3

I have recently installed a Windows 2008 Server and have joined 8 computers to its domain. The domain name is companyname.local. I set up user accounts in AD for each user, the user name being the same as the user name they have on each of their own computers.

One of the computers was new with Win 7 Pro and when I went to join it to the domain, it created a username.local folder in the Users folder on that computer. But when I joined all the other computers to the domain, no such folder was created in their respective Users folder, there was only a single folder for their username, no ".local" folder.

I am confused! Is the ".local" folder the one each user should have all their desktop, favourites etc settings in?

Also, I went to log onto one of the computers at the weekend to change some program settings, I didn't have the password for the user of that computer so I used my admin credentials to log on. I told the user to "switch user" to log back on with her own user name. This she did and instead of going into her usual desktop, a new desktop was created and I discovered that this had created a ".local" folder.

I realised that all the users are logging on with "localcomputername\username" as opposed to "domainname\username. I don't understand which of these is right and have not been able to clarify the situation through searching the Internet.

4
  • 2
    remove all the local accounts
    – tony roth
    Jun 28, 2011 at 21:51
  • 1
    Two problems that I see here: Don't use local accounts, just domain ones. Don't name your domain with .local.
    – Rob Moir
    Jun 28, 2011 at 22:25
  • 2
    Personally I don't see an issue using .local. If you're assigning a DNS suffix other than than .local then hosts that auto-assign .local in the absence of an assigned suffix will use your assigned suffix. If you are assigning .local as your DNS suffix then how can it create problems for hosts that auto assign themselves .local in the absence of an assigned suffix if they are being assigned a .local suffix?
    – joeqwerty
    Jun 28, 2011 at 22:39
  • @joeqwerty - it clashes with mDNS/Bonjour which is, for all its faults, a standard that has reserved the .local namespace, and makes a lot of assumptions about what it can and can not do with it. If you ever need to have mac clients on the network (and these days, I think its foolish to say "never, not going to happen" about anything) then you will regret that design choice. IIRC Microsoft stopped recommending it some time ago for this reason, but old documentation doesn't go away so it still appears.
    – Rob Moir
    Jun 29, 2011 at 21:55

4 Answers 4

5

Delete (or disable) all of the local user accounts on the computers. That way you'll ensure that users are using their AD account. Then you can use USMT to migrate the user's profile so that it's associated to their AD account instead of their local account.

As an aside, at no point should you know your users credentials. This is a bad way to operate, and doing so encourages credential sharing between users which obviously is not good.

3
  • Wish I could doubleplusone for not using users' credentials. I cringe and want to smack every admin I encounter that operates that way. "We will never ask you for your password..."
    – Adrien
    Jun 28, 2011 at 22:48
  • Hi I am solely responsible for the IT in this company hence me knowing the user credentials. I have made progress though as when I first started to work for them they were using an illegal copy of XP on 8 computers, none of which even had a password! Jun 28, 2011 at 23:21
  • 1
    That is a vast improvement; it's still not a good idea for you to know your users' credentials. It's a bad habit that, like piracy, the earlier it's broken, the better. If it ever becomes 100%, unavoidably, absolutely vital that you must log in with their credentials, then a better procedure is to change their password to something you know, do your business, then change it to something random and force them to change on next login. Just my opinion, of course ...
    – Adrien
    Jun 28, 2011 at 23:27
3

If a user profile folder already exists for a local user, and then a domain user with the same username logs on, then .<NETBIOS domain name> is appended to the user profile folder to distinguish it from the local user profile folder.

If a domain user logs on and no local user profile folder exists for a user with the same username, the folder is simply created without any suffix.

I imagine Windows actually has a more sophisticated method of knowing which profile folder belongs to which user and this folder naming convention is merely for human benefit. That really is the only difference, and the user accounts are still separate and can still be used independently.

Why you have local users as well as domain users confuses me though, since with local users you lose an awful lot of benefits you gain when you join the computer to Active Directory in the first place.

1
  • Thanks for that. This is only a small company and its IT strategy has been to say the least organic and not very well thought through and they are all somewhat resistent to change! I have been trying for some years to lick them into shape and it has taken me 3 years to persuade them to even get a server as they had been struggling with a peer-to-peer that was creaking and suffered a bewildering collections of shares. Each desktop is highly individual so I have to be careful not to impose too many changes too quickly hence my asking what is the best way to do all this. I appreciate the advice! Jun 28, 2011 at 23:15
0

domain logons include domainname\username while local logons include localcomputername\username

if the local user is the same as the domain user you can still get access to domain resources and mostly function like normal, which is likely what is h appening to you.

What happens when you try to login as domainname\username instead of localcomputer\username?

1
  • Hi thanks for that. I have 2 XP machines which will only log on using the localcomputername\username id, I get a message saying the user details are unknown. I don't understand the significance of the ".local" folder though. Should I create a ".local" folder for all the computers and then copy all the desktop settings to these instead? Jun 28, 2011 at 22:21
0

The user name can always be referred to in the [NetBIOS domain]\[username] format. For a local user account, the domain is always the name of the computer, i.e., WS01\frank. For an Active Directory user account, it will be the NetBIOS name of the domain, i.e., WIDGETCO\frank.

When you log in to a workgroup or domain member workstation without prepending a domain name, the workstation will first attempt to authenticate by prepending the local computer name as the NetBIOS domain. If this fails and the workstation is a member of an Active Directory domain, it will attempt to authenticate by prepending the NetBIOS name of the Active Directory domain. You can always specify whether the authenticated user should be the local user or the domain user by prepending the appropriate domain label.

The user profile is created the first time a user account logs on to the workstation. If there is no profile folder by the name of the user on that workstation, the folder will be created named with the just the username (i.e., C:\Users\frank). If there is already a profile folder by that name, it will append the NetBIOS name of the user account to the new profile folder (i.e., C:\Users\frank.WS01 or C:\Users\frank.WIDGETCO). If there is already a folder with the domain portion appended, Windows will append a three digit number incrementing from 000 (i.e., C:\Users\frank.WIDGETCO.000, frank.WIDGETCO.001, etc.).

Note that this behavior is per-machine and depends on the presence or absence of similarly named profile folders. Just because a user account gets a folder named one way on one machine does not guarantee the folder will be named the same way on another.

The user profile path is stored in the registry under HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList. You can remap a user login to an already existing profile folder by modifying the ProfileImagePath value under the subkey for the user's SID. Note that the user must have proper access permissions to the files and the registry hive stored in that profile.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .