Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Background

  • We have a Server 2008 R2/Win7 domain.
  • We have teachers and students using Windows 7 workstations, deployed via SCCM.
  • Students all refer to a shared profile (\\dfsroot\\profiles\student, containing ntuser.dat and all other files and directories set with permissions and ownership set to allow all students access).
  • We are using roaming profiles.
  • Offline files are disabled.

Problem

We have found a subset of our students are unable to login to Windows 7 workstations, with the error "Group Policy Client failed the login: Access is denied". This ceases if the workstation is moved to a different organisational unit with less policy applied, but this also messes around with targeting for printers and other such preferences. As far as we can tell by doing group policy modelling, there are essentially no group policy differences between a student account that can always login, and a student account that will always fail.

We've checked permissions over and over again, but it seems odd to me that only a subset would be deterministically affected if permissions were in fact wrong.

Teachers and other non-student accounts have no problems at all, but they also have one profile per account.

I'm really at a bit of a loss as to what to do next. Any ideas?

share|improve this question
    
You have many users sharing a profile, you have that setup as a mandatory profile right? If not, then it seems like you have recipe for a big mess. –  Zoredache Jan 27 '12 at 7:16
    
@Zoredache: yes, it's a mandatory profile. –  Matthew Iselin Jan 27 '12 at 7:28
    
Do you have any XP boxes at all? Using the same profile on 7 and XP can cause problems. Also to be clear, some users can logon fine and some can't to the same workstation? Can a user that normally fails login successfully immediately following a reboot? If so, perhaps a previous logoff from another user isn't unloading the registry completely. –  Paul Ackerman Jan 27 '12 at 19:34
    
@PaulAckerman - we do have XP boxes (in the process of upgrading them all to Win7). And that is correct, a particular and consistent set of accounts cannot login properly, but all other accounts can. A reboot does not resolve this unfortunately. –  Matthew Iselin Jan 28 '12 at 12:54

1 Answer 1

up vote 1 down vote accepted

We have found the problem was in the permissions of the registry hive itself in ntuser.man. So whilst the permissions were correct on the file itself, the registry could not be loaded by the shared users.

This was solved by loading ntuser.man (Load Hive in regedit) and making sure the permissions on it were set to allow access to the entire group of users, instead of just the one.

It all seems to be working fine now.

share|improve this answer
    
+1 - Just what I was going to suggest to look at. You beat me to it. (It'd be nice to have some time to play Server Fault now and again... grumble) –  Evan Anderson Feb 1 '12 at 14:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.