Can't Manage XP Machines in AD

[Guest]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Hello, I am trying to manage my XP machies from AD so that I can add domain
users to the local admin group. This is to try and fix another problem I
posed a few days ago (see below under line for over all issue). I can't seem
to manage the PC's and I used to be able to do that before the upgrade, this
leads me to think the computers arn't on the network properly, or the
computer account hasn't been created correctly, maybe it's confused because
the old domain and new domain are the same name!

Hopefully this will shed some extra light and someone has some idea how I
can fix this!!

____________________________________________________________
History: -

I did an upgrade to my servers, basically I had SBS 2003 with 50 users on
it, the server was old so we bought a new server. I built the server to be a
2003 Server in the same domain, server name, same settings the lot etc and
then installed Exchange with all the same settings etc etc

I then manually re-created all the users (easiest way as I only have 50
users, didn’t want to swing or migrate, wanted to leave current config in
place while I built the other).

I then Exmerged all the email, copied all the data and profiles, switched
off the old servers plugged in the new, re-added all the PC’s to the new
domain.

Issue: -

When I log in (with admin privileges) my profile comes down correctly, my
email works, printers are available and policies are present. All works fine.

When a normal user logs in (with Domain User privileges) firstly the group
policies aren't coming into effect. No got any more info than this at the
min, no errors no nothing! I backed up and restored my GPO's from the last
server.

Secondly when my users log on and download there profile form the server
they don't see all of the profile. I restored there profiles from backup.
When I look on the PC when they are logged in in documents and settings at
the profile they can only see certain folders: -

Users Documents
Desktop
Favorites
Start Menu
WINDOWS

They can't see: -

Application Data
Local Settings
etc
etc

I thought at first it wasn't downloading those folders but if I log on as an
administrator and click on the cached copy of there profile all the folders
are there, it's only when they are logged in that they can't see it.

It shouldn't be a permissions thing on the folder as they can download it.

It's not that they are hidden as I clicked to show hidden files and folders.
This is causing outlook to fail as they can't see the application data
folder. Also no printers etc

Anyone any ideas as to what’s happening here? Not sure if there’s an overall
permissions issue because the way I got round this problem was to put all my
users into the Domain Admins group, everything works fine now but I need to
get them all out of Domain Admins asap!

Any help would be greatly appreciated.

Thanks in advance.

Mike

 

[svend]

Archived from groups: microsoft.public.win2000.advanced_server (More info?)

Im not 100% clear on what you've what you've done so I may be typing lots of
drivel here ... but just because you made the server name and domain name the
same does not mean that it is the same domain.
This may be the reason why the workstations can't be managed correctly. Have
you gone to each workstation and taken it out of the doamin and the put it
back in.
I think you'll need to do this to ensure that the workstation creates a
valid SID for itself on the domain. Only when the computer is part of the
domain can your Group Policies be applied.
Try changing a workstation back to a workgroup, deleting the computer in AD,
and then change the workstation from workgroup back to the domain.

The user accounts themselves will have new SIDs too and so they will create
new profiles on the workstations for themselves - so you'll then have to copy
the old profile back over to the new user. If you've copied over roaming
profiles check that you've set the profile directory in each user account.
I'm not sure how well this wil work as again the registry hive stored in the
roaming profile (NTUSER.DAT) may not be able to be used on a user with a
different SID. The only way I know to get the NTUSER.DAT from one user to
another cleanly is with the copy profile function.

Svend


"Ziguana" wrote:

> Hello, I am trying to manage my XP machies from AD so that I can add domain
> users to the local admin group. This is to try and fix another problem I
> posed a few days ago (see below under line for over all issue). I can't seem
> to manage the PC's and I used to be able to do that before the upgrade, this
> leads me to think the computers arn't on the network properly, or the
> computer account hasn't been created correctly, maybe it's confused because
> the old domain and new domain are the same name!
>
> Hopefully this will shed some extra light and someone has some idea how I
> can fix this!!
>
> ____________________________________________________________
> History: -
>
> I did an upgrade to my servers, basically I had SBS 2003 with 50 users on
> it, the server was old so we bought a new server. I built the server to be a
> 2003 Server in the same domain, server name, same settings the lot etc and
> then installed Exchange with all the same settings etc etc
>
> I then manually re-created all the users (easiest way as I only have 50
> users, didn’t want to swing or migrate, wanted to leave current config in
> place while I built the other).
>
> I then Exmerged all the email, copied all the data and profiles, switched
> off the old servers plugged in the new, re-added all the PC’s to the new
> domain.
>
> Issue: -
>
> When I log in (with admin privileges) my profile comes down correctly, my
> email works, printers are available and policies are present. All works fine.
>
> When a normal user logs in (with Domain User privileges) firstly the group
> policies aren't coming into effect. No got any more info than this at the
> min, no errors no nothing! I backed up and restored my GPO's from the last
> server.
>
> Secondly when my users log on and download there profile form the server
> they don't see all of the profile. I restored there profiles from backup.
> When I look on the PC when they are logged in in documents and settings at
> the profile they can only see certain folders: -
>
> Users Documents
> Desktop
> Favorites
> Start Menu
> WINDOWS
>
> They can't see: -
>
> Application Data
> Local Settings
> etc
> etc
>
> I thought at first it wasn't downloading those folders but if I log on as an
> administrator and click on the cached copy of there profile all the folders
> are there, it's only when they are logged in that they can't see it.
>
> It shouldn't be a permissions thing on the folder as they can download it.
>
> It's not that they are hidden as I clicked to show hidden files and folders.
> This is causing outlook to fail as they can't see the application data
> folder. Also no printers etc
>
> Anyone any ideas as to what’s happening here? Not sure if there’s an overall
> permissions issue because the way I got round this problem was to put all my
> users into the Domain Admins group, everything works fine now but I need to
> get them all out of Domain Admins asap!
>
> Any help would be greatly appreciated.
>
> Thanks in advance.
>
> Mike
>