NTFS Permissions for the Roaming Profile Parent Folder in C#

Generation Data Matrix ECC200 in C# NTFS Permissions for the Roaming Profile Parent Folder

Creator/Owner Administrator Security group of users needing to put data on the share Everyone LocalSystem

Full Control Subfolders And Files Only None List Folder/Read Data, Create Folders/Append Data This Folder Only No Permissions Full Control This Folder, Subfolders, And Files

*This is true unless you set the Add The Administrator Security Group To The Roaming User Profile Share policy, in which case the Administrators group has Full Control (requires Windows 2000 SP2 or later versions).

As explained earlier in this chapter, when a user logs on to a Windows Vista or later computer for the first time, Windows tries to find a profile named Default User .v2 in the NETLOGON share on the domain controller authenticating the user . If Windows finds a profile named Default User .v2 in the NETLOGON share, this profile is copied to the user s computer to form the user s local profile on the computer . If Windows does not find a profile named Default User .v2 in NETLOGON, the Default profile under %SystemDrive%\Users on the user s computer is copied instead as the user s local profile . To create a default network profile, follow these steps:

1. 2.

Log on to any computer running Windows Vista and later versions using the Administrator account or any account that has administrative credentials . Configure the desktop settings, Start menu, and other aspects of your computer s environment as you want users who log on to Windows for the first time to experience them . Create an Unattend .xml file that contains the Microsoft-Windows-Shell-Setup\ CopyProfile parameter and set this parameter to True in the specialized configuration pass . At a command prompt, type the sysprep.exe /generalize /unattend:unattend.xml command . Running this command will copy any customizations you made to the default user profile and will delete the Administrator account .

Restart the computer and log on using the Administrator account . Click Start, rightclick Computer, select Properties, select Advanced System Settings, and then click Settings under User Profiles . The User Profiles dialog box opens . Select Default Profile from the list of profiles stored on the computer and click Copy To . The Copy To dialog box opens . Type \\domain_controller\NETlOgON\Default User.v2 in the Copy To dialog box . Click Change, type Everyone, and then click OK twice to copy the local user profile you previously configured to the NETLOGON share as the default network profile Default User v .2 . Type \\domain_controller\NETlOgON in the Quick Search box and press Enter to open the NETLOGON share on your domain controller in a Windows Explorer window . Verify that the profile has been copied .

You may already have a Default User profile in NETLOGON that you created previ-

6. 7. 8.

ously as a default network profile for users of computers running Windows Xp or earlier versions. This network profile is not compatible with Windows Vista and later versions. See the section titled Considerations for Mixed Environments earlier in this chapter for more information.

After you have created a PROFILES share and configured it with suitable permissions on a file server, you can configure new user accounts to use roaming user profiles . To do this, follow these steps:

Log on to a domain controller as a member of the Domain Admins group (or any administrator workstation running an earlier version of Windows on which adminpak .msi has been installed) . Open Active Directory Users And Computers and select the OU containing the new user accounts for which you want to enable roaming . Select each user account in the OU that you want to configure . For each account, rightclick it and select Properties . Click the Profile tab, select the check box labeled Profile Path, type \\profile_server \Profiles\%username% in the Profile Path text box, and then click OK .

2. 3. 4.

The selected new user accounts are now ready to use roaming profiles . To complete this procedure, have each user log on to a Windows Vista and later computer using her user credentials . When the user logs on to Windows Vista and later versions for the first time, the Default User .v2 profile is copied from NETLOGON to the user s local profile and then copied as user_name .v2 to the PROFILES share on the profile server . For example, a user named Jacky Chen (jchen@contoso .com) who logs on to a Windows Vista and later computer for the first time will receive the roaming user profile \\profile_server\Profiles\jchen .v2 . The .v2 suffix identifies this profile as compatible only with Windows Vista or later versions .