0

Windows Server 2016 installation with 3 Remote Desktop Services (RDS) session hosts servers, one domain controller. There is a user group configured for RDS users with group policies for a few settings.

The issue:

Logging into one of the RDS session host servers with a domain admin account, changing a file in one of the folders below c:\Program Files. If I now log onto ANOTHER server with the SAME domain admin login, this file has also changed there, on that other server! I haven't touched that server at all!

(I do understand this would happen if I change files related to users, i.e. in the user profile folders under c:\Users\, these are roaming profiles of a sort.)

Does this mean the "c:\Program Files\" is now also included in the user profile ...? That is entirely unexpected and I cannot find any hint or documentation that this should be so.

It is extremely annoying as I do not always intend these changes to be identical. It "could" be useful for a farm of RDS servers, but it is spooky - this "action on a distance".

When I log on with local admin, then the file I changed is unchanged. So it really seems that I the entire C drive has become part of the user profile ...?

Conversely, creating files in a local login in the "c:\Program Files" folder are NOT visible in any domain login, and vice versa.

DFS (Distributed File System) is not configured. Unless it configures itself by default? This is a clean install from scratch.

Steps to reproduce:

 log in with a local admin login
 create a folder "test-local" under c:\Program Files
 create a text file "test-local.txt" in that folder 
 sign out

 log in with a domain account (domain admin)
 look into c:\Program Files - the folder "test-local" is not present
 create a folder "test-domain" under c:\Program Files
 create a text file "test-domain.txt" in that folder 
 sign out

 log back in with the local admin account
 the folder "test-domain will not be present, you'll see only the "test-local" folder
nepdev
  • 391
  • 1
  • 7
  • 21

1 Answers1

0

If you attempt to modify files in C:\Program Files without elevating your permissions and with UAC turned on, Windows will "virtualise" the write by actually writing it into the relevant path in C:\Users\you\AppData\Local\VirtualStore instead of the real location, and mapping across in explorer so it looks like your change was successful. This is for backward compatibility with old programs that like to to write data to Program Files (bad and deprecated in Vista).

Likely this VirtualStore path is part of your roaming profile or equivalent and is then roamed to the other servers so your changes follow you. Although, it seems odd that the Local section of AppData would be roamed. Still, something to think about and dig further on.

Workaround, make sure you are running whatever you are editing/creating these files with elevated privileges.

Mintra
  • 561
  • 3
  • 7