Profiles - How should they work

[garethedmondson]

This is an old one I guess, but how should mandatory profiles really work?

Our situation is this....

In AD each user points to a profile. At the moment this is set to: \\<servername>\ygg-userprofiles\staffv5

(It is the 5th generation of staff profile). It is a mandatory profile and the required .man file is in place. The profile is 2.98Mb.We assume it works.

When a user logs on, I assume they get given this profile and that it downloads to their machine. However how should this happen? WHen the profile downloads should it keep it's name - staffv5 when stored on the machine or will it rename itself to whatever user is logged in - thus creating several profiles if several users log in?

At the moment when we check the machine there are a few profiles on there - all of various sizes - they seem to grow.

I assumed that when they logged on the staffv5 profile would download to the local machine (2.98Mb of it) and sit there. Anyone else who logs in would then reference that profile (as it is the same).

What I didn't expect is several profiles there each with different user names.

IN addition if they do change usernames then I didn't expect them to grow. One staff member's profile is now at 8Gb - even though it is meant to be mandatory - which I assumed would keep it at 2.98Mbyte.

Is there a setting somewhere I have missed?

Any help appreciated,

Gareth

[squeeky]

if you are setting the profile on the server its a roaming profile. It downloads to the local pc and then when you log off it saves any changes to the profile back to the server. Personally i create a share called profile with a matching username eg 99fbloggs and then the profile path points to that. Otherwise when some muppet stores all their files on the desktop everyone has to download them with the roaming profile data. The profile also contains stuff like temp internet files etc if you dont turn these features off

[garethedmondson]

if you are setting the profile on the server its a roaming profile. It downloads to the local pc and then when you log off it saves any changes to the profile back to the server. Personally i create a share called profile with a matching username eg 99fbloggs and then the profile path points to that. Otherwise when some muppet stores all their files on the desktop everyone has to download them with the roaming profile data. The profile also contains stuff like temp internet files etc if you dont turn these features off

In that case where do I setup a mandatory profile that I want each user to use?
The LEA always had us use the AD setting but changing the permissions on the server so nothing writes back and also change the ntuser to .man instead of .dat

Hmmm - it seems we may have a roaming mandatory profile.


So where are we going wrong?

Gareth

[gshaw]

In theory the mandatory profile should be downloaded to the PC at each logon and at logoff any changes get discarded. That's what happens with our curriculum PCs, easy to test by changing the toolbars around in Excel \ Word, logoff and logon... do the changes persist or does it revert to the original profile settings?

There's also some GPO settings to delete cached copies of roaming profiles to remove clutter at each logoff. The only issue we've had there is some programs not releasing the registry and you end up with folders like user.000 in the profiles folder... UHPClean will sort that though.

As for user data is that redirected by GPO i.e. My Documents and Desktop being stored on a server?

[simpsonj]

I think, and I may well be wrong, that it works like this:

1, User logons on for the first time, pulls down the mandatory profile from server, which is then copied to the local hard drive under their username. So there is a profile folder on the local machine, 2.98meg big, called joe.DOMAIN.

2, User works away, and things get added to the local profile as different programs are used, files are saved etc etc

3, User logs out, joe.DOMAIN folder on the local machine is now 4meg in size

4, User logs onto the same machine, PC detects the local profile folder and so uses that instead of wasting time pulling down the mandatory profile from the server. Local folder increases in size.

5, User logs into a different machine, pulls down the 2.98 mandatory profile, local profile folder called Joe.DOMAIN is created, and so on.

Personally I don't worry too much about profiles on the C: drive of a machine, usually enough space to cope with massive profiles, and shouldn't increase the login time... Profiles that size on the server however will cause an issue.

If you're that worried, then there's a script that can wipe all non essentially profiles from the C: drive on log off or log on if you want, I'd have to dig it out though. Or probably a GP setting that will handle it, though I haven't managed to get it to work.

[gshaw]

That's pretty much it but not sure about step 4, iirc mandatory profiles re-download at each logon

[simpsonj]

Yes, I think you're right, I'm confusing mandatory with my staff profiles, which are turning into a nightmare, but that's a seperate issue entirely...

[2097]

they work like this

1.) User logs onto machine
2.) user pulls Profile off of Server and is created into a personal local profile
3.) any changes made to this profile are not kept
4.) when the user logs off the profile is deleted

Mind you does not always work out . Sometimes it does not remove the profile fully and if you goto document and settings and look at the folders you will see multiple instances of user accounts i.e. 2097.1 , 2097.2 etc

We use the Hive clean up service and a Script at startup which deletes all profiles on the desktop that Begin with 06/07/08/09 and 10 ( wouldnt want it deleting the staff local profiles )

[garethedmondson]

Hi Guys,

@simpsonj : Thanks for that. I'm glad it seems to be workign well.

@2097 : Great stuff. We use the Hive MSI to close the profiles properly as they do not get deleted. If you do have that script that would be excellent.

Many thanks

Gareth

[Gibbo]

Step4 is relevant, we sometimes find a user can't log in because there's a really long string in a web address in the cookies or some other Application Data folder. And this is with Mandatory Profiles.

[elsiegee40]

Hi Guys,

@simpsonj : Thanks for that. I'm glad it seems to be workign well.

@2097 : Great stuff. We use the Hive MSI to close the profiles properly as they do not get deleted. If you do have that script that would be excellent.

Many thanks

Gareth

Look for delprof in google/edugeek. It's what most of use to delete these profiles as they do tend to bild up!

[garethedmondson]

Yes I've used the delprof script before. I took it off for some reason - cannot remember why.

Gareth

[ajbritton]

A Guide to Profiles - Wiki

[maniac]

Profiles can be the most annoying and confusing things. As far as I can remember if there's already a local profile on the machine and a mandatory profile specified in AD, the mandatory profile is merged into the local profile at login, so any of the settings defined by the mandatory profile are enforced together with the content of the local profile.

To stop the build up of local data on the machines you will need to make sure all local profiles are cleared off the machine at logoff. There's several ways you can do this - I use the VBS script below as a start up script to clear out the documents and settings folders on XP. It's a bit crude as it still leaves traces of the profiles in the registry, but removes all the files. It was written by someone else on here I believe, but I can't recall who.

On Error Resume Next
	 Dim obtainfolder
	 Dim Pathfinder
	 Dim strPath

	 Set fso = CreateObject("Scripting.FileSystemObject")

	 strPath = "C:\Documents and Settings\"

	 userexcludelist = "Administrator,All Users,Default User,localservice,networkservice,"
	
	 Set f = fso.GetFolder(strPath)

	 ' Loop through all subfolders
	 For Each fldrItem in f.SubFolders
	   fldrName = fldrItem.name
	   If Right(strPath,1) <> "\" Then
	     Pathfinder = strPath & "\" & fldrName
	   Else
	     Pathfinder = strPath & fldrName
	   End If

	   If InStr(1, userexcludelist, fldrName, 1) Then
	    
	   Else
	    
	     set obtainfolder = fso.GetFolder(Pathfinder)
	     obtainfolder.Delete true
	   End If



	 Next

	 ' Clean up objects
	 Set fso = Nothing
	 Set fc = Nothing

You can also try installing the userhive cleanup service and turning on the options in Group Policy to delete local profiles at logoff, although I've not had a lot of success with this. You can also run Delprof from a script which is more through but takes a while to run sometimes depending on the size of profiles it's having to delete.

Mike.

[Gibbo]

You can also try installing the userhive cleanup service and turning on the options in Group Policy to delete local profiles at logoff, although I've not had a lot of success with this.

Same here. I've picked one machine at random and it contains the following:

7user
7user.network
7user.network.000
7user.network.001
7user.network.002
7user.network.003
7user.network.004
7user.network.005
7user.network.006
7user.network.007

Inside the profile are the folders Cookies, containing INDEX.DAT and Local Settings, containing hidden system files HISTORY and TEMPORARY INTERNET FILES.