Windows Server 2008 R2 Profile error

Good Day All!!

i have a small issue with my server.

i add a TS user in the AD and give access for TS roaming profile.

i have 2 x Windows 2008R2 acting as RD servers and 1 x 2008R2 acting as a session broker. The SB also holds CALS for RD server.
Have 100 CALS and users so far is 78.

Now the problem

when user logs into the RD server (which ever is pointed by the SB), the users receive this message

"windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off"

Event ID : 1511

Did some google on this and came up with some MS ideas but it didn't work.

This looked good but did not help
www.bauer-power.net/2010/03/temporary-pr...aded-on-windows.html

Many thanks in advance for having a look at my problem.

Cheers
Kapish

Are you using roaming profiles?
If so are you using GPO to setup roaming profiles or the Profiles tab in AD users and computers?

Does this happen on all accounts?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

^^ Where are your profiles located. Check at this registry spot

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

The article you mentioned isn't fully complete in some cases.

Lets say under profilelist you see.

S-1-5-21-3457107745-1101441733-3463990262-1022
S-1-5-21-3457107745-1101441733-3463990262-1022.bak

If it's listed 2 times click on it and you can see which is the correct because it will have the proper information in it. So in my case the .bak had the correct profile information. so..

S-1-5-21-3457107745-1101441733-3463990262-1022.ba (added ba) Then ill later delete once its working
S-1-5-21-3457107745-1101441733-3463990262-1022 (deleted the .bak)

Many Thnx Bublitz for answering my queries.

Am using profiles tab in AD users and computers to create TS profile.

This happens to some accounts. To be precise, 4 out of 78 account.
We have a step by step detail configuration which is followed to create an account. That is why am baffled as to why it is happening to some accounts only.

this is the place where profiles are located

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Unfortunately none of the registry folders ends with .bak folder name.

Many thanks in advance.

Cheers
Kapish

So i'm assuming your sending the profile to a network share of some sort?

Check the folder permissions of their profile. Compare them with ones that work.

Also

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Click on the folders below and find the profiles that don't work. Compare the registry settings with ones that do work. Do this for both servers of course.

Also

Right click -> my computer -> then click advanced system settings - > then user profiles -> click settings

Find the profile in the list on both servers compare those with ones that work as well. Are they all local or roaming?

Finally you can also do some scorched earth. Delete the profile on bother servers via the user profile screen mentioned above on both servers.

Also verify the registry entry is gone on both servers after you deleted the profile on both servers (via advanced settings) at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Then the final step delete the network profile as well where ever that is in the AD user and computer configuration.

Log back in and see if it will be recreated.

The problem i think as pointed out by you Sir, is the folder access option for the concerned user. All those users, whose profile is working o.k have full access rights on their respective folders.

But the ones who are giving problem do not have any control. When i try to give those users full access to their folders in the RD server under C:\users\username folder then i get the error message saying "Error applying security - Access denied" even thou i log in as the domain admin to work on those folders.

Thanks in advance

You will have to take ownership over those folder then.

Right Click -> Properties -> Security -> Advanced -> Owner -> Edit

Then select your name in the "change owner to field" and also select "Replace owner on subcontainers and objects" then press OK

Now you should be able to fully view and change folder permissions or even delete it and have them start from scratch.