Hi, I have setup an LXC container with ubuntu lobster, Samba 4.17.7 in an active directory dc.
(i followed the samba wiki and other sites on setting up and provisioning)

I almost have it working, I can join windows 10/11 computers but the login does not work quite right.
When a user logs in I get the error that they can't be signed in and event viewer shows this:

"Windows could not load your profile because a server copy of the profile folder already exists that does not have the correct security. Either the current user or the Administrators group must be the owner of the folder. "

I tried using pdbedit to set the profile path to the users home folder and also tried a GPO.
(gpresult /R does show the GPO is being applied)

For example if I set the profile path to //home/user/winprofile, the folder winprofile is created but I still get the error.
I have been reading and trying thins for days but I cannot get it to logon properly.

It looks like some kind of permission error but I can't find what it would be.

Any help would be appreciated.

I've been studying samba, so let me give this a try!

First, can you post your configuration for the samba domain controller, possibly minus any personal identifying information? Second, what type of profiles are you trying to use? Those two things will probably find a solution soon, I think. It will probably help someone find a solution even if I can't do it. But I'll give this a try, and see if I can help. I haven't actually messed with a DC in a live enviroment yet, not since it only supported NT4 style domains. But I'm headed that direction, as my server 2019 installation is meant for evaluation purposes only for me. I just wanted to learn about it from setting up a real domain and maintaining it, but I really want Linux to do the work instead for the 100% real thing, except if incapable.

P.S. - I would suggest after finding a solution, try to script the solution for being able to repeat it later. At least with joining a domain, that's what I did. You DO have to know bash scripting to give that a try, but I recommend it when possible. If that's too much, however, we'll just get you through any way we can.