User Profile Settings. Windows 2000 Server. Help Please.

[tickmike]

Hi All.

Windows 2000 server / W2K... W.S. < Edit

On changing from a 'roaming' profile to a 'mandatory' (setting up the mandatory as in the Wiki) I get the following problems, Any ideas please.

1..Edit ..On the workstation.. Edit end ..logging on to a 'user' setting, I get "Restrictions...The operation has been cancelled due to restrictions on this computer" But does not say what, You can still log on ? .

2.. On logging off the above user I get "windows cannot update your roaming profile.

3..Edit .. Now on the server ..Edit end...On trying to set the 'home folder' In users polices I keep getting " you do not have create rights on this computer"( I have tried to take owner ship of the folder).

Also some help with this please. Edit .. On the workstation ..Edit end .
A..On the "log on to windows" box How do I disable the "options" ( I have the domain computer and the local computer in the options box, I do not want the pupils to change them over).
B.. How do I Inhibit the Internet Explorer Icon from the desktop for the users ( I use firefox).

From Michael.

[ajbritton]

1..logging on to a 'user' setting, I get "Restrictions...The operation has been cancelled due to restrictions on this computer" But does not say what, You still log on ? .

Not sure what you mean by this. Are you trying to log on to the server with a non-admin user account?

2.. On logging off the above user I get "windows cannot update your roaming profile.

Sounds to me like Windows still thinks the profile is roaming. Did you change NTUSER.DAT to NTUSER.MAN? There are usually two NTUSER files in the profile directory (NTUSER.DAT and NTUSER.DAT.LOG). A common mistake is to rename the .DAT.LOG file. Make sure Explorer is showing you all files and not hiding file name extensions.

3..On trying to set the 'home folder' In users polices I keep getting " you do not have create rights on this computer"( I have tried to take owner ship of the folder).

Again, you're not trying to do this whilst logged on as a non-admin user are you?

Here's the sequence (which extra details about where and whom to logon as).

Server Infrastructure
1 - Log on to server as Administrator
2 - Create MPM user account as per wiki notes
3 - Create the server infrastructure as per wiki notes

Create a mandatory profile as follows
1 - Log on to serve as Administrator
2 - Check that the MPM user account has no entry in Profile Path
3 - Select a PC where MPM has no local profile
4 - Log on to the PC as MPM and make any initial settings required
5 - Log off the PC
6 - Log on to the PC with an account with local and network admin status (eg domain Administrator)
7 - Use the Windows interface to copy the MPM profile to \\(servername)\MandatoryProfiles$\(new profile name), (eg \\myserver\MandatoryProfiles$\Profile1) remembering to assign access to Everyone. (You need to use the copy profile function from My computer, Properties, Advanced, User Profiles Settings, (select the profile), Copy To.)
8 - Log off the PC
9 - Logon to the server as Administrator
8 - Navigate to D:\MandatoryProfiles\(new profile name) and rename NTUSER.DAT to NTUSER.MAN

Assign the mandatory profile to a user
1 - Log on to server as Administrator
2 - Modify a user's the Profile Path to \\(servername)\MandatoryProfiles$\(profile name) (e.g. \\myserver\MandatoryProfiles$\Profile1)

Test the new profile
1 - Log on to a PC as the user that you modified to use the mandatory profile.
2 - Make some changes to the environment
3 - Log off the PC
4 - Log back on to the PC as the same user
5 - Changes should have disappeared.

Good luck...

[tickmike]

Hello Ajbritton.
I have edited the above post to try and explain a bit better.

Thanks for that (I think I did all you have put down ), I will try again tomorrow night when I go over to school and go over the above.

Re Question. 2
Just had a look(via my radio link to school from home) at the NTUSER.DAT File It still thinks its a DAT file !?? (right click> properties> says Its NTUSER.DAT )
What I did to change it was to right click it and rename it, is that not the way to do it ?.( this could be the problem).

Re Question 3 I was logged on with admin acc.
One thing always puzzles me about the 'administrators' accounts on a server.
what I always do when installing the OS is to change the primary administrators name.
But that should then be the server main administrator, but what about all the other administrator settings in GP eg.domain admin, DCHP admin.... Do I have to put me down into all these admin groups or is it done automatically because I'm the primary administrator ?.

Anybody got any info on question A &B on my post above please.

From Michael.

[plexer]

Mike: When you renamed it was it showing as ntuser.dat or just ntuser? if it was just ntuser and you renamed it then it is now actually ntuser.man.dat

If that is the case -> tools -> folder options -> view -> "hide extensions for known files" untick that and rename it.

Ben

[tickmike]

Hello Ben .
10 out of 10 For that answer, I had a look at that yesterday when I was at school, but what I was looking at was ' show hidden files and folders' and that was unchecked did not think to look at the one below it..
I bet it will work now without these odd errors. But if not I will go though what AJB said above.
Regards Michael.

[tickmike]

Hi All.
Windows 2000 server /W2K ..ws.

This is from my question above.
Does any know were in AD GP you turn off :-
This is a 'user' account on a workstation.
A..On the "log on to windows" box How do I disable the "options" ( I have the domain computer and the local computer in the options box, I do not want the pupils to change them over).

B.. How do I Inhibit the Internet Explorer Icon from the desktop for the users ( I use firefox ).

Any ideas.
From Michael.

[plexer]

I don't believe you can remove it via a gpo with the standard windows gina. The only way then would be a custom gina that only allows windows domain login.

We don't find it to be a problem. Plus if you were to remove and then needed to log on yourself locally it would be a problem.

Ben

[tickmike]

Hi All.
Windows 2000 server /W2K ..ws.
Good morning Ben,
Re A.
Will the AD GPO settings stop them changing the computer settings if they log onto the local computer instead of the domain account ( I will have a play with this tonight when I go over to school ).
Re B
Any ideas which setting turns off the IE icon on the desktop ?.

From Michael.

[Geoff]

To remove the IE icon. Go to:

User Configuration\Administrative Templates\Desktop

in your relevant GPO.

Then enable:

Hide Internet Explorer icon on desktop

[tickmike]

Hi Geoff.

Thanks .
Do you Know, I have somehow missed seeing all that group of settings ops: ( there are so many ! I whished there was an index )

From Michael.

[plexer]

Unless they know a local account username and password they cannot log onto the local machine using their domain login so it's not a problem.

Just make sure the administrator passord is changed and that there are no other accounts enabled including the guest one.

Ben

[tickmike]

Hi Thanks .
That's good to know, For when it was individual computers ( not locked down) the little darlings cause me some grief changing as many of the setting as they could and I spent my own free time changing them all back again. Not any more . :twisted:
From Michael.

[tickmike]

Hi all,
I re did the Mandatory profile as AJBritton said above and the above errors have gone but the only problem is my GPo are not going out to the workstations on the user accounts.
Is there any re-sets I should do ?.

Any Ideas please.

From Michael.

[ajbritton]

Hi all,
I re did the Mandatory profile as AJBritton said above and the above errors have gone but the only problem is my GPo are not going out to the workstations on the user accounts.
Is there any re-sets I should do ?.

Any Ideas please.

From Michael.

R U saying that user settings or computer settings are not being applied? Bear in mind that that for policies to apply, they must be set at an appropriate level in AD. It is generally good practise to keep your computer accounts seperate from your user accounts. Most people create specific OUs to do this. It is then easy to assign computer policies to OUs containing computer accounts and user policies to OUs containing user accounts.