ForensiT Homepage
Forum Home Forum Home > ForensiT Support > Domain Migration
  New Posts New Posts RSS Feed - Access error when Migrating a profile
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Access error when Migrating a profile

 Post Reply Post Reply
Author
Message
y2gray View Drop Down
Newbie
Newbie


Joined: 26 Mar 2008
Status: Offline
Points: 8
Post Options Post Options   Thanks (0) Thanks(0)   Quote y2gray Quote  Post ReplyReply Direct Link To This Post Topic: Access error when Migrating a profile
    Posted: 26 Mar 2008 at 11:32am
Hi,

I've used ProfWiz many times on many computers in a domain with no problems.

Yesterday and today on two different systems I encountered my first problem with the software.

It migrated the profile over to the domain with no errors, but when the user logged into their new domain (non local) account, for some reason the profile didn't copy over correctly.

All the start menu items were missing and settings were not transfered (i.e. Outlook). For some reason it did not completely delete the old local profile (the old file that remained was the NTUSER.dat file).

For some weird reason whenever you open ANYTHING (Outloook, Favourites in Internet Explorer, etc) it looks to the old profile for the information and says for example "C:\Documents and Settings\old profile name\filename is not available, access denied".

In one instance the desktop background copied, and on one system it did not.

Any ideas? I'm thinking it's something to do with file permissions, but in all the cases where the migration was successful, it just transfer all the local user permissions over to the new domain user. I've tried even giving "Everyone" access to the old user profile folder but to no avail.

I'm doing a major migration so I'd like to have this solved asap.

Thanks a lot!
Back to Top
Support View Drop Down
Moderator Group
Moderator Group


Joined: 09 Nov 2006
Location: United Kingdom
Status: Offline
Points: 1844
Post Options Post Options   Thanks (0) Thanks(0)   Quote Support Quote  Post ReplyReply Direct Link To This Post Posted: 26 Mar 2008 at 1:05pm
Hi,

The first thing to say is that User Profile Wizard does not copy or move profile data. Instead, it configures the existing profile so that it can be used by the user's new domain account. For this reason, any applications should be looking in the existing profile path.

It is unusual, but it sounds like the default security permissions were changed on the profile before it was migrated. User Profile Wizard does not "fix" permissions that have been changed. You may want to consider reapplying permissions on the effected folders, replacing permissions on child objects.
Back to Top
y2gray View Drop Down
Newbie
Newbie


Joined: 26 Mar 2008
Status: Offline
Points: 8
Post Options Post Options   Thanks (0) Thanks(0)   Quote y2gray Quote  Post ReplyReply Direct Link To This Post Posted: 26 Mar 2008 at 1:25pm
Hi,

First, thanks for the quick response :)

But just to make sure I understand things correctly, when a profile is migrated over to a domain, the new domain profile assumes the same permissions of the profile that is being migrated right? Isn't that the whole reason you choose which profile to migrate? (aside from the need to preserve settings, etc).

Both PC's where this failed had permission to the profile folder that was being migrated. Meaning the old user profile had Full Control permission of "C:\Documents and Settings\old user profile name".

So the new profile should get those same permissions and not be denied on anything because where it's failing is that it's saying it doesn't have permission to the old profile's files in the "Documents and Settings" folder.

That's why I'm confused because as far as I know permissions haven't been changed on any computer. The user should have access to everything.

But I'll try removing all permissions and then reapply them giving that user Full Control to that folder and then try the migration again.

I'll let you know the results.

Thanks a lot again!
Back to Top
Support View Drop Down
Moderator Group
Moderator Group


Joined: 09 Nov 2006
Location: United Kingdom
Status: Offline
Points: 1844
Post Options Post Options   Thanks (0) Thanks(0)   Quote Support Quote  Post ReplyReply Direct Link To This Post Posted: 26 Mar 2008 at 3:05pm
You're right - that's how things should work. By default the permissions on the profile folder are inherited by the folders and files inside, like "My Documents." However, it is possible for someone to break that inheritance so the permissions do not flow down. It sounds from what you say like that might have happened here. 
Back to Top
y2gray View Drop Down
Newbie
Newbie


Joined: 26 Mar 2008
Status: Offline
Points: 8
Post Options Post Options   Thanks (0) Thanks(0)   Quote y2gray Quote  Post ReplyReply Direct Link To This Post Posted: 26 Mar 2008 at 3:43pm
I solved the problem on one of the systems. I believe what solved the problem is giving the "administrators" group full control on the profile folder in question. Although that shouldn't have been the issue being that the user was a member of the "administrators" group.

Although I'm not sure if that has to be set that way if I'm running Profwiz from the Administrator account instead of the user account (even though it's the user profile I'm migrating and not the administrator). If you could let me know I would appreciate it.

I did look into what you suggest about inheritance being broken as I know that can be done quite easily. When I did it originally I checked the subfolders under the user's main profile folder (i.e. "My Documents") and I could've sworn the user account still had inherited full control from the main profile folder. I could be wrong though.

In any event I know what to double-check now before I actually perform the migration, so thanks very much for the help!
Back to Top
Support View Drop Down
Moderator Group
Moderator Group


Joined: 09 Nov 2006
Location: United Kingdom
Status: Offline
Points: 1844
Post Options Post Options   Thanks (0) Thanks(0)   Quote Support Quote  Post ReplyReply Direct Link To This Post Posted: 27 Mar 2008 at 8:17am
Which administrator account you use to run the Wizard doesn't matter; you don't have to be logged in as the user - or not logged in as the user. You certainly shouldn't need to make any changes after the Wizard has run.
 
If giving the user permissions to the profile via the Administrator group worked, it does indicate something was messed up with the security of the profile folder.
 
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.03
Copyright ©2001-2019 Web Wiz Ltd.

This page was generated in 0.031 seconds.