Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Domain Controller: BDC01 ( Storage Server: BrightonSAN1 ( Domain: brighton.local

Last night I moved our users home directories off of our Domain Controller onto a storage server using the MS FSMT. I'm getting a mixed bag of errors. The first being some users cannot logon properly, they can't access the logon.vbs in the sysvol folder on the DC and consequently cannot map their drives. I've narrowed that down to a DNS issue as we there was a remnant of our previous DNS server in the DHCP server options and scope options. I'm able to get their drives remapped by browsing to the sysvol folder by IP address as opposed to Computer Name and manually running the logon.vbs script.

The other error I'm getting is Access Denied on a few of the users home directories. The top level folder (Home) is shared as normal and I've removed and re-added the NTFS security a number of times now including making the user the owner with full control. I've checked each and every individual file and folder in said users home directory and they are indeed the owner but I'm unable to write but I can read the contents.

I'm stumped. This isn't happening to all clients. I'm considering removing their AD accounts, backing up their folders and readding them as a last resort but obviously I'd like to know why the above errors are happening.

share|improve this question

Presumably you have checked sharing permissions as well as ntfs security? The strictest of the two will take effect. Eg. Have you shared a homedirs folder to a domain group but some users are not members of that group? Also, do you have any deny permissions set on either of these as they can combine unintuatively?

share|improve this answer
Share Permissions: Authenticated Users - Full Control SYSTEM - Full Control – Shaun Murphy Feb 24 '10 at 12:19
and have you given authenticated users/everyone read or full access to the profiles folder itself in ntfs permissions as well as giving each user access to their own profile? – JamesRyan Feb 24 '10 at 13:02
Indeed. I've managed to get to a point whereby everyone is now working but tomorrow is another day. I'm going to remove and readd one of the troublesome accounts out of hours to see if that helps. Thanks for your suggestions, EK. – Shaun Murphy Feb 24 '10 at 14:01

I've made some headway with the read/write issue. I've gone into the advanced security of each user experiencing troubles and have unticked 'Include inheritable..' then selected the user, clicked edit and making sure they have full control I've then ticked 'Apply these permissions..' and then 'Replace all existing..'

This seems to have done the job.

As for the logon.vbs and IP / Computername issue, I'm still scratching my head.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.