Terminal Server User Profile - Delete Permissions

One frequent problem our help desk encounters is corrupted user profiles on the terminal servers.  Today those tickets are escalated to the server team to have the local user and roaming profiles deleted.  That team wishes to have this task moved
to the desktop / help desk.
I've built a script to perform this action, but desktop and help desk AD groups do not have sufficient rights on these servers to delete the user profiles.  NTFS permission changes will allow them the ability to delete the roaming profiles, but I don't
beleive this would be sufficient to delete the local profiles from the terminal servers (properly).
The script command I'm using to delete the local profiles is:
takeown /f $LPath.FullName /r /d y
I attempted using a service account to run the command within the script but I couldn't find a secure way to nest the password.  Can someone point me to the correct permissions needed for a regular user to properly delete a remote user profile?
Thanks!
There's no place like 127.0.0.1

Hi,
Thank you for posting in Windows Server Forum.
What kind of permission is assigned to your help desk users?
Firstly please check that your help desk users can delete the profile via “System Properties--Advanced tab--User Profiles--Settings button”. By deleting user profiles will delete the corresponding registry entries in addition to the folder under C:\Users
Apart still if you want to check the registry setting, we can verify and delete under below mention path.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Here need to find the respective SID for the users and the delete that SID and then again ask users to log back in which will create a new user profile.
Else your help desk user can get the permission for running below script through which they can delete the user profile.
Remove RDS Profiles
http://gallery.technet.microsoft.com/scriptcenter/5146833f-dd54-47a8-9941-b0889a456571
Hope it helps!
Thanks.
Dharmesh Solanki

Similar Messages

  • Can't copy past to desktop on Terminal server user profile

    Hi,I have a problem that I've seen posted in the forums but can not find a solution.  I am using windows 2008 r2 Terminal servers to log user on to the environment.  My users can't create/Copy/save files/shortcuts to the desktop.  My Terminal
    server profile path is filled out correctly and each user has full access to respective profile folder.
    Any help would be very much appreciated. 
    Thank you. 

    Hi,
    Thank you for posting in Windows Server Forum.
    Which client RDP version using for your environment?
    Please make sure that you not enabled “Do not allow clipboard redirection” in GPO setting under below mention path.
    Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection
    User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection
    More information.
    Make Local Devices and Resources Available in a Remote Session
    http://technet.microsoft.com/en-us/library/cc770631.aspx
    Also see that you have enable clipboard redirection. On client side please check following setting:
    1.  On Windows client machine, type mstsc.exe and press Enter.
    2.  Click the Options button, click Local Resources tab and make sure that the
    Clipboard check box has been selected.
    Hope it helps!
    Thanks.
    Dharmesh Solanki

  • Logon rejected for Unable to obtain Terminal Server User Configuration. Error: Not enough resources are available to complete this operation.

    Error: Logon rejected for  Unable to obtain Terminal Server User Configuration. Error: Not enough resources are available to complete this operation.
    The problem is that the SharePoint server will
    function just fine for a week or so and then suddenly when a new user tries
    to log on they get an error message indicating that not enough resources areavailable to
    log them on and also user will to credential prompt while accessing share point site . 
    Raj

    Hi,
    According to the error message, please use performance monitor to diagnose if it is a memory-related bottleneck and you can use the counters of the memory part in the article below:
    https://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx
    In addition, it may be due to thousands of open connections to the server are in a TIME_WAIT state. You can run "netstat -an" command on the affected server and client. If you see mutiple connections in the TIME_WAIT state, you can follow the article
    to increase the number of TCP/IP connections:
    https://msdn.microsoft.com/en-us/library/ee377084(v=bts.70).aspx
    Furthermore, if you are running windows server 2003, please make sure that you have installed the KB 948496 and stop all services that you don't need.
    Best regards,
    Susie
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Outlook is running to slow for terminal server users

    All tried but no luck .thanks

    Outlook is running to slow for terminal server users and very slow updating inbox. Can anyone suggest how can i increase speed for the users ?
    Office 2013
    exchange 2010
    This topic first appeared in the Spiceworks Community

  • Terminal Server User license file not found or User ID not matched.

    Hi,
    I recently went for the Process Runner, downloaded trial version and wanted to work with Ides system, but at the very first step the system throws the following error:
    "Terminal Server User license file not found or User ID not matched.
    and the details are as follows:
    Process Runner 2008
    Version : 4.20.10
    Supported file version: 7.3
    Current Framework: 2.0.50727.42
    User Name: Demo User
    Licensed  To: Demo Company
    Product Id : PR-ALL-DR-MTH-CU
    Full Version : 4.20.10.9579
    Current UserID : Administrator
    License Type : Evaluation/Demo License
    Evaluation Days : 1 of 30
    Licensed Uses : 5 of 15
    Expiration Date : 12/31/2011
    COMPANY : Demo Company
    MAX_ROWS : 30
    MAX_THREADS : 3
    USER : Demo User
    Current Node Id : DAAB-AA43-58DB-00DB-4862
    Max Instances Allowed : N/A
    OS-Office culture info : en-US | en-US | en-US | en-US
    C-Info : en-US
    Computer : SAPSERVER
    Current Domain : WORKGROUP
    OS : Microsoft Windows NT 5.2.3790 Service Pack 1
    AppPath : D:\Vijj downloaded\Process Runner
    MyDocPath : C:\Documents and Settings\Administrator\My Documents\Innowera
    Terminal Server User license file not found or User ID not matched.
    Can anybody guide me please.
    Thanks.

    Hi,
    According to the error message, please use performance monitor to diagnose if it is a memory-related bottleneck and you can use the counters of the memory part in the article below:
    https://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx
    In addition, it may be due to thousands of open connections to the server are in a TIME_WAIT state. You can run "netstat -an" command on the affected server and client. If you see mutiple connections in the TIME_WAIT state, you can follow the article
    to increase the number of TCP/IP connections:
    https://msdn.microsoft.com/en-us/library/ee377084(v=bts.70).aspx
    Furthermore, if you are running windows server 2003, please make sure that you have installed the KB 948496 and stop all services that you don't need.
    Best regards,
    Susie
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

  • Adding another exchange account Outlook 2013 Pro Plus for terminal Server users

    Really hoping someone can offer some advice on this one as I have wasted far to many cycles trying to figure this out.
     Company I work for recent purchased another company and we are in the process of bringing them into our network.  They currently run a a 2008 R2 terminal server where all users connect to for there day to day work.  A number of applications
    are installed including Office 2013.
    All users have Outlook 2013 configured to access their exchange server for email and this works fine.
    The first step in bringing them into our fold is to add an email account for Our Exchange  server without removing their existing exchange configuration or Outlook Profile.  So the one profile will have both exchange accounts listed and they can
    continue to get email from their server but as well email from our domain.
    I created a MSP file and tested pushing this out using PDQ Deploy to a few workstations here in our office and it works fine.  I then started to work on deploying in their environment.  PDQ Deploy will not work as they are all terminal Services
    Clients.  So I tried to push out via GPO.  I created the GPO Initially wanting to use a package and apply that GPO to an AD group.  However it will not let me deploy a MST as a package.  So I then tried moving it to a script that would
    run at logon.  That too is not working.
    I know I could enter install mode then run the MSIEXEC.EXE \config.MSP but that takes away the ability to control the role out.
    Any other ideas on how to get this done.

    Using the MSPfile method would require the logged-on user to have the necessary Windows permissions to run setup.exe, and on an RDS/TS Session Host, that's not likely to be available. (since it's not a great idea to give end-users those permissions on a
    shared system like RDS/TS)
    But you might be able to do it with a PRF file and an Outlook launch command, like this?
    http://technet.microsoft.com/en-us/library/cc179062(v=office.15).aspx
    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

  • Windows 2008 R2 File Server - user profiles appear underdirectory C:\user

    I've a windows 2008 r2 file server and  few day ago I've noticed that under directory c:\users some user profiles have been created.
    These users don't have rdp access to this server and don't use any ts application.
    Is this a problem or a normal behavior?

    Hello,
    IIRC this is normal behavior as they do a connect to the server to access the shared folders.
    Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
    Can you please explain in more detail?
    Why aren´t all users creating a local Profile on the fileserver?
    Kind regards,
    Tim
    MCITP, MCTS, MCSA
    http://directoryadmin.blogspot.com
    This posting is provided 'AS IS' with no warranties or guarantees and confers no rights.
    "If this thread answered your question, please click on "Mark as Answer"

  • Group Policy For 2008 Terminal Server Users Default Open With Not Working

    I'm trying to change the default open with behavior for jpg files on my terminal server. I created a Group Policy that changed it to MS Paint to Office 2010 Picture Manager. The policy appears to apply correctly but jpg files still open in
    Paint. When a user is logged on, if they look at the properties of a jpg, it shows Photo Gallery as the program to open it but when opened, it opens in Paint.
    Has anyone seen this behavior before?
    Orange County District Attorney

    > did. It would be helpful to know where the changes actually go in the
    > registry to see if they did or now.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • User profile deleted

    Hi,
    I deleted a standard user profile this morning - one that I was allowing my student to use on my computer. My student has since informed me that he had a Word document in that profile that he needs.
    I didn't archive this profile. Is there anyway I can get back the word document?
    Cheers
    Tim

    Hi Tim,
    Nope, for Security when an account is removed, immediately every thing is really gone.

  • Server/User profile time

    Hello experts,
    I am an SD/ABAP person. We have a set of App servers with load balancing with central Europe time. The same set of servers are used all over the world. Personal user time in User profile is set to the zone the user actually works. Is this a stable way to set the system?
    I understand, for example, that the posting date of a document would reflect user time and document creation date would reflect server time.
    Whats the best architecture for such a global scenario? Please share your experience.
    Thanks,
    Raj

    Hi Raj,
        In my experience most of the Customers I have seen use the same way you mentioned. Please check the following SAP Help document, might be useful
    http://help.sap.com/saphelp_erp2005vp/helpdata/en/50/dc9de3122211d3a54fdfb7b31fd578/frameset.htm

  • How to determine which AD server User Profiles is pulling from?

    I have a User Profile set up, and can't recall specifying an AD server.
    I've been asked to run multiple UP incrementals during the day. The SharePoint and SQL server seem capable of handling it, but I forgot to check performance of the AD server(s) during the nighly incremental.
    How would I determine which AD server is being used, so I can test CPU and memory?
    Thanks,
    Scott

    Go to:
    C:\Program Files\Microsoft Office Servers\14.0\Synchronization Service\UIShell\miisclient.exe
    On the Operations tab, if you look at any of the operations, there is a Connection Status box in the middle right. This contains the DC that it has connected to.
    Trevor Seward
    Follow or contact me at...
    &nbsp&nbsp
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

  • Windows 2008 Terminal Server "user must change password at next logon" problem with Windows 7 client.

    Hi,
    I have a fully patched Windows 2008 SP2 Terminal Server and a fully patched Windows 7 client.
    I have logged into the Windows 2008 SP2 Terminal Server server with a test account via RDC before.
    When I try to log in via RDC to the 2008 TS with a test account which has been marked with the setting "User must change password at next logon" I get the RDC message "You must change your password before logging on the first time.  For assistance, contact your system administrator or technical support."  I need to force the user to change their password once it has been issued, any ideas on how this can be done?
    Thanks,
    Dan

    This does not resolve my issue all the way. I'm having the same problem; When i'm "deploying" users, i always want the users to set their own passwords. Ok, so I then set the auth mode to "RDP Security layer". It seemed to work fine, and it does for that
    special purpose.
    Just like Daniel, my clients are connecting to our terminal server from several/different "customer-domains" So, they can't logon locally(on their local computer) and change their password, it has to be done THROUGH the terminal server.
    But if I turn on RDP Security Layer, users can't use remoteapp through tsgw they only get: "Your Remote Desktop Connection Failed because the remote computer cannot be authenticated" Any ideas?
    Also, our terminal servers is round robin based in a farm. So users connect to: tsfarm.domain.com(yes, public a-record which resolves to two internal adresses) This is because, we're using a wilcard *.domain.com as SSL certificate.
    But, when i'm using this, our clients sometimes get double auth when they login. I only get the double auth when tsfarm.domain.com resolves to server A, but the session broker wants the user to be on server B.(load balancing)
    This does not occur when SSL is enforced, any ideas?

  • Terminal server User folder view

    Hi all we are haveing som trouble in a mixed environment with a 2003 active directory controllers and two 2008 r2 x64 terminal servers with load balancing borker between them
    Our problem is when users are logged in to our new 2008 rdp server they get the 2008 one click view on all folders, this is both confusing and difficult for our users, is there any way to change this setting globaly so that the Organize-Folder options is set to double click on alle folders
    We have gone trought the local policy settings but cant get it fixed

    Ho Kristin Thanks again for your help.
    After i changed the Classic Shell gpo to enable, the users have the double click option in the folder view, but it the setting does not change, it is still the one click view.
    If i logon with any user  i can see that the folder setting actually is set to Double-click, and that the One-click view is grayed out.
    On our Ad controller who is a 2003 server, the Force Classic menu is enabled, maybee this is a issue in mixed environment so our Active directory gpo is doing something to our 2008 r2 ts servers.
    I have gone trough all our terminal server gpo's in the 2003 controllers and the only thing who does something with folders and viewa ia the Classic Shell gpo.
    So here is our config now
    2003 ad controller has Desktop Authority (Script Logic) installed
    2003 Ad controller gpo: Force classic start menu = enabled
    2008 r2 ts Local policy classic shell enabled

  • Terminal server user can't access B1 companies

    Client has terminal server configuration, but is not live.  I can logon as administrator and then into B1 as "manager" and access the OEC company as well as my test or live companies. 
    I just created my first user account on the terminal server... "amy".  I logged onto TS as "amy" without incident.  I then launched B1 and logged in as manager.  B1 then presents me with the "Choose Company" window, there are no companies listed to choose from.????  why???
    User "amy" is part of the "Administrators" group (for now) on the TS.
    I can login as Amy and access SQL server fine
    logging in as 'sa'.
    User 'amy' does not show as a user in sql server, but neither does "manager" or a B1 user I created in B1 called 'test'.  Since
    I never created a user account within B1 for "amy" I would
    not expect her to have a user id in sql, but I did expect to see a user for "manager" and "test".
    We have already tried rebooting the server.
    Any suggestions?

    Steffan - I have no idea where to go on ts to reset the "native client logon values" nor any ide how to do so.  i'll need some more guidance from you on this step.
    Bishal - The user "amy" appears nowhere in sql.  not under sql/logins or database/users.  This makes sense to me though because i only created "amy" as a ts user account which i wouldn't expect to automatically create a sql user for "amy".
    Gordon - The "use trusted connection" box was unchecked.  I went ahead and checked it and logged in as sa.  i immediately got an error msg....Login failed for user Headquarters/Amy.  Headquarters is the name of the domain at my client.  TS is part of the domain.  User "amy" also has a user account on the domain called "amy".

  • Cisco Unified MeetingPlace 8.5 with WebEx - User Profile Deletion

    Hi all,
    I'm running Cisco Unified MeetingPlace 8.5 with WebEx. In the WebEx administration page, I'm unable to delete any users and I'm only able to set them to be "Inactive". There's no function to delete them. Searching the web for answers only tells me that i'm unable to delete and only able to set it to be inactive. Has this changed with any recent releases / updates?

    Here is more information about User Profile restrictions in WebEx Scheduling/WebEx Managed Users deployments:
    http://docwiki.cisco.com/wiki/Cisco_Unified_MeetingPlace_Release_8.5_--_Choosing_a_WebEx_Deployment_for_Cisco_Unified_MeetingPlace_Release_8.5#User_Profile_Restrictions_for_Cisco_WebEx_Scheduling.2C_Mixed_Meetings
    -Dejan

Maybe you are looking for