Mandatory Profiles

[eddyc]

Hi,

I've followed your very useful Wiki on how to create roaming mandatory profiles - which is great!
The problem is now however that the user account that the profile was made for (255255) can log in without a problem, and open word fine, without the prompt asking for your initals and name does not appear. I then log in with this profile as another user 54321 and when I open Word I get prompted for my initals and name - do you know why this is happening or what I can do to fix it?! It's driving me mad!

Thanks in advance.

Ed

[elsiegee40]

Hi Ed

Did you use Word, etc before locking the profile as mandatory?

This thread has some tips in it: Creating a small mandatory profile

[rh91uk]

Have you changed ntuser.dat to ntuser.man? don't know if that would make a difference but it's worth a shot!

[elsiegee40]

Have you changed ntuser.dat to ntuser.man? don't know if that would make a difference but it's worth a shot!

A profile is roaming with ntuser.dat

Renaming ntuser.dat to ntuser.man makes it mandatory

[eddyc]

Hi,

The profile was originally ntuser.dat which has all of the changes applied to it - I have then exported this out of windows back to the SYSVOL share - and changed it to ntuser.man - it applies the correct changes to 255255 - the student account it was made with, but does not apply to other accounts that log in with this profile. Most strange.

[theaman]

Hi,

It can be a bit of a pain.......but

Log in as a user make the profile how you want it set macros and all other settings

Log out login as administrator go to my computer -> Properties -> Advanced -> User Profiles -> pick the user that you have just made -> then click copy To put server location and add the everyone group in copy to the location change the Ntuser.DAT to NTuser.MAN then copy to your PC so you can load the file in regedit.


Loading ntuser.man file

The file ntuser.man located within the main profile folder contains all of the windows settings for a user. It can be edited using regedit.

Click > Start > Run and type “regedit”

Select HKEY_Local_Machine



Click > File > Load hive , and select the location of ntuser.man.



Name the key “ntuser” and click ok. The hive is now loaded into regedit.

Within the ntuser file there will be entries that relate to a specific user, the majority of these are located in:

Ntuser > software > Microsoft > windows > currentversion > explorer > shellfolders

The string for “AppData” is an example of this. The path:
“C:\Documents and settings\john doe\Application Data” will only work for the user john doe. In order to change this to work for all users the user name needs to be replaced with %USERNAME%.

Make this change for all instances of the username, you can search for them and replace.


Hope that make senes i'm in a bit of a rush.

[maniac]

I place my money on a permissions problem within the registry hive.

The user you created it with will have the correct rights, but any other user may not be able to read the registry hive, so will act as if it's a brand new profile - hence the prompting for details etc.

Easy solution, load the registry hive into regedit as described by theaman above, and right had click the root of the loaded part of the registry, click permissions and add everyone as read only - then any user will be able to read that mandatory profile proprly - problem solved.

You may also need to change the folders as described above, but these are usually replaced automatically by windows anyway - on my mandatory profile I blanked them all so there's no chance of any settings pointing to the wrong places.

Mike.

[tosh74]

when you exported the profile did you use the "Permitted to Use" function ?

[ajbritton]

Concur with above suggestions. 9 times out of 10, this is a permissions problem within the registry.

[Andrew_C]

Sorry if this is a bit OT, but some time ago there was a long thread discussing the relative merits and otherwise of the various types of profile. I can't find it!

ISTR it went on for pages; and I'd guess a couple of years ago... We're still using roaming, and it is taking over 10 mins for some kids to log on.

[zag]

Sorry if this is a bit OT, but some time ago there was a long thread discussing the relative merits and otherwise of the various types of profile. I can't find it!

ISTR it went on for pages; and I'd guess a couple of years ago... We're still using roaming, and it is taking over 10 mins for some kids to log on.

Use mandatory for the kids as its very quick

And use Group policy settings for the teachers (they have profiles but not stored on the server).

Once I did this we have incredibly quick logins and no corruptions or problems with the roaming element.

[cookie_monster]

Use mandatory for the kids as its very quick

And use Group policy settings for the teachers (they have profiles but not stored on the server).

Once I did this we have incredibly quick logins and no corruptions or problems with the roaming element.

We host a default user profile in the netlogon share everyone gets this at first logon, we then use group policy to deliver a different desktop and start menu to different groups of users. For staff we redirect the appdata folder to the server this makes most settings roam but it's much faster.

[eddyc]

Sorry for the delay in getting back on here, when I exported the profile I used the permissions setting and granted it to everyone - I have since loaded this up in regedit and checked the key and everyone has read access, yet if anyone other than the original account that made the profile logs in, the user gets the prompts for details.

I'm baffeled on this one!!!

[pritchardavid]

have you done what likeaman said?

login as administrator go to my computer -> Properties -> Advanced -> User Profiles -> pick the user that you have just made -> then click copy To put server location and add the everyone group in copy to the location change the Ntuser.DAT to NTuser.MAN

[eddyc]

have you done what likeaman said?

Yes, I followed likeaman's instructions exactly.