Home / server / Questions / 650050
Accepted
db_ch
Asked: 2014-12-09 09:49:39 +0800 CST

"Group policy client service failed. The logon access is denied" when copying roaming profiles to new server. (Samba)

  • 772

We have perfectly working roaming profiles on Samba 3.3.10 (SuSE) with Windows 7 clients. We configured our new server with same domain name, Samba 4.1.11 (Debian).

On the new server, for newly created profiles, it works perfectly, we can login, logout, profiles are created and saved. But if we want to copy an existing profile from current server to the new one, it's impossible to login, we get the following error : "Group policy client service failed. The logon access is denied".

The rights on the files are correct on the server, but we are wondering if some data in the profile has to be changed ? For example in the registry or any other file...

The only warning we have in Windows is a "Search" that cannot access "csc:" with SID. This is a Windows Search registry.

Update : We tried to "mount" the user registry Hive on another computer, replaced all the user old SID by the new one, and even changed the rights on the registry. Then we saved it in the profile. Same problem.

Otherwise said, in addition to copying the profiles files to the new server, what should we do to have the old profiles load correctly ?

Feel free to ask for more details that you could find useful to understand/solve this problem that should arise for any roaming profiles migration, I suppose ?

Thanks a lot for any help !

linux

1 Answers

  1. Best Answer

    Thanks to the help of people on [email protected], this is the solution to the problem:

    For anyone having the same problem and reading this in the future, I will summarize the solution here.

    Summary:

    • If you want to install a new server, completely replacing the current one,
    • keeping the same domain name,
    • especially if you have roaming profiles and want your users to keep the same profile on the new server,

    Solution:

    • then you should configure the new server with the same domain SID. (Having the same domain name with another SID is considered by Windows as being another domain).
    • After creating the users on the new server, you will have to change their SID to the same SID they had on the old server. (Otherwise you get the above error. It is not possible to log a user profile if the server and profile SIDs are not matching)
    • Note : on the opposite, you may change the groups (including the SID) without problem if you want.

    To do the migration once everything was tested:

    • On each PC, quit the current server domain.
    • Shut down the current server.
    • Start the new server.
    • Enter all PCs into the new domain.
    • Copy all profiles to the new server preserving rights.
    • There you are !

    P. S. I don't know if there is a way to avoid quitting and entering the domains.

    • 0