2

A user at the place where I work left the company, we deleted his account out of AD and then he came back...and now his redirected profile exists, but with the wrong permissions on the folder.. I asked a coworker about it and from what I understood I threw together the following procedure (which still doesn't work, the user still gets a 502 error in the logs and no redirected desktop);. this is bad because he needs to access his old files:

Set security permissions on the folder correctly

1. Took ownership of the folder as Administrator

  1. Right clicked \\somersrv\x$\Redirected\<username> and selected properties from the menu.
  2. Clicked the Security tab.
    1. Clicked the Advanced button
      1. Clicked the owner tab
      2. Noticed that the owner was a UUID string...S-1-5-21-23423431 (which indicates the original owner has been removed)
      3. Clicked the Edit... button.
        1. The Advanced Security Setting for <username> dialog appears
        2. On the owner tab, clicked Other users or groups button
          1. The Select User, Computer, Service Account, or Group dialog appears.
            1. In the Enter the object name to select textbox I typed somedomain\administrator
            2. Clicked OK
          2. Selected somedomain\administrator from the Change Owner to: list box.
          3. Checked off the Replace owner on subcontainers and objects
          4. Clicked OK
          5. The Windows Security dialog appeared with the following message:
            • If you have just taken ownership of this object, you will need to close and reopen this object's properties before you can view or change permissions.
          6. I clicked OK on all the remained dialog boxes to close everything out.

2. Took ownership of the folder as the user

(same procedure as above, except I selected the <username> as the owner instead of the administrator)

3. Set Security Permissions correctly for the user

  1. Right clicked \\somersrv\x$\Redirected\<username> and selected properties from the menu.
  2. In the <username> Properties Dialog:
    1. Clicked Edit...
    2. The Permissions for <username> dialog appears
      1. Clicked Add..
      2. The Select Users, Computers, Service Accounts, or Groups dialog appears
        1. In the Enter the object names to select textbox entered somedomain\<username>
        2. Clicked OK
    3. Back in the Permissions for <username> dialog box,
      1. Clicked <user> from the Group or user names list.
      2. In the Full Control row, in the Allow column checked off the checkbox.
      3. In the Full Control row, in the Allow column unchecked the checkbox.
      4. Clicked OK
    4. Clicked OK on the remaining dialog boxes until they all closed.

The standard set of permissions my coworker specified are already added to the users folder...they were:

  • SYSTEM
  • Domain Admins
  • <username>

My coworker also eluded at the end of his messages to something about making the SYSTEM the owner, not sure what he meant; he also said to check the other user directories, but the permissions on them don't seem to adhere to much of a standard. Some of them won't even let me look at the permissions or the owner even when I'm logged in as administrator.

But in the end the user's Desktop, My Documents, and Favorites appeared in the folder but now they have the user as the owner and only the somedomain\administrator listed under the permissions, and they still get the 502 error.

Why does the user still get the 502 error when logging in?

Also, is there another way to do this? Using the command line or powershell or something like that? The Microsoft UI for this is atrocious.

2 Answers 2

6

Q: is there another way to do this?

A: Do yourself a favor and backup his old data and then delete his profile and redirected folders. Then allow Windows to create his user profile and redirected folders on first login. Then restore the data to the new redirected folders.

Currently you're dealing with two different security entities (SID's) even though the old and new user accounts have the same name. Trying to get the permissions set correctly on the folders for the new SID is just going to frustrate you and you'll probably wind up with a big mess.

5
  • Actually this didn't work...thank you for your answer though. Something on the network here must be different.
    – leeand00
    Jul 8, 2014 at 14:08
  • What didn't work? Did Windows not create a profile and/or redirected folders for the user?
    – joeqwerty
    Jul 8, 2014 at 14:09
  • No it didn't...yes I know it sounds like the right answer to me too..maybe on a normal network...or maybe it's because I manually deleted the local user profile instead of using Advanced -> User Profiles to delete the profile and it kept logging in with a temporary profile. I'm very new at this, so I just deleted the user profile folder.
    – leeand00
    Jul 8, 2014 at 14:11
  • 2
    No, that's not the right way. You've deleted the profile folders but you haven't deleted the profile registry hive. Go into the Advanced System properties and look for an "unknown" profile and delete that.
    – joeqwerty
    Jul 8, 2014 at 14:26
  • I didn't include that issue in my previous post, so I'll select your answer as the right one, but I'm adding what we in my answer below. Ok?
    – leeand00
    Jul 8, 2014 at 15:01
0

Here is what we did:

On the server

  1. Login as Administrator on the server that has the redirected folders...
  2. Copy the old folder to somewhere else...
  3. Create a new folder with that username
  4. Make sure the user has control of the folder
    1. Right clicked \\somersrv\x$\Redirected\<username> and selected properties from the menu.
    2. In the <username> Properties Dialog:
      1. Clicked Edit...
      2. The Permissions for <username> dialog appears
      3. Clicked Add..
      4. The Select Users, Computers, Service Accounts, or Groups dialog appears
        1. In the Enter the object names to select textbox entered somedomain\<username>
        2. Clicked OK
      5. Back in the Permissions for <username> dialog box,
        1. Clicked <user> from the Group or user names list.
        2. In the Full Control row, in the Allow column checked off the checkbox.
        3. In the Full Control row, in the Allow column unchecked the checkbox.
        4. Clicked OK
      6. Clicked OK on the remaining dialog boxes until they all closed.
  5. Make sure the user not the administrator is the folder owner
    1. Right clicked \\somersrv\x$\Redirected\<username> and selected properties from the menu.
    2. Clicked the Security tab.
      1. Clicked the Advanced button
        1. Clicked the owner tab
        2. Clicked the Edit... button.
        3. The Advanced Security Setting for <username> dialog appears
          1. On the owner tab, clicked Other users or groups button
            1. The Select User, Computer, Service Account, or Group dialog appears.
              1. In the Enter the object name to select textbox I typed somedomain\<username>
              2. Clicked OK
            2. Selected somedomain\<username> from the Change Owner to: list box.
            3. Checked off the Replace owner on subcontainers and objects
            4. Clicked OK
            5. The Windows Security dialog appeared with the following message:
              • If you have just taken ownership of this object, you will need to close and reopen this object's properties before you can view or change permissions.
            6. I clicked OK on all the remained dialog boxes to close everything out.

On the user machine

  1. Delete any extraneous user profiles for that user on the machine
    1. Login as administrator
    2. Click Start
    3. Right-click Computer and click properties
    4. In the resulting window click Advanced System Settings
    5. Click the Advanced tab
    6. Under User Profiles click Settings...
    7. If you're sure that the user doesn't have anything important in the profiles delete them here.
    8. Click OK
    9. If the user profile folders are still there, delete them.
      • Note: If you deleted the user profile folder manually you will need to delete the profile entries for that user from the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\ProfileList
  2. Log out
  3. Login as the user
  4. Create Desktop, My Documents, Favorites (if they don't exist already) in the redirection folder \\somesrv\x$\Redirected\<username>
  5. run gpupdate /force

Back on the server

  1. Copy their files from the old profile back in

Back on the machine

  1. Restart
  2. Log back in as the user.
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .