I'm having problems giving a Domain Local group permissions to a mandatory user profile with Windows Server 2003 R2 SP2 and Windows XP SP3.
I've created a Global group called Sales, and put John and Mary in that group. I then created a Domain Local group called Sales Local and put the Sales group into that. I want John and Mary to use the same mandatory profile.
I logged in as Administrator and went to copy the profile to the appropriate folder \server01\profiles\sales and also assign the Domain Local group Sales Local permissions to use the profile.
I entered the appropriate path to the new profile location, and then clicked Change on Permitted to Use and selected the Sales Local Domain Local group (Note: I had to click on Object Types and check off Groups to do this).
On the server side, I renamed ntuser.dat to ntuser.man, then tried to log in as John.
The problem is that John doesn't see all of the profile. For example, he will see a text file I placed on the desktop, but he doesn't see the My Documents folder icon that I added to the desktop. Also, if you go to Desktop->Properties, you just see a black screen instead of theme selections, and if you try to add a My Documents folder to the desktop you get an error message that the visual style could not be set.
None of these problems exist if I make Sales a Global group, but I thought with A-G-DL-P, it wasn't "best practice" to give resources permissions based on a Global group. Also, why do I have to take the extra step of checking of "Groups" to give a group permissions to a profile? I saw a "howto" article that mentioned giving "BUILTIN\Users" access to the mandatory profile. That doesn't sound very secure.
What am I missing? Is this a configuration error on my part? A known limitation?