hi,

i recently just created a TS using SCCM to image windows 7 for all my machines.

after formatting is completed, an error "The User Profile Service service failed the logon. User profile cannot be loaded" when logging in with a domain user account (local administrator account logging in OK)

after doing some research, found out that there is a permission denied issue on the c:\Users folder which is preventing the domain user accounts to be created.

i have found out how to solve the issue by "Check Include inheritable permissions from this objects parent and Replace all child object permissions with inheritable permissions from this object"

my question here is, does anybody know what can possibly cause this to happen?

thanks.

• Moved by Moiz Rassiwala[MSFT]Microsoft employee Friday, June 22, 2012 9:58 PM (From:Configuration Manager 2007 General)

it sounds like your OSD process or domain join process has removed "Domain Users" from the local workstation "Users" group, or has removed the default filesystem permissions. you should review the default permissions at each stage of your OSD TS steps to see where it's going wrong.

Hi Don,

In your opinion, normally what stage do you think this will happen?

thanks.

in TS for Ademin password have you configured??

system is joined in Domain?

after formating while joining in Domain may be system could not join in Domain.

"after formatting is completed"

What does that mean? Are you somehow trying to log in right after the format and parition task?

Do you mean after the TS is finished?

If so, how did you create your TS and what does it look like?

well, if a local user account is ok, and a domain user account is not ok, i'd start looking shortly after the domain join, or, for some GPO setting.
are you applying any form of hardening or lockdown at any point?
or possibly some form of script which is going awry, changing permissions, but perhaps at the wrong point in the filesystem.

Hi Jason,

sorry for the misunderstanding. yes i do mean after the TS finish. here is the screenshot of my TS

How did you create your image?

"Uninstall IE9"? What's that all about? Why install something and then uninstall it? I wouldn't be surprised if that is causing the issue.

Have you tried running the TS without any of the Install Software Tasks?

Why do you have the same tasks in both the Lenovo section and HP section? You should just move those out to a "Common" section or just as children of the Install Software group.

I just attached the picture using the attached icon.

The uninstall IE9 is because our firm has some softwares not compatible with IE9 so we need to downgrade it.

I have not tried running the TS without the Install Software Tasks yet, will give it a try.

Will move all the software tasks to a common one later, actually this TS is done by my colleague so i'm not too sure whats his idea on this built.

Thanks.

I meant the Windows Image (WIM) that you are deploying.

Why include install IE9 just to uninstall it though? That's backwards. You should only it install it if its OK. If IE9 is already part of your image, you should rebuild your image without it.

The problem is this image is given to us by our parent company in US.

In some other countries, we have certain software that cannot support IE9.

So you opinion is that this could be causing the issue.

But the issue of not being able to create a domain account happens intermittent.

Don't honestly know the exact root cause, just saying its bad joo-joos to install something with far reaching ramifications as far as the OS is concerned only to uninstall it.

I would start by removing all of the app installs and testing. Basically use a process of elimination to narrow down what may be causing the issue. If it never happens after you remove the app install tasks, you know its one of them causing the issue and you can start adding them back one by one until it recurrs. It's a long process for sure, but there' no other way to specifically know what the source of the issue is.

Obviosuly, this is not normal behavior and so something unique about what you are doing is causi

Hi Jason,

Will give it a try.

Thanks so much for you advise.

• Proposed as answer by WeNeedUs Friday, January 23, 2015 3:42 AM
• Unproposed as answer by WeNeedUs Friday, January 23, 2015 3:42 AM

Hi Guys,

LONG TIME I KNOW

The answer  should be your your profile share on your server had it's permissions changed.

These are the correct permissions

http://blogs.technet.com/b/askds/archive/2008/06/30/automatic-creation-of-user-folders-for-home-roaming-profile-and-redirected-folders.aspx