Domain User Problems On Server2003

Legion1987 · 04-17-2008, 01:07 PM

Hey there,

It seems I have a problem with the default configuration for the domain user group in server2003. I'll give you the full story to see if there was anything I did wrong.

This environment has 3 servers. There was an older Compaq that was the domain controller and hosted a few of their applications. The other 2 servers have server2003 and are basically just file servers. The old Compaq finally gave out, so I promoted one of the server2003 machines to be the domain controller. Now because it is a new domain, I needed to go to all the client PCs to recreate their profile, then copy their data to the new one.

Everything works fine if I make them a member of the domain admins group. If I take domain admins off their account, leaving them as a domain user their profile seems corrupt. Their desktop wallpaper is set to blue, the start menu doesnt have any quick start shortcuts, and I cannot open any applications. They all give different errors. *Edit* All the client PCs have Windows XP Service Pack 2, except for one Windows 2000 Professional PC. The Win2k PC has similar symptoms.

Just to make sure it wasnt some goofy setting with their domain (we did not set them up originally), I tried doing the same thing on a test domain with all default settings. I get the same results.

What is the best way to fix this problem so I dont need to have everyone running around with domain admin rights?

XtabbedoutX · 04-17-2008, 02:27 PM

How did you do the promotion to the new server. How did you replicate the data to the new server?

You should have just been able to DCPROMO the new server into the domain and DCPROMO out the old one and the new server SHOULD be working as if nothing ever happened.

Legion1987 · 04-17-2008, 02:45 PM

I may not have explained my issue correctly.

Without domainadmin rights given to a user, they cannot log into the domain without trashing their profile. It seems they do not have permission to customize their own desktop screen, they have less than guest permissions. The old server would not peacefully step down so we created a new domain and setup everyone with a new account. Giving everyone domainadmin rights and everything runs smooth as ever, take it away and everyone has issues when logging in.

Thank you in advance!

XtabbedoutX · 04-17-2008, 04:20 PM

Have you ran diagnostics on the server to see if anything is a miss? This is a very strange problem to have. It sounds as if the AD Database is trashed.

Dwarflord · 04-18-2008, 04:09 PM

Sorry about this answer, but have you made domain users local admins?
and are the profiles fixed or roaming?

Legion1987 · 04-19-2008, 07:22 AM

The profiles are fixed. I'm not sure what you mean about making domain users local admins.

We found a way to fix it the other day on our test network though. If we use the copy profile feature in WindowsXP it seems to work fine. The way we copied the profiles is manually copying the data from the old to the new one.

04-17-2008, 01:07 PM	#1 (permalink)
Legion1987 Registered User Join Date: Apr 2008 Posts: 10 OS: Windows Vista	Domain User Problems On Server2003 Hey there, It seems I have a problem with the default configuration for the domain user group in server2003. I'll give you the full story to see if there was anything I did wrong. This environment has 3 servers. There was an older Compaq that was the domain controller and hosted a few of their applications. The other 2 servers have server2003 and are basically just file servers. The old Compaq finally gave out, so I promoted one of the server2003 machines to be the domain controller. Now because it is a new domain, I needed to go to all the client PCs to recreate their profile, then copy their data to the new one. Everything works fine if I make them a member of the domain admins group. If I take domain admins off their account, leaving them as a domain user their profile seems corrupt. Their desktop wallpaper is set to blue, the start menu doesnt have any quick start shortcuts, and I cannot open any applications. They all give different errors. Edit All the client PCs have Windows XP Service Pack 2, except for one Windows 2000 Professional PC. The Win2k PC has similar symptoms. Just to make sure it wasnt some goofy setting with their domain (we did not set them up originally), I tried doing the same thing on a test domain with all default settings. I get the same results. What is the best way to fix this problem so I dont need to have everyone running around with domain admin rights? Last edited by Legion1987 : 04-17-2008 at 01:08 PM.

04-17-2008, 02:27 PM	#2 (permalink)
XtabbedoutX Tech, Microsoft Support Join Date: Sep 2007 Location: Oklahoma City Posts: 861 OS: Server 2K3 R2, Server 2K, XP PRO, Mac OS X 10.4, Mac OS X 10.5, Ubuntu Linux 7.10, iPhone My System	Re: Domain User Problems On Server2003 How did you do the promotion to the new server. How did you replicate the data to the new server? You should have just been able to DCPROMO the new server into the domain and DCPROMO out the old one and the new server SHOULD be working as if nothing ever happened. __________________ HJT - 5 steps against malware. Post your HijackThis log there and not here ! Posting system specs

04-17-2008, 02:45 PM	#3 (permalink)
Legion1987 Registered User Join Date: Apr 2008 Posts: 10 OS: Windows Vista	Re: Domain User Problems On Server2003 I may not have explained my issue correctly. Without domainadmin rights given to a user, they cannot log into the domain without trashing their profile. It seems they do not have permission to customize their own desktop screen, they have less than guest permissions. The old server would not peacefully step down so we created a new domain and setup everyone with a new account. Giving everyone domainadmin rights and everything runs smooth as ever, take it away and everyone has issues when logging in. Thank you in advance!

04-17-2008, 04:20 PM	#4 (permalink)
XtabbedoutX Tech, Microsoft Support Join Date: Sep 2007 Location: Oklahoma City Posts: 861 OS: Server 2K3 R2, Server 2K, XP PRO, Mac OS X 10.4, Mac OS X 10.5, Ubuntu Linux 7.10, iPhone My System	Re: Domain User Problems On Server2003 Have you ran diagnostics on the server to see if anything is a miss? This is a very strange problem to have. It sounds as if the AD Database is trashed. __________________ HJT - 5 steps against malware. Post your HijackThis log there and not here ! Posting system specs

04-18-2008, 04:09 PM	#5 (permalink)
Dwarflord Registered User Join Date: Dec 2007 Posts: 74 OS: windows xp	Re: Domain User Problems On Server2003 Sorry about this answer, but have you made domain users local admins? and are the profiles fixed or roaming?

04-19-2008, 07:22 AM	#6 (permalink)
Legion1987 Registered User Join Date: Apr 2008 Posts: 10 OS: Windows Vista	Re: Domain User Problems On Server2003 The profiles are fixed. I'm not sure what you mean about making domain users local admins. We found a way to fix it the other day on our test network though. If we use the copy profile feature in WindowsXP it seems to work fine. The way we copied the profiles is manually copying the data from the old to the new one.