Active Directory roaming profile permission issue on folder C:\Users\<user>\AppData\Roaming\Microsoft\Installer

Question

I have a problem with one specific folder while user profiles are synced at logon. Let me explain the situation:

I have:

• A user account (MYDOMAIN\accountname)
• Security group 'Access to WADUP_RW'
• A SMB share (\\my-smb\WADUP)
• A pc with Windows 10 pro installed (Up-to-date) and joined into MYDOMAIN

Permissions on the WADUP folder on \\my-smb:

• 'Access to WADUP_RW' has read and write access
• Domain Admins and Enterprise Admins groups have read and write access

Configuration for the user account:

• Profile path: \\my-smb\WADUP\accountname

The problem I'm having:

1. Log in accountname on the pc.
2. \\my-smb\WADUP\accountname folder is created. (Owner is accountname)
3. Log out accountname on the pc.
4. All data in user profile is being saved to the \\my-smb\WADUP\accountname
5. So far so good
6. Now I log in accountname on the pc again
7. I get the error 'There was a problem with your roaming profile. You have been logged on with your previously saved local profile. Please see the event log for details or contact your administrator.'
8. I check the event log, which says that \\?\UNC\my-smb\WADUP\accountname\AppData\Roaming\Microsoft\Installer can't be copied to \\?\C:\Users\accountname\AppData\Roaming\Microsoft\Installer with DETAIL - Access is denied

9. I check the folder C:\Users\accountname\AppData\Roaming\Microsoft\Installer permissions, which are:

   • Everyone: Read
   • System: Full control
   • Administrators (PC\Administrators) Full control

What I've tried:

• Changed SMB server, made no difference.
• Manually changed the folder permissions to everyone: Read and write. Though the permissions reset whenever I logged out.
• All Pc's do it but they are the same windows version.

Solution

After 11 month we managed to figure the problem out:

We have a policy on our domain controller that requires a domain admin to login to install software. This makes sure that users aren't able to just install all kinds of software on our workstations.

However we needed a way for some programs that lot's of people use to be rolled out on workstations. This is where we created this problem; we used gpo's to rollout software that can be installed via 'Control panel > Programs and features > Install a program from the network'.

Whenever a user uses this way to "install" rolled out software, it creates the 'Microsoft/Installer' folder in roaming with admin permissions and is not able to sync anymore.

We have bid farewell of this way of software management and removed the 'Installer' folder from the local profile and the smb profile, this has fixed the problem completely.

Comments

[Rick Jelier]

I already have stumbled upon that post indeed, I really want to do this but it feels like a workaround. Plus the fact that the problem I am having doesn't show up anywhere else makes me worry it's not a bug in Windows but actually a misconfiguration in my setup.

[Hrihaan]

I didn't notice anything actually wrong with your setup, but Microsoft does have a helpful documentation on deploying roaming profiles you might want to review and compare to your setup. The document has a lot of steps that don't relate to your smaller setup, but it's a good reference for best practices.

[Rick Jelier]

Hi, we already tried this but the folder reappears after login on the local machine.