Security for Roaming Profile folders?

[rlcos]

Anybody know what services OTHER THAN "System" and "Administrators"/"Domain Admins" should have rights to a user's roaming profile directory?

I am using an XPs farm (on Win2K, obviously) with roaming profiles set up on a separate Nt4 server. I appear to be having security issues with the profile folders, because with security tightened down to just "System" and the individual user, the user's copied profile is not copying back to the profile directory. They can READ the profile, but changes are not written back to it.

If I loosen the security as far as "Everyone" havign access to the user's profile folder, then I have issues with the server getting confused about who is who. (User logs in, WHOAIM says he is who he is supposed to be, but he gets another user's printers instead of his own... and ONLY the other user's printers.) This problem gets corrected when I reboot the individual XPs server having the problem, but it doesn't stay fixed.

Any ideas? I'm slowly going insane...

 

[CitrixEngineer]

Each individual profile folder should be Full Control for the user in question.

Check that the users are in groups that have permission to log on locally to the Citrix Servers (so that the local copy of the profile can be created, and the default is not used instead).

Try using Filemon from

http://www.sysinternals.com

(when the server isn't too busy!) and trace what happens when a user logs in, looking out for "ACCESS DENIED" messages (the log can be exported to Excel as a CSV).

Hope this helps CitrixEngineer@yahoo.co.uk