To work around this you can either enable a Group Policy setting called Computer ConfigurationPoliciesAdministrative TemplatesSystemUser ProfilesAdd the Administrators security group to the roaming user profiles, before the profile is created or you can grant the Administrators local group (or any other user/group you prefer) Full Control permissions to the profile folder and all its files and subfolders. Obviously these permissions will not let ADMT, which connects to the computer as the user running it (it does not have a service), translate the profile. I have written about manually performing this process here.If you have not changed the default settings Windows will create roaming profiles with the following ACL/Owner: Translating a profile means updating the NTFS permissions on all the files in the profile directory, but also loading the user’s registry hive the NTUSER.DAT file, and translating the registry permissions set on all the keys in it. ADMT needs Full Control NTFS permissions to translate a profile, roaming or local.In the Windows Server 2008 Active Directory schema Microsoft have created a new attribute called msTSProfilePath that is meant to store this setting in the future.) The Remote Desktop Services Roaming profile is specified on the Remote Desktop Services Profile tab in ADUC and is stored in the userParameters attribute data blob. Beats me…(Just to be clear, the regular Roaming Profile is specified on the Profile tab of the user in Active Directory Users and Computers (ADUC), and is stored in the profilePath attribute. This seems very strange to me since we are just talking about reading another attribute in Active Directory and doing the same thing as you are already doing with Roaming Profiles. It will translate Local Profiles using the User Profiles option in the Computer Account Migration wizard, and regular Roaming Profiles using the Translate Roaming Profiles option in the User Account Migrationwizard, but it will not touch the Remote Desktop profile. No version of ADMT translates security for Remote Desktop (Terminal Server) Roaming Profiles.Here are some observations I have made about the use of ADMT over the course of many years: The most annoying thing is that Microsoft have yet to implement PowerShell support in ADMT. It offers what you need to perform intra or inter-forest Active Directory migrations/restructures, but it is very basic. I’ve been using this baby since version 2.0.
ADMT started it’s Microsoft life as licensed software from One point. The good old Active Directory Migration Tool (ADMT) has reached version 3.2 making it compatible with Windows 7/Server 2008 R2 and 圆4.
0 kommentar(er)
