Students - Mandatory Profiles Vs "NETLOGON\Default User" method?

Hi all,

CURRENTLY:
In AD we have the "Profile Path" for all students empty. We have a modified copy of a "Default User" folder in NETLOGON.

When a student logs into a computer they havent logged into before they get a copy of this default user from the netlogon folder on the DCs..

This was setup from: How to Create a Base Profile for All Users
But it would seem that this method is possibly way outdated.

When a student logs in it doesnt take them too long, they see "setting up internet explorer branding" among other popups, etc etc..

If we moved to a mandatory profile method, would this vastly speed up all student logins?

Has anyone tried both of the above to compare??
Thanks in advance

mandatory profile is so much better than roaming profiles, you have more control, and kids cant change any settings. I've kept my Mandatory Profiles below 4mb, which is great for wireless log-on, as its much quicker.
With Roaming profiles they can get very big and corrupted

What @burgemaster is suggesting is not a roaming profile - the profile won't get copied back to the server when they log off because there's no profile path specified.

Given that, he would be better with a mandatory profile but it won't speed up the login process (you need to remove some of the active setup items if you want to get rid of things like IE setup)

The mandatory profile will stop profiles being left on machines as users log off (unless the machine crashes or is hard powered off)

oh yeah I see what u mean now

Ive setup a MAN profile for the test user. a little speed increase which is good.

Also Our MAN profile is only 1.7meg.. Could I ask, as its so small am i missing steps that I should have done previously before copying the profile?
I just ran Office and a few other applications.

As we have desktop and startmenu setup from the server, can i clear both of these in the profile folder?

Thanks in advance

Quote:

---

Originally Posted by srochford

The mandatory profile will stop profiles being left on machines as users log off (unless the machine crashes or is hard powered off)

---

I still get a local copy of the profile on the machine mate.

Quote:

---

Originally Posted by burgemaster

I still get a local copy of the profile on the machine mate.

---

true.. you can avoid this with a GPO or with the tool uphclean
regards
bio..

You have to have the profile on the machine while the user's logged on. @Bio has pointed to a GPO setting (it's for Windows 2000 but I don't think it's changed since) that will delete these profiles when the user logs off.

UPHClean makes sure that profiles are closed cleanly at logoff (which is needed so that the group policy stuff can actually make them be deleted) but you can also use delprof (resource kit tool) as part of your machine startup script to clean up profiles which are left over following machine crashes etc.

Quote:

---

Originally Posted by srochford

(you need to remove some of the active setup items if you want to get rid of things like IE setup)

---

How do you remove active setup items?

Quote:

---

Originally Posted by chazzy2501

How do you remove active setup items?

---

depending on the item in question run it when creating the profile or in the case of ie/media player gpo

<long explanation>
Active Setup is a system used by a number of installers which need "something" to happen when each user uses the package that has been installed by an admin.

If you look in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components you'll see a set of GUIDs which identify various packages. As a user logs on, Windows checks this list and compares it with HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components. If you look at the list under HKLM you'll see that there's a version value for each one. If the version value is different (or missing) under HKCU then Windows runs the stubpath program from the HKLM bit.
</long explanation>

So, if you want to stop the active setup stuff running, one way is to try and capture what happens after a user logs on but sometimes this doesn't work (it writes stuff into HKCU which points to a user profile path that won't exist for other users or it writes the UNC of a home directory etc). The alternative is to either delete the Active Setup values from HKLM or just add the matching stuff to HKCU

This scripts gets rid of all the "Setting up personised settings for internet explorer", etc popups that appear top left when loggin in....

@echo off
setlocal EnableDelayedExpansion
set KEY="HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components"
set FND=find /i %KEY%
for /f "Tokens=*" %%a in ('reg query %KEY% /s^|%FND%') do (
set SP=N
for /f "tokens=*" %%b in ('reg query "%%a"^|find /i "STUBPATH"^|find "REG_"') do (
set SP=Y
)
if "!SP!" EQU "Y" reg delete "%%a" /V STUBPATH /F
)
endlocal

It's also worth running through what you're setting in group policy for the users.

Sitting down with a bare policy and a stopwatch and adding things one at a time, it's surprising how much time you can trim / add by setting or not setting various things.

You can do it with a populated policy too, but it's easier (and safer) to build from scratch in a test OU.

@burgemaster - I assume you're running that as part of machine startup (or your build process)? A normal user wouldn't be able to delete those values.

For most apps, that's not going to cause a problem but I know we deploy some apps (VMWare player comes to mind) where we've put in an active setup that we really do need to run for a user (it's trivial, doesn't display anything on screen and takes a fraction of a second but it was the easiest way to make sure the VM settings are configured properly for the user)

Woould any of this help me with my issue?

Since we came back in September I've been getting reports from Staff saying that all their settings have gone from their PC - Outlook settings/Sigs, Pinned taskbar/start menu items (we are using Windows 7)
When I check the Pcs i am seeing a lot of this:

username
username.DOMAIN
username.DOMAIN.000
username.DOMAIN.001
etc
etc

When I look in it there are random files that haven't been deleted - its not just limited to NTUSER.DAT

It's affecting the kids as well, but since they cannot customise their settings, is not a big deal other than loads of profile folders - I have added them all to the Domain Guests group which removes their profile at logoff, but this doesn't help for staff..
I have set a few staff up on Roaming profiles so that most of their settings are saved to the sever, but I would rather not be using them

Also not an option for staff is DELPROF.. not too sure about UPHClean - heard its in Beta for win7 and not sure if it deletes the profile

I have no idea why its started as there hasn't been any new software or any majopr policy changes made to the Domain.