computer Configuration, Admin Templates, Add Admin group

> to roaming user profiles.

>

> And also, Computer Configuration, Admin Templates, Do not check for

> user ownership of Roaming Profile Folder - Not working as well

>

> Last step, Take ownership from pecific profile folder, "secuser1" and

> grant full control to the admin account - then - I can access the

> profile and view all these folder in there such as favourite, local and

> deskstop etc.

>

> BUT that roaming account is somehow not working anymore when I attempt

> to log on again and lead me to log on as local profile.

>

> I did try with several user profile account such as secuser2,3,4 but no

> luck whatsoever!

>

> Please help me from this mess, I just want to get in those profile

> without restrictions or any demage to the accounts for the back-up

> purpose.

>

> Thanks millions in advance

> Reply With Quote

 

You will have to seize ownership of the shared folders, then

assign appropriate permissions so that the users can still

access them.

Guest lynnaungko

Guest lynnaungko

Posted
Posted

Re: Admin access denied to view roaming profiles

 

 

Thank you for your response, I appreciate it

 

I did try size the ownership and grant the permission for the admin and

relevant user account to access the profile files and log on to the

account respectively. But after I've done that, that user account could

not log on any more, the client computer attempt to log on by the local

account.

 

My main shared folder is called "Profiles" in which individual

profile-file (secuser1)is placed .

Grant share permission FULL to EVERYONE

NTFS permission FULL to Admin Group

FULL to secondgroup Group where these

secuser1 (user) has been placed.

 

But no luck whatsoever.

Please! Share your knowledge whatever you think might help this case.

Thank you ever so much!

 

 

--

lynnaungko

------------------------------------------------------------------------

lynnaungko's Profile: http://forums.techarena.in/member.php?userid=35303

View this thread: http://forums.techarena.in/showthread.php?t=854543

 

http://forums.techarena.in

Guest lynnaungko

Guest lynnaungko

Posted
Posted

Re: Admin access denied to view roaming profiles

 

> You will have to seize ownership of the shared folders, then

> assign appropriate permissions so that the users can still

> access them.

 

thanks you again! I did what you told me to and it worked!

 

I took the ownership as admin from the particular profile from

"secuser1" .

And grant the FULL permission to both "Admin" and "secuser1" account.

Admin could access evey files in that profile "secuser1".

Grant the ownership back to "secuser1" account again. Otherwise that

account wont log on again! Dont know why!

 

As I mentioned previously, I ve done these > GPO, Computer

Configuration, Admin Templates, Add Admin group to roaming user

profiles.

And also, Computer Configuration, Admin Templates, Do not check for

user ownership of Roaming Profile Folder

But still have to grant the ownership back to "secuser1" account. No

idea at all!!

 

 

And then I could sucessfully log in with that secuser1 account from my

client computer.

 

But I still wonder, if I have 100 accounts to view or backup or any

other reason, do i have to do exactly the same way for each one of the

100 accounts??

 

Please, share me if anyother easiest or pratical way to dealing this!

 

Thank you, for your help and interest in my case!

 

 

--

lynnaungko

------------------------------------------------------------------------

lynnaungko's Profile: http://forums.techarena.in/member.php?userid=35303

View this thread: http://forums.techarena.in/showthread.php?t=854543

 

http://forums.techarena.in

Guest Pegasus \(MVP\)

Guest Pegasus \(MVP\)

Posted
Posted

Re: Admin access denied to view roaming profiles

 

After seizing ownership, you have to grant full access rights

to the user who owns the folder.

 

 

"lynnaungko" <lynnaungko.308tzg@DoNotSpam.com> wrote in message

news:lynnaungko.308tzg@DoNotSpam.com...

>

> Thank you for your response, I appreciate it

>

> I did try size the ownership and grant the permission for the admin and

> relevant user account to access the profile files and log on to the

> account respectively. But after I've done that, that user account could

> not log on any more, the client computer attempt to log on by the local

> account.

>

> My main shared folder is called "Profiles" in which individual

> profile-file (secuser1)is placed .

> Grant share permission FULL to EVERYONE

> NTFS permission FULL to Admin Group

> FULL to secondgroup Group where these

> secuser1 (user) has been placed.

>

> But no luck whatsoever.

> Please! Share your knowledge whatever you think might help this case.

> Thank you ever so much!

>

>

> --

> lynnaungko

> ------------------------------------------------------------------------

> lynnaungko's Profile: http://forums.techarena.in/member.php?userid=35303

> View this thread: http://forums.techarena.in/showthread.php?t=854543

>

> http://forums.techarena.in

>

Guest Pegasus \(MVP\)

Guest Pegasus \(MVP\)

Posted
Posted

Re: Admin access denied to view roaming profiles

 

 

"lynnaungko" <lynnaungko.308zji@DoNotSpam.com> wrote in message

news:lynnaungko.308zji@DoNotSpam.com...

>

>> You will have to seize ownership of the shared folders, then

>> assign appropriate permissions so that the users can still

>> access them.

>

> thanks you again! I did what you told me to and it worked!

>

> I took the ownership as admin from the particular profile from

> "secuser1" .

> And grant the FULL permission to both "Admin" and "secuser1" account.

> Admin could access evey files in that profile "secuser1".

> Grant the ownership back to "secuser1" account again. Otherwise that

> account wont log on again! Dont know why!

>

> As I mentioned previously, I ve done these > GPO, Computer

> Configuration, Admin Templates, Add Admin group to roaming user

> profiles.

> And also, Computer Configuration, Admin Templates, Do not check for

> user ownership of Roaming Profile Folder

> But still have to grant the ownership back to "secuser1" account. No

> idea at all!!

>

>

> And then I could sucessfully log in with that secuser1 account from my

> client computer.

>

> But I still wonder, if I have 100 accounts to view or backup or any

> other reason, do i have to do exactly the same way for each one of the

> 100 accounts??

>

> Please, share me if anyother easiest or pratical way to dealing this!

>

> Thank you, for your help and interest in my case!

 

The standard way of setting user rights goes like this:

- Owner: Domain Admin

- Full access rights: Domain Admin, System, UserName

 

If you omit "Domain Admin" then you cannot manipulate the

user's files and folders.

 

If you omit "System" then your backup jobs cannot back up

the user's files and folders.

 

If you omit "UserName" then the user cannot access his own

files and folders.

 

If you need to change ownership and permissions for a large

number of accounts then you can do it with subinacl.exe or

fileacl.exe - see here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=723f64ea-34f0-4e6d-9a72-004d35de4e64&displaylang=en

 

It will take some practice in using these command and in

writing batch files to get them to work properly.

Guest lynnaungko

Guest lynnaungko

Posted
Posted

Re: Admin access denied to view roaming profiles

 

 

I worked on with fileacl.exe, and have done alright!

But it took time for few accounts to take ownership and grant

permissions and so on. Frustrated a bit with the wrong syntax but

finally it's ok.

 

I wonder why my GPO doesn't work?

I just Enabled on Computer Configuration, Admin Security Templates,

System, User Profiles, then Enable - Add Admin Group to Roaming User

Profile

 

As simple as sound, but why won't work? Could you direct me where to

learn sample procedure to set up that. Coz I might done wrong. What I

did was, select domain, go to properties, edit GPO!

 

Thanks in million

 

 

--

lynnaungko

------------------------------------------------------------------------

lynnaungko's Profile: http://forums.techarena.in/member.php?userid=35303

View this thread: http://forums.techarena.in/showthread.php?t=854543

 

http://forums.techarena.in

Guest Pegasus \(MVP\)

Guest Pegasus \(MVP\)

Posted
Posted

Re: Admin access denied to view roaming profiles

 

 

"lynnaungko" <lynnaungko.30aj3c@DoNotSpam.com> wrote in message

news:lynnaungko.30aj3c@DoNotSpam.com...

>

> I worked on with fileacl.exe, and have done alright!

> But it took time for few accounts to take ownership and grant

> permissions and so on. Frustrated a bit with the wrong syntax but

> finally it's ok.

>

> I wonder why my GPO doesn't work?

> I just Enabled on Computer Configuration, Admin Security Templates,

> System, User Profiles, then Enable - Add Admin Group to Roaming User

> Profile

>

> As simple as sound, but why won't work? Could you direct me where to

> learn sample procedure to set up that. Coz I might done wrong. What I

> did was, select domain, go to properties, edit GPO!

>

> Thanks in million

>

>

> --

> lynnaungko

 

Sorry, I am not suffiently experienced to advise you on this

subject with the required degree of authority. I recommend

you start a new thread under a suitable heading.

 Share
Go to topic listing
×
×
  • Create New...