Offline users may not be able to access cached profile resources when they log on with cached credentials (841801)


The information in this article applies to:

  • Microsoft Windows XP Professional

SYMPTOMS

If you log on to a Microsoft Windows XP Professional-based computer, you may experience the following behavior:
  • If you log on by using cached credentials, you cannot access your user profile resources that are located on a network share. For example, contents of the My Documents folder may not be available.
  • The homedrive and homepath environment variables that should point to network resources are set to local resources.

CAUSE

This behavior may occur if more than three users log on to a computer, and some contents of those users' homeshares are cached. This behavior occurs because Windows XP client-side caching (CSC) only stores the access rights of the last three users who accessed a file or a share. When a fourth user logs on, Windows determines if the user has access to the homehare path before it sets the homedrive and homepath environment variables. This check does not work because the user's credentials are no longer stored when three or more users have logged on with cached credentials since this user last logged on. Therefore, this user is denied access.

WORKAROUND

To permit more than three offline users to share one computer, configure the permissions on the user profile to give Full Control permissions to the Everyone group, and then make sure that only authenticated users have Full Control permissions for the home folder. To do this, follow these steps.

Warning Before you follow these steps, make sure that you understand the security implications of granting Full Control permissions for the profile path to the Everyone group.
  1. Determine the profile path and home folder path for the user profile. To do this, follow these steps:
    1. Log on as a user who has administrator credentials to the local computer that you want to share between more than three offline users.
    2. Click Start, click Control Panel, and then click User Accounts two times.
    3. Click the Advanced tab.
    4. Under Advanced user management, click Advanced.
    5. In the left pane of the Local Users and Groups window, click Users.
    6. Double-click the user who you want to find the profile path for, and then click the Profile tab.
    7. Note the profile path for the user profile and the home folder path.
  2. Edit the security settings for the profile path. To do this, follow these steps:
    1. Locate the profile path that you noted in Step 1.
    2. Right-click the folder, and then click Properties.
    3. Click the Security tab, and then click Add under Group or user names.
    4. Type everyone, and then click OK.
    5. In the folder_name Properties window, click Everyone in the Group or user names list, and then select the Full Control check box.
  3. Edit the security settings for the home folder path. To do this, follow these steps:
    1. Log on to the domain as a network administrator.
    2. Locate the home folder path that you noted in Step 1.
    3. Make sure that only authenticated users have Full Control permissions.

STATUS

This behavior is by design.
Modification Type:MajorLast Reviewed:5/28/2004
Keywords:kbprb KB841801 kbAudEndUser kbAudITPRO
©2004 Microsoft Corporation. All rights reserved.