Roaming Profiles Log

1. If you have Authenticated Users = Full in shared, you don't need any of the others.

2. Your NTFS permissions have no way for a normal user to create their home folder. As such, you'll have to create the folder yourself. The best way to do this is to create all the home folders, and use chown to set the owner to them. That way they own the folder and you can use the Creater Owner security object to set permissions appropriately.

   I highly suggest that Creater Owner does not get Full Control, as this will also allow the users to muck with the permissions of their home folder, something they should never need to do.

   The alternative is to grant the "Create Folders" permission on the Profiles folder, and set it to apply to "This folder only". This will allow the users to create the folder, but it will only apply to that single folder. This will also allow any user to create any arbitrary folder.

The permission you have in the question would not have worked on Server 2003. Permissions are almost identical between 2003/2008/2008R2.

Can you link to Microsoft's recommendation, I've never heard that before from them.

If you don't want the RDS user profiles to roam then you'll need to enable Group Policy loopback processing in Replace Mode in the RDS GPO object so that user settings from the RDS GPO are applied rather than user settings from the GPO in the SOM (Scope of Management) of the user.