Folder Redirect Revisited

[Guest]

Folks

I'm in an organization with around 20 client WinXP Pro SP1 pc's and one DC - Win2003 Server - Standard Edition. We are setup as a domain and using roaming profiles and folder redirection, generally with great success. However, I've got around 4 users who's profile won't roam correctly nor will their My Documents and Application Data folders redirect out of their roaming profiles to a shared drive on the server. Since some documents in these problematic users' My Documents folders are on the order of 100 or more Mb, it can take a large amount of time to load the profile. Even when loaded, it still isn't roaming correctly, it's just writing the data to c:\documents and settings\%Username%\my documents, for example, instead of writing it back over our 100Mbs LAN to the server

I've made sure the ACL for our shared profiles folder is correct, per MS Kbase articles 274443 and 232692 and 291087

On one p.c. that one of these users generally uses, I've implemented userenv debug logging and folder redirection logging. Here's a portion of fdeploy.log

13:28:44:690 Entering folder redirection extensio
13:28:44:690 Flags = 0x
13:28:44:705 Group Policy Object name = {E3229A63-9D22-4E56-BB61-C667DCCABA1F
13:28:44:736 File system path = \\NWSCR.DMX\SysVol\NWSCR.DMX\Policies\{E3229A63-9D22-4E56-BB61-C667DCCABA1F}\Use
13:28:44:736 Directory path = LDAP://CN=User,cn={E3229A63-9D22-4E56-BB61-C667DCCABA1F},cn=policies,cn=system,DC=NWSCR,DC=DM
13:28:44:736 Display name = DMX Domain Polic
13:28:44:736 Found folder redirection settings for policy DMX Domain Policy
13:28:44:752 The user was found to be a member of the group s-1-1-0. The corresponding path was \\dmx-10\share\home\%USERNAME%\My Documents
13:28:44:752 Successfully obtained redirection data for My Documents, (Flags: 0x1)
13:28:44:752 Successfully obtained redirection data for My Pictures, (Flags: 0x2)
13:28:44:752 The user was found to be a member of the group s-1-1-0. The corresponding path was \\Dmx-10\share\home\%USERNAME%\Application Data
13:28:44:752 Successfully obtained redirection data for Application Data, (Flags: 0x1)
13:28:44:752 Successfully gathered folder redirection settings for policy DMX Domain Policy
13:28:44:752 Redirecting folder My Documents to \\dmx-10\share\home\%USERNAME%\My Documents
13:28:44:782 Previous folder path C:\Documents and Settings\kjungbluth\My Documents expanded to C:\Documents and Settings\kjungbluth\My Documents
13:28:44:782 New folder path \\dmx-10\share\home\%USERNAME%\My Documents expanded to \\dmx-10\share\home\kjungbluth\My Documents
13:28:44:798 Contents of redirected folder My Documents will be copied to the new location
13:28:44:813 Could not copy security information from C:\Documents and Settings\kjungbluth\My Documents\DESKTOP.INI to \\dmx-10\share\home\kjungbluth\My Documents\DESKTOP.INI
13:28:44:813 Failed to perform redirection of folder My Documents
The files for the redirected folder could not be moved to the new location
The folder is configured to be redirected to <\\dmx-10\share\home\%USERNAME%\My Documents>. Files were being moved from <C:\Documents and Settings\kjungbluth\My Documents> to <\\dmx-10\share\home\kjungbluth\My Documents>
The following error occurred while copying <C:\Documents and Settings\kjungbluth\My Documents\DESKTOP.INI> to <\\dmx-10\share\home\kjungbluth\My Documents\DESKTOP.INI>:
%%133

13:28:44:813 Redirecting folder Application Data to \\Dmx-10\share\home\%USERNAME%\Application Data
13:28:44:844 Previous folder path C:\Documents and Settings\kjungbluth\Application Data expanded to C:\Documents and Settings\kjungbluth\Application Data
13:28:44:844 New folder path \\Dmx-10\share\home\%USERNAME%\Application Data expanded to \\Dmx-10\share\home\kjungbluth\Application Data
13:28:44:844 Contents of redirected folder Application Data will be copied to the new location
13:28:44:860 Could not create directory \\Dmx-10\share\home\kjungbluth\Application Data\Adobe, error 1338
13:28:44:860 Failed to perform redirection of folder Application Data
The files for the redirected folder could not be moved to the new location
The folder is configured to be redirected to <\\Dmx-10\share\home\%USERNAME%\Application Data>. Files were being moved from <C:\Documents and Settings\kjungbluth\Application Data> to <\\Dmx-10\share\home\kjungbluth\Application Data>.
The following error occurred while copying <C:\Documents and Settings\kjungbluth\Application Data\Adobe> to <\\Dmx-10\share\home\kjungbluth\Application Data\Adobe>:
%%1338

Of course these same errors show up in the client p.c. Event Viewer/Application Log.

I've also implemented various GPO's that turn off WinXP's fast user logons. I don't delete the local cached copy of the profile if that matters.

There's more that I've done which should have helped, but didn't and I can't remember it exactly anyway. Per the log snippet above, the errors sure look like ACL problems, but I've been over that with a fine tooth comb. The problematic users, their profiles, and their home directories were created no differently than those that work.

Anyone's help and comments is greatly appreciated.

Shane

 

[Adam Arndt]

Shane,

Putting the "1338" error message into net helpmsg at the command prompt
tells us that "The security descriptor structure is invalid." This could be
because the data was originally backed up on a 2000 or NT server and then
restored to a 2003 Server which will create ACLs a little differently;
another possible reason is that the ACLS on this folder were populated using
a custom XCACLs script. In either case, if you sit at the file server and
view the local folder Share\home\kjungbluth\mydocuments\ (or maybe the
desktop.ini file inside of it) you will get a pop-up that says that the ACLs
or the Security Descriptor is invalid and ask you if you would like it to
reorder the permissions for you, select OK and the issue should be resolved.


Adam Arndt
(another question is: Are these computers laptops? (If not why are you using
folder redirection)

 

[Guest]

Adam

Thanks for the quick reply

These problematic users/p.c.'s are desktops not laptops. We redirect because we have very large files stored in My Documents, or at least some of us do. I can knock heads around all day and there's always someone who will still store large files in My Doc's instead of just their home directory (which is where My Documents resides)

I'll give your suggestion a try right now and let folks know how it works

Shan

----- Adam Arndt wrote: ----

Shane

Putting the "1338" error message into net helpmsg at the command prompt
tells us that "The security descriptor structure is invalid." This could be
because the data was originally backed up on a 2000 or NT server and then
restored to a 2003 Server which will create ACLs a little differently;
another possible reason is that the ACLS on this folder were populated using
a custom XCACLs script. In either case, if you sit at the file server and
view the local folder Share\home\kjungbluth\mydocuments\ (or maybe the
desktop.ini file inside of it) you will get a pop-up that says that the ACLs
or the Security Descriptor is invalid and ask you if you would like it to
reorder the permissions for you, select OK and the issue should be resolved


Adam Arnd
(another question is: Are these computers laptops? (If not why are you using
folder redirection

 

[Guest]

Alan and group

I should have added more info. to my last reply to you

The kjungbluth folders were created automatically by the server upon that user's first login so should in theory have the correct ACLS. No scripts were used nor was this folder copied over to the new server from an old NT 4 box we were using

On the server, as administrator, I went to the \Share\home\kjungbluth\mydocuments and didn't have any access problems - which of course is to be expected as administrator. Normal users can't login to this machine while sitting at it. I'll have to temporarily disable that GP to do it

Maybe it would be easier to just copy all the file for this user to a temporary location then delete their profile and home directory. Have them logon at a client and then once everything was settled, move their files back into their home directory. What do you think

Thanks

Shan

----- Adam Arndt wrote: ----

Shane

Putting the "1338" error message into net helpmsg at the command prompt
tells us that "The security descriptor structure is invalid." This could be
because the data was originally backed up on a 2000 or NT server and then
restored to a 2003 Server which will create ACLs a little differently;
another possible reason is that the ACLS on this folder were populated using
a custom XCACLs script. In either case, if you sit at the file server and
view the local folder Share\home\kjungbluth\mydocuments\ (or maybe the
desktop.ini file inside of it) you will get a pop-up that says that the ACLs
or the Security Descriptor is invalid and ask you if you would like it to
reorder the permissions for you, select OK and the issue should be resolved


Adam Arnd
(another question is: Are these computers laptops? (If not why are you using
folder redirection

 

[Adam Arndt]

Shane,

While on the server do not connect to \\server\share but go through the
local file system and goto the Security tab to verify the NTFS permissions
and see if it gives you the prompt from before. (For some reason I thought
you said that you were using Offline Files, and not Folder Redirection);
Folder Redirection, great idea; Offline Files for desktops, bad idea.

Adam