+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 26
Windows Thread, Default profile and GPOs EDIT: Now how to install hotfix in Technical; Hi, We're just setting up a Win2k3 domain and are having a bit of trouble with profiles. We started off ...
  1. #1

    Join Date
    Jul 2006
    Location
    Exeter
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Default profile and GPOs EDIT: Now how to install hotfix

    Hi,

    We're just setting up a Win2k3 domain and are having a bit of trouble with profiles. We started off using Mandatory profiles for the kids, but then found out that it was overriding any new GPOs that were set, so we've decided to go roaming, locking down with group policy. However, I also found out that if I create a Default User profile in the NETLOGON folder, that too overrides GPOs (well, at least the proxy settings GPO that I've been testing it with). Log on to a machine with a test student user that downloads the default profile, and they have filtered proxy settings - fine. Log off, delete their profile, change the GPOs so that unfiltered proxy settings are attached to their OU and remove the filtered ones, log on, download the default profile and the filtered settings still apply. Anyone have any ideas?!

    Joe

  2. #2

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227

    Re: Default profile and GPOs

    The default profile is used to create new profiles. Thus it has no effect on existing profiles. Therefore what happens:

    1. new user logs in
    2. windows makes a new profile using the default profile
    3. user logs out.
    4. user logs in again.
    5. existing profile is used.
    6. group policies are applied.
    7. user logs out.
    8. go to step 4.

    Also, bear in mind there is a 90min delay before workstations pick up GPO settings changes.

  3. #3

    Join Date
    Jul 2006
    Location
    Exeter
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Default profile and GPOs

    I should have stated that Fast Boot is off, so group policy is refreshed every time the user logs on - it shows up in a gpresult which is the most bizarre thing. And step 5 doesn't happen because I deleted the local profile in between the user logging out and in again so they would download the default profile again.

  4. #4

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227

    Re: Default profile and GPOs

    Fast boot has no bearing on the 90min update delay.

    Group policies are applied before the default user profile is copied. Which is why you aren't seeing their affects.

    Stop deleting local profiles or use mandatory profiles instead.

  5. #5

    Join Date
    Jul 2006
    Location
    Exeter
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Default profile and GPOs

    It doesn't for the computer policies (unless you restart the computer) but the user policies it certainly does - as I said, the gpresult I did showed that the new policy came into effect. So by your theory, if I don't delete the user's profile, the new GPOs will be applied when they next log in? Mandatory profiles unfortunately have the same problem, which is why I want to move to roaming.

  6. #6
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    4,995
    Thank Post
    123
    Thanked 286 Times in 263 Posts
    Rep Power
    108

    Re: Default profile and GPOs

    Something is wrong there you shouldnt be seeing this type of outcome.

  7. #7

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227

    Re: Default profile and GPOs

    btw, you might want to start using the GPMC rather than gpresult. It makes diagnosing these problems a lot easier.

    Basically the 'Way to do it'(tm). Is to setup a default user profile on either your machine image (ghost, ris, whatever) or to have one in the netlogon. Then everything else you can't set up globally in the default profile must be put in group policies. There's no need for mandatory or roaming profiles with this approach.

    After a couple of logins everything should be working fine.

    However, that said, mandatory profiles can be used to much the same effect. Especially for kids. Where you want everything to be the same and tight control over settings that aren't controlled via GPO settings.

    It really comes down to personal preference and what your comfortable with.

  8. #8

    Join Date
    Jul 2006
    Location
    Exeter
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Default profile and GPOs

    I think I've actually found the solution - when I created the mandatory and default profiles I was logged on to a machine with a Domain User, so group policy was being applied. I just created a profile with a local user (so no group policy was being applied) and uploaded that, and it seemed to work. I'll test it more thoroughly, but I think that's fixed it - I'll just stick with my mandatory profiles.

    Oh, and I was using GPMC to actually create and manage group policy, but gpresult on a machine that's having problems is incredibly useful, to see what policies are actually being applied.

    Thanks for talking it through with me!

    Joe

  9. #9

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227

    Re: Default profile and GPOs

    If you use the 'Results' section of the GPMC you can profile the machine that's broken without ever going near it.

  10. #10

    Join Date
    Jul 2006
    Location
    Exeter
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Default profile and GPOs

    Ah, I didn't know that. It is sitting right next to me though, so it doesn't make much difference!

    Ok, well it's not working. Not entirely sure whether it was in the first place - maybe it was all just a figment of my imagination...

    Anyway, so downloading the mandatory/default profile (they're both pretty much the same) now results in me not being able to get on the internet at all. I think it's only the IE branding that's not working because all the other policies seem to be unaffected. If I just pick up the local default profile, then it works fine.

  11. #11

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227

    Re: Default profile and GPOs

    Are you using Folder Redirection of the Application Data folder?

  12. #12

    Join Date
    Jul 2006
    Location
    Exeter
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Default profile and GPOs

    Yes... Why?

  13. #13

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,850
    Thank Post
    110
    Thanked 598 Times in 514 Posts
    Blog Entries
    1
    Rep Power
    227

    Re: Default profile and GPOs

    There's a bug that stops the IE branding from applying if you use that paticular type of folder redirection. There is a hotfix avalible from microsoft.

    http://support.microsoft.com/?id=888254

  14. #14

    Join Date
    Aug 2006
    Posts
    12
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Default profile and GPOs

    I don't know if this helps, but I've found that if you have a mandatory profile and apply Group Policy, the Group Policy will not apply unless the user is an administrator on the local computer. GPResult will say that it applied the policy, but the settings will not apply.

    Related to this, I've also found that if the profile that you move to the default user on a local computer had a Group Policy applied to it(domain or local), then the policy will continue to apply to any profile that gets created from the default user, and GPResult will never show it being applied! I've made a point for the technicians to only copy the local administrator's profile (no domain GPOs) before any local GPO is created if they want to tweak the default user profile settings. Otherwise we end up with "ghost" group policy settings being applied.

    Maybe what you're experiencing is related to either of those situations.

  15. #15

    Join Date
    Jul 2006
    Location
    Exeter
    Posts
    15
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Default profile and GPOs

    The 'ghost' group policy settings is exactly the situation we're in. However, I found that if you create the default/mandatory profile from a local user rather than a domain user, there are no 'ghost' GPOs.

    However, I haven't experienced your first comment - as far as I can see, all policy is being applied correctly except the IE branding.

    Thanks for the link Geoff - that looks like the thing I've been after. Pity I have to phone up MS to get the hotfix I'll have a look at it tomorrow.

    Have a good evening!

    Joe



SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. GPOs combined with mandatory profile
    By edsa in forum Network and Classroom Management
    Replies: 7
    Last Post: 31st October 2007, 11:40 PM
  2. Vista default profile on domain
    By netadmin in forum Windows Vista
    Replies: 0
    Last Post: 27th February 2007, 01:37 AM
  3. Where's the default profile???
    By secman in forum Windows
    Replies: 7
    Last Post: 17th February 2006, 01:11 PM
  4. Replies: 38
    Last Post: 7th November 2005, 11:03 PM
  5. Replies: 17
    Last Post: 16th September 2005, 09:07 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •