I've set up roaming profiles (client insists) as per this doc: https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/deploy-roaming-user-profiles and it works, but there's something I don't get.

Step 2 - Creating a security group. It seems like roaming profile should be created for any User that I put in this group regardless of what machine they are accessing, but it doesn't work like that for me. In my environment roaming profiles are only applied if the User AND Computer are added to the security group.

Is there something wrong with my setup, or is this expected behaviour? If expected, why, what am I missing? It seems to me that the policy should apply to any object that is in that group, be it a user or a computer.

Thanks in advance.


You must grant the "Read" rights to your computers, Microsoft says that in Step 4:

Due to the security changes made in MS16-072A, you now must give the Authenticated Users group delegated Read permissions to the GPO - otherwise the GPO won't get applied to users[...]

Step 4 .9:

Select the Delegation tab, select Add, type Authenticated Users, select OK, and then select OK again to accept the default Read permissions.

So, grant the "Apply group policy" and "Read" permissions to the group containing the users, and "Read" to the group containing the computers (it can be "Domain computers" for example. Or "Authenticated users", but double check that you only gave the "Read" permission and not "Apply group policy" otherwise your user-group filtering will be useless).

This is because technically the computer account is used to download the group policy from the domain controllers, even for the "User" part of the GPO (that's why the computers must be able to Read the GPOs even for User settings).

You can read this blog post if you want more details about that : https://docs.microsoft.com/fr-fr/archive/blogs/askds/deploying-group-policy-security-update-ms16-072-kb3163622

| improve this answer | |
  • I have a single security group containing both users and computers rather than separate ones, which is how it is described in that MS doc. I had also already added Read permissions to that group as in step 4.9 in that doc. – spoovy Feb 17 at 11:14
  • If you don't want to filter by computers (i.e if you want roaming profiles regardless of the computer), you should add Read permission for Authenticated Users – Swisstone Feb 17 at 11:18
  • To be clear by "that group" I meant "Authenticated Users". I already had set it up as described in the doc and by you. – spoovy Feb 17 at 11:21
  • Generate a report with GPResult /h report.html and check for errors/update your question with any error message you see in the report. – Swisstone Feb 17 at 11:24
  • Interesting. I get an error: "Error: Computer determined not to be in a site. Error code 0x77F" – spoovy Feb 17 at 11:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.