Access Denied Roaming Profile

By default the Roaming profile is only accessible for the owner (end-user) and the system account. I found a post on the internet with a workaround to access the profile without problems to the end user.

Using two tools, the first is SubInAcl.exe available from Microsoft (download), and the second is cacls.exe which you should already have by default in Windows.

    These first two commands will give the local administrators group ownership of the user’s folder and everything underneath. NOTE: This will not change any existing permissions.

    SubInAcl /subdirectories D:\Profile\User.Name /setowner=Administrators
    SubInAcl /subdirectories D:\Profile\User.Name\*.* /setowner=Administrators
    

    This second command will give the local administrators group full access to the user’s foldercacls

    D:\Profile\User.Name /T /E /C /G Administrators:F
    

Source Article

Author: Thomas Faddegon

Bla bla bla

  • Edwin de Bruin

    I also suggest to enable the following setting in a GPO

    “Add the Administrator security group to the roaming user profile share”
    found at Computer Configuration\Administrative Templates\System\User Profiles

  • Tnx for the feedback 🙂