samba - Dec 2014 - How to copy roaming profiles to new server ? ("Group policy client service failed. The logon access is denied")

Dear all,

We have perfectly working roaming profiles on Samba 3.3.10 (SuSE) with 
Windows 7 clients. We configured our new server with same domain name, 
Samba 4.1.11 (Debian).

On the new server, for newly created profiles, it works perfectly, we 
can login, logout, profiles are created and saved. But if we want to 
copy an existing profile from current server to the new one, it's 
impossible to login, we get the following error : "Group policy client 
service failed. The logon access is denied".

The rights on the files are correct on the server, but we are wondering 
if some data in the profile has to be changed ? For example in the 
registry or any other file...

The only warning we have in Windows is a "Search" that cannot access 
"csc:" with SID. This is a Windows Search registry.

Update : We tried to "mount" the user registry Hive on another
computer,
replaced all the user old SID by the new one, and even changed the 
rights on the registry. Then we saved it in the profile. Same problem.

Otherwise said, in addition to copying the profiles files to the new 
server, what should we do to have the old profiles load correctly ?

Feel free to ask for more details that you could find useful to 
understand/solve this problem that should arise for any roaming profiles 
migration, I suppose ?

Thanks a lot for any help !

Denis

Did you retain the domain SID?

This is done with:

net getlocalsid DOMAINNAME
net setdomainsid SID

Regards,
Marcel

2014-12-08 20:25 GMT+01:00 (lists) Denis BUCHER <dbucherml at
hsolutions.ch>:
>
> We have perfectly working roaming profiles on Samba 3.3.10 (SuSE) with
> Windows 7 clients. We configured our new server with same domain name,
> Samba 4.1.11 (Debian).
>
>
>

Hello Denis,

Am 08.12.2014 um 20:25 schrieb (lists) Denis BUCHER:
> We have perfectly working roaming profiles on Samba 3.3.10 (SuSE) with
> Windows 7 clients. We configured our new server with same domain name,
> Samba 4.1.11 (Debian).
> 
> On the new server, for newly created profiles, it works perfectly, we
> can login, logout, profiles are created and saved. But if we want to
> copy an existing profile from current server to the new one, it's
> impossible to login, we get the following error : "Group policy client
> service failed. The logon access is denied".

How are the IDs mapped on both servers? Do the users/groups have the
same IDs on both machines? E. g. if you store them in your AD / PDC
backend and retrive them on the fileserver, then you should be able to
simply copy the profiles and preserve the file permissions.

If you used a local ID mapping on the old server, you have to transfer
the idmapping DB, to keep UIDs/GIDs.


Regards,
Marc

Dear Marcel, 

No, in fact we got a new SID on the new server, and we tried to change
it in the profiles. (Without success) 

Do you suggest to simply keep the same SID on the new server ? 

Thank you very much for your help, 

Denis 

Le 08.12.2014 21:05, Marcel de Reuver a ?crit : 
> Did you retain the domain SID?
> 
> This is done with:
> 
> net getlocalsid DOMAINNAME
> net setdomainsid SID
> 
> Regards,
> Marcel 
> 
> 2014-12-08 20:25 GMT+01:00 (lists) Denis BUCHER <dbucherml at
hsolutions.ch>:
> 
>> We have perfectly working roaming profiles on Samba 3.3.10 (SuSE) with
Windows 7 clients. We configured our new server with same domain name, Samba
4.1.11 (Debian).

Le 08.12.2014 21:06, Marc Muehlfeld a ?crit : 
> Hello Denis,
> 
> Am 08.12.2014 um 20:25 schrieb (lists) Denis BUCHER:
> 
>> We have perfectly working roaming profiles on Samba 3.3.10 (SuSE) with
Windows 7 clients. We configured our new server with same domain name, Samba
4.1.11 (Debian). On the new server, for newly created profiles, it works
perfectly, we can login, logout, profiles are created and saved. But if we want
to copy an existing profile from current server to the new one, it's
impossible to login, we get the following error : "Group policy client
service failed. The logon access is denied".
> 
> How are the IDs mapped on both servers? Do the users/groups have the
> same IDs on both machines? E. g. if you store them in your AD / PDC
> backend and retrive them on the fileserver, then you should be able to
> simply copy the profiles and preserve the file permissions.
Yes, users have the same name. User "dbucher" is still
"dbucher" on the
new server and files have their ownership and rights preserved. 
> If you used a local ID mapping on the old server, you have to transfer the
idmapping DB, to keep UIDs/GIDs.
Yes, no problem on this side. But the problem seems to be with Windows
SID. 

Denis 
> Regards, Marc