NAC and AD, Machine GPOs, Roaming Profiles = Chaos

I've just observed a hapless Cisco consultant try to make NAC 4.1 work on computers with machine GPOs, roaming profiles, logon scripts within user GPOs, and for that matter legacy logon scripts with "run logon scripts synchronously" enabled. All of these technologies seem to fail on a NAC-enforced connection.
We assign software on machine GPOs and we use roaming user profiles, and it seems we either need to have a domain controller and profile share on the isolation VLAN, which defeats the purpose of NAC, or perform some kind of machine authentication, which can occur before GPO processing and net logons can happen.
While I'm not the Cisco consultant, it wasn't hard to recognize this problem.
Everything I've read about NAC and CAA suggests this is a per-user compliance solution and not a per-machine solution. Surely others have observed this, and I think this is what machine authentication (802.1x) NAC, as opposed to user authentication NAC, is all about. At the risk of sounding like a total n00b, where can I start researching a NAC solution that supports what I want and lets us use the Cisco NAC gear we've already invested in?

I have had similar issues and have solved many with a custom script that runs at log on. It is a compiled script and works great, AutoIT3.
The policy part takes care of itself if you leave machines logged in long enough or do a gpupdate /force. This will force the group policy to synchronize but you will need to log off and on again.
The roaming profile is much tougher. I am still trying to get this working. If anyone has any info on EXACTLY what takes place on a roaming profile synchronization, I would be grateful. If I can I will replicate that process in my script and solve this issue also.
I have fixed the log in script stuff with a delayscript that I use (ironically) clean access to install. You have to launch it with the users credentials, though and not from Clean Access which uses the SYSTEM users credentials in its stub agent!
This is a known issue to Cisco but any prodding of them to get it working would help. Their solution is braindead, just give unremediated machines full access! If they fail remediation, kick them off then. Gee, that gives the unremediated machine a mere two to three minutes to attack your AD DCs on each log in attempt. Not good.
Anyway, that's where I am at. Most of this can be dealt with, some is still problematical.
Dan S.

Similar Messages

Tablet 2 won't upload roaming profile

Tablet 2, Windows 8 Pro (factory installed), AD domain member, user account with roaming profile.
The OS will download my roaming profile when I log in, but refuses to upload it back to the server when I log off. I've installed Windows 8 (Enterprise) from scratch on two other computers (a Dell laptop and a Lenovo W500 laptop), and on those machines, the roaming profile works correctly. Has anybody else seen this behavior?
Bob

Have you tried to export to the "camera roll", and then try to export to you tube from the photos app?

AppV 5 slow to refresh with roaming profile (no redirects) but fast with local profile

Hi,
I have an issue I can't get thought out. I have an AppV5 SP3 full infra, with SMB share and local caching of packages enabled. Everything works from a functional level. However I have an issue where users with a roaming profile get a very slow AppV refresh
during login.
I created a few testaccounts, a few with local profile and a few with roaming profiles. For these testusers there are NO folder redirects. The only difference between them is local profile or roaming profile.
When I login with a local-profile user initially, the AppV client rather slowly refreshes the applications and shortcuts. It generates quite some CPU load on the RDS host, but as soon as the shortcuts are placed everything is fine. When I log that user off,
and log in again, the shortcuts are there immediately and I can immediately start the applications (Office 2010 for example). Blazing fast. Also when logging in, the refresh-UI is there for about half a second, it really flashes and it's done.
Then with a testuser with roaming profile, the initial refresh is about the same. But when I logoff that user and login again, it's all very slow. The shortcuts are there but blank initially, it takes about 5-10 seconds to get the correct icon. It takes
much longer before the refresh actually starts (sometimes up to 30 seconds after login), and it takes 5-10 seconds to do the refresh, with 100% cpu load on the thread AppVclient.exe is running on. Also right after loging in when the shortcuts are blank they
don't work until they get the proper icon. WHen everything is refreshed it works all fine though. It's just painfully slow at start.
I don't understand this. I can reproduce this every single time. Without folder redirects I don't see the difference between roaming and local profile from AppV perspective, as the roaming profile is of course copied to the server and in that sense the server
just works with a local copy anyway.
Anyone encountered this, and how to troubleshoot, or better fix this?

So is the fact that there is a 5-10 second delay during refresh actually an issue? What I mean by that is - are any users comparing the local profiles with roaming profiles experience, or complaining that the delay is there?
Roaming profiles and Folder redirection are of course very simple to configure; however for the best user experience I recommend managing profiles with a real profile management solution.
If you have MDOP, then you'll also have access to UE-V. You've mentioned your environment is RDS, which sadly doesn't get UE-V, even though you have App-V.
Here are some resources on UE-V + App-V and what's required when managing App-V with roaming users:
How To Use Microsoft User Experience Virtualization With App-V Applications
Application Publishing and Client Interaction: Roaming registry and data
Here's also some resources on App-V performance worth looking at:
Performance Guidance for Application Virtualization 5.0
App-V Performance Best Practices: New Project VRC White Paper
Please remember to click "Mark as Answer" or "Vote as Helpful" on the post that answers your question (or click "Unmark as Answer" if a marked post does not actually
answer your question). This can be beneficial to other community members reading the thread.
This forum post is my own opinion and does not necessarily reflect the opinion or view of my employer, Microsoft, its employees, or other MVPs.
Twitter:
@stealthpuppy | Blog:
stealthpuppy.com |
The Definitive Guide to Delivering Microsoft Office with App-V

Mac OS X Lion Server Roaming Profiles

I have Mac OS X Lion Server on my iMac and want to setup "Roaming Profiles" to be able to go into any one of my macs, laptops and desktops, and log in to the same profile. Any one know if this is possible and if so, how to do this???

You should be able to do this in the Workgroup Manager like http://www.dummies.com/how-to/content/how-to-configure-mobility-settings-on-lion -server-.html or in the Profile Manager. Depends on your setup.

Problem sending mail with roaming profile (Outlook 2010)

Hello all,
I hope you will be able to help me.
Here's the problem I have with Outlook 2010:
When a user opens a roaming profile on another
PC or on his new
PC, everything works perfectly except
Outlook.
Outlook opens normally with all email
accounts, you can even see the email, no worries
about that.
But when we want to send an email, it
gets stuck in the outbox.
Some additional info:
     - In the account settings,
you can test the account settings, it says
that everything is working (sending and receiving)
     - The only way I found today to
operate the account is to
completely remove and reconfigure
     - There is an error message
that says I can not write on the file C:\Users\UserName\AppData\Roaming\Microsoft\Outlook\accountName.pst
     - The problem occurs with
all users, not just one in particular
     - The accounts are IMAP
     - Incoming emails work
Thank you for your help.

Hi Tim,
This is a known issue in Outlook, we don't recommend using IMAP account with roaming profile.
For more information, you might want to read this similar thread:
https://social.technet.microsoft.com/Forums/office/en-US/f9b1bf03-d468-46e8-b40d-76fac11fd66c/outlook-2010-creates-new-imap-pst-files-at-random-and-cannot-send-mail-roaming-profiles-and-imap?forum=outlook
Regards,
Ethan Hua
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Cisco ISE NAC agent and Microsoft roaming profiles

Hi there,
I have installed Identity services engine version 1.1.3 in didstributed mode. The NAC agent is installed on the end user PC joined to the domain. when a user with a roaming profile logs into the PC, the NAC agent fails to run posture assesment, but if a user with non-roaming profile logs in, the NAC agent does posture and full network access is granted.
Is there something i need to do to enable the NAC agent to perform posture for users with a roaming profile.
Regards,
Henry

Hello,
I found the following from the cicso doc. Hope it helps!
The following failure scenarios might cause the Cisco NAC Agent to appear following successful user authentication when the client machine roams between CASs in Layer 3 (both In-Band and Out-of-Band) and Layer 2 /Layer 3 Out-of-Band environments. Erroneous Agent login dialogs could also appear if users roam from the Cisco NAC Appliance network in Layer 3 mode to a non-NAC network:
–ARP poisoning
–Temporary loss of network connection between the client machine and the CAS
–Access to untrusted interface IP address on the CAS from non-NAC network segments on NAC-enabled client machines
Cisco offers the following recommendations to prevent this situation:
–Ensure all trusted networks (post-authentication) can reach the CAS untrusted interface IP address through the CAS trusted interface only
–Block discovery packets from all non-NAC networks to the CAS untrusted interface IP address (discovery packets that arrive on the trusted interface of the CAS are blocked by default)
For more information please refer to the following link:
http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/48/cam/m_agntd.html

7310 - Problem with CIFS and Roaming Profiles since upgrade to 2010.Q1.0.2

We have developed a strange problem with our environment which I'm pretty sure is down to the upgrade to 2010.Q1.0.2 from 2009.Q3.4.1 on our 7310 (all the previous 2009 releases had been fine) since nothing else has changed in our environment. I suspect some changes to the underlying CIFS server causing this?
We have virtual Windows servers hosted on a VMWare VSphere cluster which are stored on the 7310 via iSCSI LUNs and also CIFS shares on the 7310 for home directories and separate CIFS shares for roaming profiles - all paths are correct in AD for each user - we also use folder redirection for XP Pro clients to force things like "Application Data", "My Documents" etc. onto the Homedir share.
What we've been seeing recently (which only started happening after the upgrade) is a lot of failed logons to the domain for users. It looks like the usual corrupted profile problem that has plagued Windows forever ...the usual messages that it cannot log the user on with a copy of their roaming profile, and that it will use a temporary one. Some folder redirections (that are initiated via Group Policy) also don't get applied. Users don't see errors when logging off from a "good" profile, and NTUSER.DAT etc. seemingly gets written correctly - the next time they log on, around half the time the users will get these errors as described below:
Event viewer logs show "cannot find the file specified" errors for NTUSER.DAT, along with "directory name is invalid" errors for some of the folder redirections.
More worrying (and what I think might be the real reason for these failures) are the "offline caching is enabled on the roaming profile share" errors. I think that the client-side caching might not be working - possibly the profiles aren't getting flushed and written correctly upon logout?
Now, unfortunately the MMC snap-in for managing shares doesn't seem to support changing the behaviour for client-side caching on the CIFS shares (as confirmed in the latest 7000-series Admin Guide on page 198).
I've been thinking about unchecking the "Enable Oplocks" box which from the CIFS side would completely stop all client-side caching I presume?
Is this likely to be the culprit here, or is there any other known behaviour that could be causing these errors? Is it also worth disabling "Cache device usage" altogether for the Profiles share itself?
Can anyone help? It's a bit of a strange problem, and something I don't want to raise with Sun on our support contract just yet, since at first glance it looks like a Windows problem, but I suspect the storage could well be to blame...

Unfortunately, this is still not working correctly...
So, it looks like it's not related to the offline caching seeing as it all works on the Q2009 despite the warnings...
Some more errors coming out of userenv.log on the affected Windows machines:
USERENV(280.284) 10:07:33:230 ReconcileFile: GetFileAttributes on the source failed with error = 2
USERENV(280.284) 10:07:33:230 CopyProfileDirectoryEx: ReconcileFile failed with error = 2
and later:
USERENV(280.284) 10:07:33:245 GetShareName: WNetGetConnection initially returned error 2250
USERENV(280.284) 10:07:33:245 CopyProfileDirectoryEx: Leaving with a return value of 0
USERENV(280.284) 10:07:33:245 RestoreUserProfile: CopyProfileDirectory failed. Issuing default profile
...which then forces the TEMP profiles.
All other errors linked to this look like "file not found", "invalid path" etc. when the files are present and the paths are correct.
Manually mapping drives using CIFS with UNC paths sporadically fails too now. We have a bunch of GPOs that map shares to users depending on their group memberships - these too are sporadically failing.
It certainly looks to me like it could be a CIFS problem introduced in the Q2010 release.
I'm going to raise a ticket with Sun...

Outlook 2010 - IMAP and Roaming Profiles

Hello,
If we setup a roaming profile user with an IMAP account in Outlook 2010 everything works on the machine the account was created on. If the user logs off and uses another machine they get the following message when trying to send an email:
"Task '*Email Address* - Sending' reported error (0x8004010F) : 'Outlook data file cannot be accessed.'
They are able to receive email without an issue.
I've seen other people report the same problem but with no fix reported. I wonder if anyone had made any progress on this.
Thanks,
Andrew

I have come up with a temporary solution. I say temporary because it involves redirecting the pst files to a network share, which is not recommended by MS. That said, our users have not had any issues with their personal/archive
pst files being on a network share as long as the PC they are working is local to the network share, i.e. in the same building on the same local network.
We have several users that share systems, some physical, some virtual, set up with roaming profiles. We ran into the situation described above when one of the users needed to access a gmail account via Outlook 2010. Along with roaming profiles,
the users are in a GPO which enforces folder redirection, so the server share was already set up..
\\ServerName\GPO_Redirect\%username%
I added the Outlook2010 ADM (outlk14.adm) to the GPO, and enabled... "User Configuration/Administrative Templates/Microsoft Outlook 2010/Miscellaneous/PST Settings/Default location for PST files" ...and set the value to \\ServerName\GPO_Redirect\%username%\OutlookPSTRedirect
I had to remove the existing IMAP account from Outlook and readd it. Doing so created the "OutlookPSTRedirect" folder automatically under the user's network share and the [email protected] file was created there. Everything seems to be working fine
after multiple logoffs and logons to different systems. No (2), (3), (4), etc. file versions are being created, messages do not get stuck in the outbox, folder view settings are remembered, etc., etc.
Apparently you can also set the "ForcePSTPath" registry value manually, but I have not tested that.

Roaming Profiles, FM9 and Acrobat Professional (9 and X) - Useful Info maybe to others

Just thought I would post this bit of information, which took me a long time to figure out and I still don't know why it happens.
Basically
Using FM9 (although have FM10 installed but cannot convert at the moment...not to mention...sigh...that a distributor sold that to us knowing that FM11 was about to be released!!!!!!!!!)
Windows 7 Professional, 64 bit
Recently upgraded to Acrobat Professional X (although the same problem happened with Acrobat Pro 9).
Could not get FM to publish to PDF (that is, print to PDF). I could distill, but then I did not get the bookmarks I needed (I tried to find an easy answer to that question, but that was a dead end involving programming).
I have spent too much time on this issue
A while ago, I found that by disabling a roaming profile, or deleting the files in the Adobe folder in a roaming profile, seems to fix whatever problem the PDF printer was having generating a PDF.
Thought I would pass that on in case someone else find it useful.

Amanda,
As Van says, yes you can have both seleced at the same time. I suspect there are other issues on your machine that are creating your problems. FWIW, I too have been running FM9 on a win7 64-bit platform with no issues.
The Roaming Profile is used typicaly with remote logins across a WAN (wide area network), however, application specific gets stored there - depending upon the application. Since you've seemed to have resolved the issue by deleting (or disabling the profile, i.e. the apps won't look there) the Roaming profile folder, it sounds like there might have been something corrupt or erroneous in the Acrobat data folders. When you installed your FM versions, did you deselect the accompanying PDFcreator option? If not and you had an existing Acrobat installation, then some items would have been overwritten, creating some issues for you.

Roaming Profiles - Office 2013, RAID 5 Failure oh and a Headache!

Your RAID failed to rebuild so you have used the same drives and re-created the same type of RAID again? I would say start by fixing this first
Delete the RAID, move to a RAID that if it degrades will not fail on rebuild.
RAID 10 would be your logical choice here as its blazingly fast and magnitudes safer to rebuild

Hello People,Wondering if someone can give me some friendly advice. The roaming profiles which my users have are around 13MB, we also user Folder Redirection alongside. The only item which is Roaming is the AppData, now looking in the profile which is using the disk space, is folders which belong to Office 2013, Bibliography and Document Building Blocks. I have downloaded and installed the Office 2013 GPO templates, and I am finding it hard to redirect these files to their documents.What I want to achieve is, point them folders to. Documents which is the H drive, so let's say H:\Office Templates\BibliographyThe other problem I am having, is my RAID 5. After an incorrect shutdown because we lost power, my Server failed the re-syncing process, so what I did was backup the drive and I deleted all the HDD from the server which this RAID 5...
This topic first appeared in the Spiceworks Community

Flash player 10 and roaming profile

Hi,
Some of my clients are having similar issues since they've upgraded from flash player version 9 to version 10. They all use roaming profile, i.e user documents and settings are stored on the server rather than individual machines.
The problem is that when they log in my application their login is successful but they don't get past that stage. This is because upon login, the application tries to write into a shared object but I believe it fails to do so.
If they revert back to Flash player 9, it's all fine. Client with no roaming profile don't experience this issue.
Therefore I believe there are some changes in Flash player 10 security. What should I do ?
Thanks

Hi !
I knew somebody from Adobe would finally reply
Well, I've actually come across this bug report this afternoon ! And I've asked my client to try the suggested workarounds. That was his reply :
' These work arounds are no good I’m afraid. These work arounds mean we have to mess around with file redirection which we don’t want to do. The reason these work arounds do work is that there is a Desktop folder in the local profile. When you re-direct the Desktop the local Desktop gets moved to the network. If we then re-create a local Desktop folder we break folder re-direction and there is potential for the user to have the wrong desktop displayed, or have files stored locally on their PC not being backed up. '
As you can see he's not so keen to change any network settings.
Do you have any other suggestions ?
Thanks

Local and Roaming profiles not being created

Hello all,
I'm in need of help and I wondered if there was anyone out there with some suggestions.
The problem is that one of our sites has Netware 5 and Zfd3.2 and there are no longer any roaming profiles or local profiles being created. Volatile user is not used. Roaming profiles go to the users home directory. All file rights are fine. DLU is still working. Novell client on W2K workstations is 4.90. All other sites appear to be OK.
I suspected that the user policy was at fault and so created a test user package and associated a test user to it = same result.
I have checked from top to bottom and compared all settings to other sites and can see no difference or anything unusual. I've been working on this for 2 days now and I'm going grey and bald.
Any suggestions anyone?
I'll buy a pint for anyone with the answer - LOL.
Thanks in advance
Alan Graham
email: [email protected]

elvisgraham,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Roaming Profile is roaming AppData\Local and AppData\LocalLow including Outlook OST file

Hi everyone.
Well my problem with Roaming Profiles here is the AppData\Local and AppData\LocalLow directories are roaming when I believe they should not. I see these folders are kept from roaming by default within the policy. I am concerned
because within the Local directory are the OST files. Some are large and I do not want them to roam. I can trick the workstation and configure Outlook to Online mode only and that works but what about all the other directories within Local and LocalLow?
I suspect since we had XP previous to 7, the old folder structure may still be in effect somewhere but am not certain. Others I’ve spoken with have seen this behavior but I have not seen a solution quite yet.
This post (http://social.technet.microsoft.com/Forums/windowsserver/en-US/1c618a22-b48a-43ca-81cc-64836c058207/appdatalocal-and-locallow-following-roaming-profile?forum=winserverGP) is close
to my problem but the reason it does not help me is I have created test new test users that have never had Windows XP and started out as new Win7 images. I placed the new users in a particular OU and applied a new folder redirection policy to that OU. There
is still a Default Domain Policy in effect for the entire forest but there is nothing in there (that I can see) redirecting any folders. The new policy I linked to the new OU redirects a few folders (music, pictures, desktop) to c:\temp so those do not roam.
Everything works fine except the AppData\local and AppData\LocalLow directories are roaming. The registry entry referenced in the above post shows everything to be fine, yet the
the AppData\local and AppData\LocalLow directories still roam.
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
and under ExcludeProfileDirs, type REG_SZ, the value is
AppData\Local;AppData\LocalLow;$Recycle.Bin
So now I am stuck. I will scour the Default Domain Policy again but quite frankly, there isn't much in there. Anyone have any other suggestions
as to what to look for in this case?
Thanks!

Hi,
Based on your description, we can check Applications and Services Logs in Event Viewer to see if some related services got crashed.
Besides, we can install the following hotfix on a troubled computer to see if it can fix the issue.
The desktop does not load and only displays a black or blue background after you log on to a computer that is running Windows 7 or Windows Server 2008 R2
http://support.microsoft.com/kb/2590550/en-us
Best regards,
Frank Shen

Best solution for data availability for end users --- reverse redirected folder and roaming profile

Roaming profiles and redirected folders do not seem to work for our environment. They often become troublesome and cause much help desk time and resources.
Is there a way to have a roaming profile and redirected folder configuration however have the local workstation have the primary copy and have the "server side" version be a backup?
This would seem to allow the user to have a constantly updated local copy and also have a backed up version on the enterprise server side available.

Hi,
I'm afraid there is no such function for saving the main copy on local side.
However if the sync of your roaming profile or folder redirection is not working well, it will still affect the result even if the function is available.
Also roaming profile is for "using same profile on different client computers", if the primary copy is on client it will not affect the purpose.
And for folder redirection it supports Offline Files so client should have a local copy when sync is not work.
If you have any feedback on our support, please send to [email protected]

Internet Explorer 10 cookies and roaming profiles (WebCache directory)

Hi,
I'm having a cookie problem on 2 out of 2 tested environments using Windows Server 2008 R2 (with roaming profiles) and Internet Explorer 10 (IEAK'ed) :S
For instance when I login to www.google.com with my username and password, as long as I'm using my Windows session I'm logged in to
www.google.com every time I open the browser (with all iexplore.exe processes closed before). When I logoff my Windows session my (roaming) profile is beeing saved on the fileserver and the locally cached Windows profile
is beeing deleted.
When I logon to Windows again (on the same computer) the roaming profile is beeing copied from the fileserver to my client (including the .txt cookies), but
www.google.com isn't logging me in automatically. The same thing happens with other cookies related stuff on websites :S
Also tried WITH and WITHOUT folder redirection for AppData/Cookies/etc, even a newly installed environment with Microsoft defaults is giving me problems.
Anybody out there having the same problem ?

Okay, I've made some progress on this today and it's working so far. It's still unclear what the following article/IE hotfix actually does:
http://support.microsoft.com/kb/2955387/en-gb
Because it's certainly doesn't magically fix getting cookies to fully roam - the webcache is still in the same folder. However, I think what it fixes is the problems reported above whereby any other stuff one want's to do with webcache fails
because the files are locked most of the time.
So with this hotfix in place, I was able to implement the following PowerShell logon script:
$SourcePath = "$LocalAppData\Microsoft\Windows\WebCache"
$LinkExists = $False
If (Test-Path $SourcePath) {
$Attributes = (Get-Item -Path $SourcePath -Force).Attributes
$LinkExists = [Bool]($Attributes -band [IO.FileAttributes]::ReparsePoint)
If (!$LinkExists) {
If ($Debugging) {Write-Host "Debug: deleting old webcache folder"}
Remove-Item -Path $SourcePath -Recurse -Force -ErrorAction SilentlyContinue
$TargetPath = "$RoamingAppData\Microsoft\Windows\WebCache"
If (!(Test-Path $TargetPath)) {
If ($Debugging) {Write-Host "Debug: creating new webcache folder"}
[void](New-Item -Path $TargetPath -ItemType Directory)
If (!$LinkExists) {
Write-Host "Configuring IE webcache to roam"
$Cmd = "cmd /c 'mklink /d " + $SourcePath + " " + $TargetPath + "'"
Invoke-Expression $Cmd 2> $Null
$LocalAppData and $RoamingAppData are variables that point to here:
C:\Users\myusername\AppData\Local
C:\Users\myusername\AppData\Roaming
What the script basically does is this set-up a symbolic link that links:
"C:\Users\myusername\AppData\Local\Microsoft\Windows\WebCache"
To:
"C:\Users\myusername\AppData\Roaming\Microsoft\Windows\WebCache"
When one logs off, WebCache roams to the network. When one logs on, it roams back and so far, cookies appear to be sticking. We use Spiceworks and before one had to type username & password each time. In my test, the logon details are persisted.

NAC and AD, Machine GPOs, Roaming Profiles = Chaos

Similar Messages

Maybe you are looking for