roming profile issue

[alonebfg]

i have a small issue with profiles that i am tring to sort out. have needed to create a couple of new users and thats fine then they come to log on this is where the issue comes and it creates there profile using the default pc profile. i have created a default profile on the server which i would like them to use but it seems to default to the pc this is a bit of a issue as default profile on the pc does not have some of the shortcuts which the server one does.

[adent]

First of all - as standard the first login must create a profile for the user. This comes from default user regardless.
If , in the user account, you have specified a profile directory on the server i.e. the user profile is roaming - AND there is a profile there already - the computer will take this one in preference to default user.

If, in that profile directory, you have renamed the NTUSER.DAT file to NTUSER.MAN - this becomes a mandatory profile that cannot be edited by the user - and again will take precidence.

Belt and braces? - change the default user profile to remove menu items you don't want. Also remember that the menu items in the All Users profile will appear as well so go through them with a fine toothcomb.

[ajbritton]

You need to copy the template profile to the NETLOGON share on your domain controllers eg '\\server\netlogon\Default User'. Also, be sure to use the Windows GUI to copy the profile so that you can set the 'permitted to use' list to Everyone.

Another way around this is to create a startup sript which updates the Default User profile on the PCs with a copy from a server based location.

Personally, I would never tinker with the Default User profile on individual PCs as it can be useful to be able to log on to them as local Admin for troubleshooting.

[adent]

The default user profile is not used by local admin. The local admin profile is by definition there - otherwise how would you have installed the image in the first place? - unless of course you have deleted it?

[ajbritton]

If PC is installed by RIS and does not involve any 'automatic logons' then I'm not sure the local Administrator profile would exist. I shall have to check. I've just never seen any need to mess with the Default User profile on individual PCs when you have a network. I suppose as long as you make a backup then you are covered.

[ITWombat]

I think your right AJ. Windows installation is done usng the Default User profile. If you spawn any reg mods on HKCU from commandlines.txt they affect the Default User profile.

Also what about the situation when the Welcome to Windows wizard on a clean install or OEM sysprep will give the option of creating new accounts. These will have admin rights. If you use such an account to modify the Default User profile, when you log in with the built-in administrator SID, it wil have those changes.

[adent]

I've never known of an instance when the Admin user profile is not there. Unless you are rolling out direct from the XP image and are not generating your own - you have to log in to run riprep - therefore there must be a profile of some description EQD.

Have to check on Monday. I could stand corrected - it's been known.

[alonebfg]

i had a defaut profile set up in \\server\netlogon\Default User but it stiil seems to take the first pc they logonto as the default profile to set it up. i have worked around this by getting everyone to log on to a pc i have setup with a default profile that i have changed. but someone last week logged onto another pc and then i got i have not got this and that on my profile. so i had to add it after was not a problem but someting i could do without. also is there a way to set diffrent default profiles for diffrent groups of users as the ta's have same shortcuts as teachers (just most of them dont work)

[adent]

One way of doing this is to have different permissions set on a shared profile directory.

We have used this to great effect in a number of schools. In short, create the start menu structure how you want it, then create sub menus for each group. Teachers - LSA's etc. and set permission on the sub menu so that only that group gets read permission.

The net effect is that, although users can see there is a sub-menu there - it is empty for them as they have not got list permission on the directory.

[ChrisH]

Thats a nice way of doing it hmm.....

[ajbritton]

i had a defaut profile set up in \\server\netlogon\Default User but it stiil seems to take the first pc they logonto as the default profile to set it up. i have worked around this by getting everyone to log on to a pc i have setup with a default profile that i have changed. but someone last week logged onto another pc and then i got i have not got this and that on my profile. so i had to add it after was not a problem but someting i could do without. also is there a way to set diffrent default profiles for diffrent groups of users as the ta's have same shortcuts as teachers (just most of them dont work)

If you want to troubleshoot what is going on here any further, I would say that you need to use something like Policy Reporter. This will let you enable the 'verbose' userenv logging which records everything (profile related) that happens during logon. It should reveal which 'Default User' profile is being used and way. If you want to go down this path, then here's what you need to do.

1 - Install Policy Reporter on the PC you use for network admin (or your server if you have to).
2 - Run Policy Reporter and tell it to enable 'verbose logging' on a PC that has an unmodified Default User profile on it. Reboot that PC
3 - Create a new user account at set it up to use a roaming profile that does not yet exist
4 - Log on to the PC using the new user account
5 - Using Policy Reporter, grab the userenv log from the PC and have a look at it. If you want to post it here, I will have a look at it for you.

[ajbritton]

The way I handle my user profiles is as follows;

Staff get full roaming profiles and anything that needs adding gets done by logon scripts.
Staff see the full 'All Users' Desktop and Start Menu entries.

Students share a single mandatory profile.
Students are denied the 'All Users' Desktop or Start Menu entries
A logon script then dynamically adds content to the students desktop/start menu based on a set of regular expressions which control which shortcuts to ignore.

[alonebfg]

the single man profile is good the problem i am getting is they get an error every time they log off like the profile cannot be updated ??

[shoggie]

Hi

Of late I have been haveing more and more students coming in haveing to have there roming profiles reset dur to them not working.

This must be down to the time allowed when the workstaion is contacting the server.

does anyone have any idea what could be coursing this or what I could do to try and sort this out?

XP workstations 2003 server.