Howto: Mandatory Roaming Profile with AutoCorrect

[mattpant]

Hi,

I've have got in place a Mandatory Roaming Profile that all Pupils load up when they logon to the computers. It has just been brought to my attention that they have found out that they can go into Word and edit the AutoCorrect list so that when other pupils type in Words they "Magically" change into something else.

Any Ideas on how to stop them doing this? And why the settings are saved if it's a Mandatory Profile?

Any ideas why my Mandatory profile grows to well over 100MB?? I thought the idea was that no settings/changes were saved?

I tried making the whole folder "Read Only" for pupils, but this seemed to course problems when they tried opening Office programs

Regards,

Matt

[ajbritton]

Is your mandatory profile stored on a server? If so, users do not need any higher level of access than Read Only. (I usually give SYSTEM Full Control however). Have you renamed NTUSER.DAT to NTUSER.MAN? Assuming both these conditions are met, then the server copy of the profile cannot grow. The LOCAL copy of the profile can grow however. Make sure you set the 'delete local copies of roaming profiles' group policy setting (I think I usually do this on a per machine basis, but it may be possible to do it per use). One last point; deploy the UPHCLEAN service to make sure the User Profile Hive file is fully unloaded. This should mean the local copies of profiles are deleted correctly.

With regards to the problem opening Office apps, I assume this is the issue where a Windows Installer dialog pops up to say that it is installing Office. This is just Office making sure all the necessary registry entries and/or user app data files are present. The trick with this is to convert the profile to a conventional roaming profile and log on as a user

1 - Make an edit copy of the mandatory profile, and rename NTUSER.MAN to NTUSER.DAT
2 - Modify the profile path on a temporary user account to point at the edit copy of the profile (this user must have full access to the profile folder)
3 - Log on to a PC using the temporary user account and make sure you run at least one Office app. (This should cause the Installer to do it's stuff)
4 - Log off (changes will be written back to the profile)
5 - If you are paranoid (like me) make another backup copy of the original profile
6 - Delete all the files from the mandatory profile
7 - Copy all the files from the edit copy of the profile into the mandatory profile folder
8 - Rename NTUSER.DAT to NTUSER.MAN in the mandatory profile folder
9 - Test the profile by logging on as a student.

Another point to note about profiles is that not only do the files have permissions on them, but the contents of the registry does as well. I usually create blank mandatory profiles by using the copy function built into the XP profile management dialogs. This gives you the opportunity to 'grant access to' Everyone. These permissions will then be set on the files AND registry.

Hope some of this helps somewhere!

[mattpant]

Hi,

Thanks for your tips, I will give them ago when I'm back in school.

Regards,

Matt

[mark]

Great post ajb! That should be elevated to "mandatory profile howto" sticky.

Mind if I do that - or wiki it, or suggest it get's put on an edugeek howto page??

[tosca925]

Another point to note about profiles is that not only do the files have permissions on them, but the contents of the registry does as well. I usually create blank mandatory profiles by using the copy function built into the XP profile management dialogs. This gives you the opportunity to 'grant access to' Everyone. These permissions will then be set on the files AND registry.

Sorry to be a bit dim here but i am a little confused on your explanation. Could you please explain this in more of a 'XP Profiles for Dummies' way to help my little brain take it all in easier.

Thanks ajb

[ChrisH]

It simply cant be a mandatory profile if its growing .

[ajbritton]

@mark - No problem, use it as you wish.

@tosca925: If you have ever looked at the registry (using regedit), you may have noticed that the structure is hierarchichal, much like a file directory. permissions can be set on the registry 'folders' and 'settings' just like you can with 'directories' and 'files'. This means that you can restrict what users can do to the registry. Generally, the HKLM hive is protected against meddling from ordinary 'Users'. The HKCU (current user) hive is open to the user for whom it was created. Herein lies the problem. If you log on to a PC and create a new profile, the user you log on with gets the correct permissions to the HKCU hive (this is what is stored in NTUSER.DAT by the way). If you copy the profile by dragging and dropping the folder from '\Documents and Settings' to the server, then modifying file permissions, the HKU hive will STILL have the permissions for the original user. If you copy the profile using the GUI under My Computer etc. and indicate that 'Everyone' will be allowed to use the profile, XP modifies the registry permissions for HKCU as well as the permissions on the profile files/folders. NB It IS possible to modify registry permissions on a mandatory profile using regedit, but much simpler (and unless you really know what you are doing, more reliable) to let XP take care of it!

[tarquel]

There was some program i had to do the resgistry permissions thingy on but i forget what it was.

If i didnt, then the "standard" users couldnt use the prog otherwise - even with full control on the installed location of the program.

Think it was Intel ...er...the microscope thing lol

Cheers
Nath

[Michael]

@mattpant - I presume you use Active Directory? If so download Ork Tools for Office 2000, XP or 2003 (depending which version you have).

You're then able to limit various functions of Office through policies as you do for Microsoft Windows 2000/XP.