"Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you logoff. You may receive this error message because of network problems or insufficient security rights. If this problem persists, contact your network administrator."

I wanted him to have a local profile, but Windows was trying to make it roaming.  Turns out the problem was that there was still a profile path in his account setting, which meant that it was trying to make him roaming.  Deleted that path, all is now well.