Hi,  i followed your step.  It works well in windows xp but not window 7.  In windows 7, after profile migrate.  Domain user can get back everything but cannot double click anything in desktop and cannot get IP.  Any idea?

it worked in xp but won't in win 7,getting error while giving permissios in registry.

i disabled UAC, log in as domain admin still no luck

Please suggest

Any update on this? Works well in XP, but like the poster above. When in Windows 7, even local profile to local profile, unable to click on anything on start menu. Cannot Search and run explorer. Even changed ownership of Windows Folder from Trusted Installer to local user.

Any update? Works in XP like the other user stated, however in Windows 7 clicking on start menu generates and error, cannot even search for a process to run. It did work properly when I enabled the Administrator account and pointed the profile list from Administrator to "john doe", but the reverse does not.

Still getting the error messages with the new steps introduced above. UAC is turned off and when applying full control to even a local user, was receiving warnings that the permissions could not be applied to app data\local\...

I tried the Windows 7 instructions and it works like a champ! Thanks!

Thanks for the great guide. I ran it through on a test machine and it worked great. Unfortunately I then ran it on one of team lead's machines and everything looked great...until we tried to open Windows Explorer. Refused to open it. Went back to the first system I tried it on and sure enough: "Windows cannot access the specified device, file or path. You may not have the appropriate permissions to access the item." Logged on as admin, no issues.

I made him a power user, a local user, changed the permissions on the file, changed permissions and ownership on the entire Windows folder. No dice. Only after making him a local administrator (Way against my policies) was he able to use explorer. Any suggestions for the future would be great, but as it stands I'm forcing all users to create new profiles.

Hoping there's a quick fix to this I'm missing, but I'm a bit baffled. All the security settings suggest it's set properly. I did run into the issue in the registry permission issue "Registry Editor could not set security in the key currently selected, or some of its subkeys" but restarting and logging in only as admin didn't fix this. Perhaps this is causes this issue?

After changing the permission of the local home folder, I kept getting this message "Error applying security 'An error occured while applying security information to C:\user\user name\file or folder'".

Does this have anything to do with UAC? I temporarily disabled it but didn't restart the computer. Is it required to restart the computer after disabling the UAC? If so, do you think that's what's giving me the error message?

Domain to Domain migration using this technique in a windows xp sp3 environment. Receiving Error Userenv Event ID 1058 Logon Failure: Unknown User name or bad password

From time to time, I am having users experience the NTUSER.DAT file is in use when they are trying to log onto their machine. Rebooting the machine obviously fixes it, however they rely on using gotomypc and rebooting the computer can be difficult.

To resolve issue with error opening explorer.exe you need to copy AppData/Local/Microsoft/Windows/* from clean domain to local profile (especially UsrClass.dat file).

The methods listed below have been verified in a non AD domain, And in a virtual AD test environment. So if you use Domain level GPOs you may need to do further testing to make sure that the local gpo settings listed below are not over written by the domain policies. Also, if there is a Default User.v2 share in your netlogon shares you may need to set the permissions to that folder to "deny all" so that the windows 7 client won't pull whatever profile is there.

Non sysprep method (sysprep method follows)

Make group policy changes (these are what causes win 7 to not look toward the server for a default profile)
• Computer Config > Administrative Templates > System > User Profiles >
o Only Allow User Profiles = Enabled
o Set Roaming Profile Path for all users logging onto this computer = Disabled
o Prevent Roaming Profile changes from propagating to the server = Enabled
• Customize the Test or Setup account
• Enable built-in Administrator account
• Log on as Administrator
• Install RichCopy from Technet
• Use Explorer to unhide system files and folders
• Use RichCopy to copy the profile from the account used to implement customizations to "Default User"
• Join machine to the domain
• Reboot
• Log on domain user and all customizations that can be transferred should be applied to the users' profile
•
Sysprep Method - You may want to use this method because this method should be fully supported by MS
• Login as the setup account
• Enable Administrator Account - log off
• Log on as Administrator
• Go to Manage Users
• Delete Setup account and any other accounts that have a profile folder and choose "delete files"
• Make group policy changes
• Computer Config > Administrative Templates > System > User Profiles >
• Only Allow User Profiles = Enabled
• Set Roaming Profile Path for all users logging onto this computer = Disabled
• Prevent Roaming Profile changes from propagating to the server = Enabled
• Complete all customizations
• Copy validated answer file to C: root
• Go to windows\system32\sysprep
• Right click while holding shift and choose "open command window here"
• run "sysprep.exe /oobe /generalize /unattend:c:\yourunattendfile.xml
• Once the system reboots go through whatever portion of mini-setup your answer file dictates
• Join machine to the domain
• Log on as a domain user
• Basic look and feel customizations should have been applied from the local Defaul User profile

And as long as the local policies that we set above remain intact, any domain user that logs onto the machine will receive the look and feel that you want for your organization.

Because MS has not published a comprehensive list of items/settings that cannot be applied to a default profile, you will have to experiment with that. I did find a doc that made it clear that the quick launch as well as the area of the start menu where you "pin" shortcuts do not persist when copying customizations to the default profile.

So far in my testing, what I have found by using RichCopy is that none of the symlink/join folders get copied to default user and therefore there are no permissions to reset. I am still testing the various permissions but so far there are no leftover folders that have the wrong permission.

Because when the profile is propagated the first time for a new user all of the folders that don't copy are populated the way MS intended and because I haven't "forced" anything with bad permissions, the OS is able to set the proper permissions on for example "history" folder, the OS will take care when the structure is propagated from default user to the user logging on for the first time.

I do have 1 important piece of info to add, it seems that blocking access to the Netlogon share is what forces the client machine to propagate the local default user profile to the first time domain user and not the GPO's as I originally thought. I should be able to verify that by early next week.

If someone tests that prior to me please post your results. I know up til 6-9 months ago this was a huge issue for desktop admins and especially deployment techs. And even though the posts about this have died down, I don't know if people just adjusted their deployment process to use Netlogon for domain user profiles or found another solution that isn't posted or is on some obscure website, but for the organization where I work, using the Netlogon share for default domain user profiles is not flexible enough. And I didn't get good results when trying to reset the permissions on ntuser.dat in the registry nor taking ownership of the entire profile structure for the profile that I wanted to use. So to sum it up, there are still little details I don't fully understand but the way(s) that I have listed above have not left me with no access to "computer" or temp profiles being loaded - try it and let me know how it goes - appreciate it.

You guys are really rockstar...I was looking for this since last 15 days and finally it took me to this page and got the solution.
This is what exactly we were in need of....

I m just surprised to see the way you guys have solved the migration problem with windows7......

Hats off to you guys.......

Best Regards,
Farhan Ziya
Pepperfry.com

Hi .. done all - but somewhere two functions got lost or cut out:
1.) power options: they´re all set yet the machine does not entertain any of them!
2.) screen saver is also set BUT does not start; merely a flash - as if it wants to start - then the screen is showing normal operation.

Anyone out there who has a clue?
Thanks,
Gerd

A great set of instructions. there is a note by the original submitter about saved Outlook passwords being lost. I found several instances of the user's GUID being used inside of the ntuser.dat file itself. One of these "ProtectedStorageSystemProvider" which I think holds the Outlook passwords. So my question is, shouldn't all of the user's GUID references inside the ntuser.dat be changed as well?
Jon

btw, could someone incorporate all the fixes discovered along this post into one process? I admit I can't quite follow where I am supposed to make the corrections/updates. I am particularly interested in a step-by-step process to move the cached Domain user profile into a local user.

Gold star to all who have contributed - love your work !

This process has worked great for me. But I have had two users whose Chrome and Safari cannot access HTTPS sites once the switch is made. I will uninstall Chrome, reinstall it, and it works. But once the user shuts chrome down and opens it back up, the same thing happens, no access to HTTPS sites. Any ideas?

Hello all. I know this discussion is a year old, but I am going to be doing a big project where I need to migrate almost 20 local user profiles to domain profiles when we switch one of our client's P2P to a domain network.

I tried this in XP and it worked fine, but in Win. 7, when I get to the step where you replace the permission entries on child objects for the domain user, I get a notification:

"Registry editor could not set security in the key currently selected, or some of its sub keys"

Before I got that, after I clicked apply after selecting the Child Entries box, I got this message:

"This will replace explicitly defined permissions on all descendants of this object with inheritable permissions from ntuser"

I get the above message in Win. XP too (I'm doing this in Win. 7 Pro). Has anyone else had this happen? Is it normal? I am doing this on my VM (Win. 7 Pro 4 bit). I did the XP on my desktop PC (not VM). Could this be happening because I'm doing it on a VM? I don't think it should make a difference.

I'd really like this to work because it would be a huge project that would take a long time to do. It would save a lot of time and expense for our customer.

Thanks!

Nick.

Cool, works fine, you save my life, thanks!!

I used this technique on both Win 7 Pro and Win XP pro 32 and 64 bit without any problems. Emails, desktop, documents, settings, configs, everything transferred over. The only thing you need to document is the Outlook email passwords and I even did the username to be safe.

As was stated, the only thing that you delete or alter is the permissions and a reg key that tells Windows to look for the domain profile and not the local account. That's it. If you follow ALL of the instructions to a T then you won't have any problems. It's important to do the optional steps too, and take note of the usrclass.dat AND ntuser.dat files for Win 7. This is awesome and saves a lot of time for us (I work for an IT contractor) and money for our customers, especially when you have to migrate 18+ profiles.

This helped me a lot with migrating non-domain users to a domain, but I'm running into an issue with Outlook. After doing all of this on a Windows XP environment, I have managed to get everything to work except Outlook. Outlook will open on any user I launch it with except the one that I migrated the profile for. Upon opening, it gives an error that says "Cannot open Microsoft Outlook". I tried removing all Outlook files for the user, but that didn't work. I also tried to open up Mail in Control Panel, but it won't open when logged in as that user. It gives some memory error saying too many windows are open. I've also tried a repair on Office as well as uninstalling and reinstalling with no success. Any help with this would be greatly appreciated.

Will this work for migrating a Domain to a different Domain.We will be moving two stores from a Domain to our Domain. We purchased the stores and now we want to put them on our company Forest Domain.We will setup the servers first with new accounts then manually move the users. When we are done getting them on our Domain we will move their mail to our Exchange server. I have done this manually many times but this could save serious time.

I followed these steps and now all of the files are gone from My Documents. They are nowhere and I can't find them. Not in the original location, not in the new, just gone. Help would be appreciated. Sigh… maybe I did something wrong : /

Thank you! This worked exactly as described for a domain to domain profile migration.
My current employer purchased my original employer and all the assets along with it. That meant that they decommissioned my domain. In so doing, I was forced to join the new domain and feared losing all of my appdata configurations on my older domain profile.
Your solution worked perfectly. My IT infrastructure guy was skeptical but willing to try to do the migration (even if it destroyed my machine).
Wow! Were both he and I surprised when it worked!

For those not fancying fidling round in the I recommend using Microsoft User State Migration via USMTGUI. USMT is the MS authorized way to handle profiles. USMTGUI is a straight forward GUI for USMT.
Since MIGWIZ (Easytransfer) is no longer updated - gone as of Windows 10 - USMTGUI is the only user migration GUI left.

Backup the profile and then restore it. You can also restore the profile to another user/another domain.

usmtgui.ehler.dk

Nice Post !
Nice Research!!

nice post. its very useful to me. Its worked on Windows XP.
Thanks for sharing..
Such a great Innovative.