Moving user profile breaks secure pages in IE

[mjdamico]

Hi,

OK. I’ll try to be mercifully concise. I’m migrating users from one domain to another, and I’d like to be able to migrate their local Windows (XP Pro) login profiles as well. If I have the user log in with their new user account, after the new local profile is created it essentially becomes an issue of directing one login name to a different local profile.

For example, user DOMAIN1\JimSmith logs into a local profile at C:\Documents and Settings\DOMAIN1.JimSmith. His login account is changing to DOMAIN2\JSmith. I’d like for DOMAIN2\JSmith to be able to log into the original profile at C:\Documents and Settings\DOMAIN1.JimSmith.

This seems like something that would be very common, however I have not found a definitive solution. Here’s what I cobbled together from researching this:

I have the user log in using his new user name which creates a new folder within Documents and Settings as well as a new entry in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList. I change the path name in the aforementioned registry key that refers to his new local profile. I load the NTuser.dat file from the user’s original profile folder into RegEdit and give full permission to the new user name. I go to the Advanced Permissions for the user’s original folder in Documents and Settings, edit the permissions entry for the original user name, and change the user name to the new user name in the new domain.

This seems to work great. The user logs in with the new account name and everything looks perfect. Desktop settings, bookmarks, favorites, e-mail settings are all intact. I’ve only found one thing that doesn’t work. Secure pages in Internet Explorer do not load. I receive a “Cannot find server” error page every time I try to connect to a secure page.

The only solution I’ve come up with is to give the user local administrative access. Power User doesn’t cut it. This is, of course, an impractical solution. Surely there’s got to be another answer. This profile migration method is almost flawless.

Thanks,
Mike

[mjdamico]

I was actually able to solve the problem with the help of RegMon, a freeware troubleshooting tool from sysinternals.

I first had to grant the user debugging privileges before I could run RegMon while logged in as him (because of default privileges, plain old users cannot run RegMon). I then launched Internet Explorer and browsed to a secure page. Then I went through the RegMon log and took note of all ACCESS DENIED entries. Several of them referred to keys in HKEY_CURRENT_USER.

I then logged in as administrator, loaded the users's ntuser.dat into regedit. Granted access to the appropriate keys, and sure enough, it worked.

RegMon rocks.