Implementing Roaming User Profiles

To implement RUP for users of Windows Vista and later computers in an AD DS environment, follow these steps:

1. Prepare the file server where you want to store roaming user profiles for users by creating a shared folder on the server. (This server is sometimes called the profile server; a typical share name for this shared folder is Profiles.)
2. Assign the permissions shown in Tables 1 and 2 to the underlying folder being shared and to the share itself. Also, confirm that the permissions in Table 3 are automatically applied to each roaming user profile folder.
3. Create a default network profile for users and copy it to the NETLOGON share on a domain controller. Let it replicate to other domain controllers in the domain. (This step is optional and is typically necessary only if you want to preconfigure a roaming user profile for your users so that they will all have the same desktop experience when they first log on. If you do not create a default network profile, Windows Vista and later versions will use the local %SystemRoot%\Users\Default profile instead.)
4. Open Active Directory Users And Computers and configure the profile path on the Profile tab for each user who will roam.

Additional optional steps include configuring roaming profiles as mandatory profiles or as super-mandatory profiles if desired.

Table-1: NTFS Permissions for the Roaming Profile Parent Folder

Table 2: Share-Level Server Message Block Permissions for the Roaming Profile Share

Table-3: NTFS Permissions for Each User's Roaming Profile Folder

Table 2: Share-Level Server Message Block Permissions for the Roaming Profile Share

*This is true unless you set the Add The Administrator Security Group To The Roaming User Profile Share policy, in which case the Administrators group has Full Control (requires Windows 2000 SP2 or later versions).