My own Windows Active Directory Problems Experiences...
The relation between NTUSER.DAT and NTUSER.POL
Hell..why one roaming profile user is not getting those policies which I have applied on my domain? This is ridiculous... I wasted my 5 days to fix it. This user was not supposed to get the control panel items and other administrative privileges but it was happening..
Cause
When a roaming profile user logs off, the NTuser.dat file is always updated on the roaming profile share. The corresponding NTuser.pol file is only updated if the timestamp of the local copy that was created at logon is newer than the copy found in the roaming profile share. A synchronization problem may occur if a user with a roaming profile logs on to multiple client computers at the same time. This can eventually cause policy settings to be applied incorrectly.
For example, if the Group Policy loopback feature is applied on one of the client computers, the NTuser.dat file on the roaming profile share may contain loopback policy settings that are not present in the NTuser.pol file. If this problem occurs, the loopback policy settings that are targeted at one client computer may be unexpectedly applied to a user who logs on to a different client computer.
How I fixed?
Its so simple than following below content..Its really hard to update your servers, specially Domain Controllers until available patches and updates are tested. Lack of time, pressure to fix this at any cost...When i observed that, this problem may be due to sync between NTUSER.DAT and NTUSER.POL I decided to regenerate the NTUSER.DAT for that problematic user. Simply renamed the profile with Administrative rights and asked user to relogon on the network..Great...her desktop was changed and now she was just a simple domain user with some limited rights....It worked.
The relation between NTUSER.DAT and NTUSER.POL
Hell..why one roaming profile user is not getting those policies which I have applied on my domain? This is ridiculous... I wasted my 5 days to fix it. This user was not supposed to get the control panel items and other administrative privileges but it was happening..
Cause
When a roaming profile user logs off, the NTuser.dat file is always updated on the roaming profile share. The corresponding NTuser.pol file is only updated if the timestamp of the local copy that was created at logon is newer than the copy found in the roaming profile share. A synchronization problem may occur if a user with a roaming profile logs on to multiple client computers at the same time. This can eventually cause policy settings to be applied incorrectly.
For example, if the Group Policy loopback feature is applied on one of the client computers, the NTuser.dat file on the roaming profile share may contain loopback policy settings that are not present in the NTuser.pol file. If this problem occurs, the loopback policy settings that are targeted at one client computer may be unexpectedly applied to a user who logs on to a different client computer.
How I fixed?
Its so simple than following below content..Its really hard to update your servers, specially Domain Controllers until available patches and updates are tested. Lack of time, pressure to fix this at any cost...When i observed that, this problem may be due to sync between NTUSER.DAT and NTUSER.POL I decided to regenerate the NTUSER.DAT for that problematic user. Simply renamed the profile with Administrative rights and asked user to relogon on the network..Great...her desktop was changed and now she was just a simple domain user with some limited rights....It worked.
Resolution (Standard)
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.
If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.
If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.
Prerequisites
Windows Server 2003, Windows XP SP1, Windows 2000 Server SP3, or Windows 2000 Server SP4
Restart requirement
You do not have to restart your computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other hotfixes.
File information
The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Windows 2000:
Date Time Version Size File name
----------------------------------------------------------
19-Dec-2003 14:40 5.0.2195.6824 42,256 Basesrv.dll
20-Sep-2003 16:45 5.0.2195.6824 236,304 Cmd.exe
19-Dec-2003 14:40 5.0.2195.6882 222,992 Gdi32.dll
19-Dec-2003 14:40 5.0.2195.6867 711,440 Kernel32.dll
19-Dec-2003 14:40 5.0.2195.6824 54,032 Mpr.dll
19-Dec-2003 14:40 5.0.2195.6883 334,096 Msgina.dll
19-Dec-2003 14:40 5.0.2195.6882 90,232 Rdpwd.sys
19-Dec-2003 14:40 5.0.2195.6882 380,176 User32.dll
19-Dec-2003 14:40 5.0.2195.6886 391,440 Userenv.dll
18-Dec-2003 16:13 5.0.2195.6886 1,630,192 Win32k.sys
10-Nov-2003 16:29 5.0.2195.6873 182,032 Winlogon.exe
19-Dec-2003 14:40 5.0.2195.6884 243,984 Winsrv.dll
Windows XP:
Date Time Version Size File name
-------------------------------------------------------
23-Dec-2003 14:34 5.1.2600.1330 669,184 Userenv.dll
Windows Server 2003:
Date Time Version Size File name
------------------------------------------------------
21-Dec-2003 12:14 5.2.3790.115 754,176 Userenv.dll
