Roaming Profile Creation and DFS 1

[ericbarr]

I am having an issue with roaming profiles using DFS. The problem only happens during the initial creation of the profile. I have had no issues migrating profiles to the DFS share.

If I create a new user account with a roaming profile using the DFS path, the profile creation fails. Event logs on the workstation show event id 1504 and 1509.

1504 - Windows cannot update your roaming profile. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator.

DETAIL - Cannot create a file when that file already exists.

1509 - Windows cannot copy file <file> to location <location path>. Possible causes of this error include network problems or insufficient security rights. If this problem persists, contact your network administrator.

DETAIL - Cannot create a file when that file already exists.

The profile is folder is empty, so I do not understand why the system errors out with "file already exists".

Group policy is setup to give the user full control of the profile. The share permissions have been verified. Full Control for "Everyone".

If I create a new user account with a roaming profile using the UNC path the profile creation works without issue.

My current workaround is to create a new an account using the UNC for the roaming profile directory. Then change the path to the DFS after creation.

Wrap-up
Create profile using the DFS path, profile creation fails.
Create profile using the UNC path, profile creation succeeds.

Thanks

Eric

 

[Zelandakh]

I've found your workaround to be the only way to get it to work.

 

[ericbarr]

I called Microsoft, and they were able to resolve the issue. Apparently, I was missing "read attributes" on the group that gives user access to the roaming profiles folder. My roaming group now has the following permissions.

Apply to: This folder only
List Folder / Read Data
Read Attributes **** fixed the issue
Create Folders / Append Data

From Microsoft
ROOTCAUSE:
==========
Only when the Parent folder of the Roaming profiles is a DFS Namespace folder or DFS Root Folder, It seem to be required to add this extra permission for the appropriate group (to which the users are member of) so the roaming profiles will be saved successfully. Unfortunately this is not documented yet on the technet article for the best practices while configuring Roaming Profiles.

 

[Zelandakh]

Thanks Eric - have a star from me for finding and posting a solution to a problem I gave up on years ago...