Microsoft KB Archive/931091

= Requirements for using the &quot;/a&quot; command-line switch to run the Desktop Standard Profile Maker client =

Article ID: 931091

Article Last Modified on 2/2/2007

-

APPLIES TO


 * Profile Maker Professional 9.0
 * Profile Maker Professional 8.0

-



INTRODUCTION
If you run the Desktop Standard Profile Maker client by using a &quot;/a&quot; command-line switch, the Profile Maker client runs in the LocalSystem security context. In this scenario, Profile Maker can perform configurations that cannot be performed when the client is running in the security context of a specific end-user. There are several additional requirements that you must meet to run the Profile Maker client by using the &quot;/a&quot; command-line switch.



Elevate the Profile Maker Secondary service
To use the &quot;/a&quot; feature, Profile Maker must have administrative access to each client computer. To grant Profile Maker this access, elevate the Profile Maker Secondary service to run under a service account that is a member of the Administrators group. Perform this action on each client computer. To apply this configuration to each target server from a single location, use the Profile Maker Microsoft Management Console (MMC) snap-in. To remotely change the service account of the Profile Maker Secondary service, you must be an administrator of the remote server that hosts the Profile Maker Secondary service.

To change the service account of the Profile Maker Secondary service, follow these steps:
 * 1) Open the Profile Maker MMC snap-in.
 * 2) In the console tree, expand Network, and then click your domain.
 * 3) In the description pane, right-click the server that hosts the Profile Maker Secondary service, and then click Properties.
 * 4) On the Secondary Service tab, click Stop under Service Management.
 * 5) Click Change under Service Management.
 * 6) Click the This Account option, type the name of the account in which you want the Profile Maker Secondary service to run, type the account password, and then click OK.
 * 7) Under Service Management, click Start.
 * 8) Click OK to exit the Properties dialog box.

Note If the account that you select in step 6 is a member of the Domain Admins group, the account will have sufficient permissions. Otherwise, you must add this account to the Administrators group on each client computer.

Enable Remote Administration
The Profile Maker Secondary service must be able to copy the Profile Maker client to each client computer. Profile Maker does this by performing these steps:  Profile Maker remotely connects to the registry on the client computer. Then the program reads the %ProgramFiles% value from the  registry entry under the following registry subkey:

 Profile Maker remotely connects to the administrative share on the client computer.

Note By default, Windows 2000, Windows XP and Windows Server 2003 operating systems have several hidden shares for administrative purpose. For example, a drive C is shared as C$. Profile Maker copies the profmkr.exe file to the following folder:

%ProgramFiles%\AutoProf\Profile Maker\Client\Distribution

 Profile Maker sets access permissions for the Profmkr.exe file.

Verify remote registry access
For the &quot;/a&quot; feature to work correctly, the Remote Registry service must be running on the client computer. If the Remote Registry service is not running on the client computer, the error code 0x000006ba is returned. Additionally, the Profile Maker Secondary service must have the Read permission to the  registry entry. This entry appears under the following registry subkey on the client computer:

To verify the configuration, follow these steps:  To determine whether the Remote Registry service is running on the client computer, run the following command at a command prompt:

Net start

This command returns a list of services that are running on the computer. You can verify that the Remote Registry service is running if you see the following item in the command result:

Remote Registry

 If the Remote Registry service is not running, run the following command at a command prompt to start the service:

Net start RemoteRegistry

</li> Click Start, click Run, type regedit32, and then click OK.</li> Locate and then click the following registry subkey:

</li> In the Details pane, click ProgramFilesDir, and then click Permissions on the Edit menu.</li> Make sure that the Profile Maker Secondary service account has the Read permission. Typically, this account is a member of a group that has the Read permission.</li></ol>

Verify remote file system access
The Profile Maker Secondary service account must have the Write permission to the following folder on the client computer:

%ProgramFiles%\AutoProf\Profile Maker\Client\Distribution

The Profile Maker Secondary service accesses this folder by using the administrative share of the drive that hosts the %ProgramFiles% folder. For example, if the %ProgramFiles% folder is C:\Program Files, the Profile Maker Secondary service accesses the Distribution folder by using the C$ administrative share. Additionally, the File and Printer Sharing for Microsoft Networks option must be enabled in Network Connections.

Verify remote Service Control Manager access
The Profile Maker Secondary service contacts the Service Control Manager on the client computer to start the Profmkr.exe file as a service. This action requires that the Profile Maker Secondary service account is a member of the Administrators group on the client computer.

Verify that the Server service is running
The Server service must be running on the client computer for the following elements to work together correctly:
 * The Remote Registry service
 * The File and Printer Sharing for Microsoft Networks option
 * Service Control Manager

You can use the &quot;Net start&quot; command to determine whether the Server service is running.

Keywords: kbhowto kbexpertiseinter kbinfo KB931091

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.