How to check roaming profile issues

samba4
shares
roamingprofiles
membermode

#1

Issue

Roaming Profiles are not working.
If you have problems with your roaming profiles, you can check or try the following steps:

Option 1.

Windows is updated with all patchlevels

Option 2.

You can apply the group policy “Always wait for the network at computer startup and logon”

Option 3.

If you use a netapp, there might be a solution to apply the GPO “Do not check for user ownership of roaming profiles”

Option 4.

You do have access on the profileshare with a new user but with a new user logged in at a windows 10 client, the profiledirectory ist created with <username.V6> but you get the error message when you log off: “There is a problem with the roaming profile service. It is no longer being saved.”

Option 5

The wbinfo check is very important, and should work:

wbinfo -a <Benutzername>%<password> oder wbinfo -a WINDOWSDOMAIN+<Benutzername>
wbinfo -u |grep -i <Benutzername>
wbinfo -n <Benutzername>
wbinfo -S <result of wbinfo -n >
wbinfo -U <result of  wbinfo -S>
wbinfo -s <result of wbinfo -U >

If you receive error messages as result from the checks, you should look in the winbindd-idmap logfile

Option 6.

Userfull information and commands to check:

:~# id <username> 
:~# univention-ldapsearch -LLLo ldif-wrap=no uid=<username> sambasid
:~# net getdomainsid
:~# getfacl <path to Share/Profilverzeichnis>
:~# samba-tool ntacl get <path to share/Profilverzeichnis> --as-sddl

Check the access via commandline:

:~# kinit <username> 
:~# smbcacls -k  //$(hostname -f)/<Sharename> / -U <Benutzername>
:~# smbclient -k  //$(hostname -f)/<Sharename>  -U <Benutzername>

#2