Article ID: 327259 - View products that this article applies to.
This article was previously published under Q327259
For a Microsoft Windows 2000 SP4 and Windows XP SP1 version of this article, see 327462
Versions of Microsoft Windows 2000 earlier than Service Pack 4 (SP4) and versions of Microsoft Windows XP earlier than Service Pack 1 (SP1) do not check the permissions of the target roaming profile folder if the folder already exists when a roaming user profile is created. This behavior might permit an individual to create another user's roaming profile folder in advance and to set permissions that might permit the creator of the folder to visit the folder later. The creator might then be able to modify the user's roaming user profile or to deny access to the legitimate user. Windows Server 2003, Windows XP Service Pack 1 (SP1), and Windows 2000 SP4 checks for correct permissions and does not permit roaming if the permissions are not those that Windows requires. This article discusses this new behavior in the products that are listed at the beginning of this article.
Windows Server 2003 uses the following steps to confirm correct security for roaming user profile folders:
Error messagesWhen you log on as a user that has a roaming profile and Windows Server 2003 determines that the roaming profile folder is not legitimate, you receive the following error message:
This new policy prevents Windows Server 2003 from checking for correct permissions on a user's roaming profile folder. Windows Server 2003 does not copy files to or from the roaming profile folder if the following conditions exist:
Windows did not load your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. Windows did not load your profile because a server copy of the profile folder already exists that does not have the correct security. Either the current user or the Administrator's group must be the owner of the folder. Contact your network administrator.
To change the "Do not check for user ownership of Roaming Profile Folders" policy setting:
Article ID: 327259 - Last Review: February 28, 2007 - Revision: 9.4