Quick question about redirecting folders

[MikeR]

Hi, and sorry for making a new topic!

I found a gazillion bits about redirecting folders but didn't find answer for this:

We have mandatory user profile for all our students, and they have a home drive on network share. It is currently set up so that My Documents was manually moved to K: drive (their homedir) and updated to the mandatory profile.

I read that you guys are using GPO to redirect the My Documents to their homedir. It made me think that is there something wrong in the way it is set up here? ops:

[Dos_Box]

You...Don't...Need....Mandatory....Profiles.....Wi th......Active.....Directory.
All you need is a default user profile, either locally on the PC or on a network share. From here just use AD GPO's. When it comes to mapping My Documents to their user area simply set the root path to \\servername\%username% this will then map the my documents folder to one on the relevant server with the users name.
Please guys, just ditch the mandatory profiles eh? Thats what group policy now does.

[mark]

We're still waiting for a walkthrough on your method Dos_Box - the mandatory guys are there already! :P

[Ric_]

@Mark: I think that the reason for nobody descibing the method is that it's so easy and glaringly obvious:

1. Leave the profile field empty for all users
2. Use GPOs to redirect the My Documents, Start Menu and Desktop
3. Install all the programs you have and log on as a user with admin rights
4. Run all your programs and configure all the settings - dictionaries, menu options, toolbars, registrations, etc.
5. Copy the folder belonging to the user in step 3 from the local Documents and Settings Folder into the NETLOGON share and rename it to Default User (or copy over the Default User profile on your machines)
6. Live happily ever after.



(May have missed something but I'm sure that I will be told!)

[mark]

Well thanks Ric - that's a start. I already redirect my start menu, and users are configured with h: as my documents [is that a wrong way to do it?? - when bulk adding users i've always set it up with: \\curriculum_server\userhome\%username%\my documents]. Desktop doesn't want to re-direct somehow.

But how does this work on multiple machines with different software installs? - do you copy over all profiles on top of the default?

[SpuffMonkey]

5. Copy the folder belonging to the user in step 3 from the local Documents and Settings Folder into the NETLOGON share and rename it to Default User (or copy over the Default User profile on your machines)

Hi - I use default user settings on the local PC for this - if I put it in the NETLOGON share - which would be applied - local or network??

[MikeR]

[rant]
Yes, I know I have to learn to use the new 2k3 environment properly. I mainly have only done NT4 domains before, and mixed mode in 2k server environment). The work I now have has quite recently upgraded to 2k3 environment (all XP&2k3), and I have to make things work somehow before the students come back from holiday (next monday 8O ).

I'll investigate it later on though, even if I'm not putting the new Default User-profile in use. I'll have to think of that, I'm pretty sure that I'm not working here after new year, the unemployment awaits...sigh.

Uh oh, better not get started on that
[/rant]

Thanks for the guidance, the thing I've yet to understand from that, is that will it affect the teachers using the computers, and more importanly allow us to easily update the profile with new shortcuts to all users desktop etc. without students messing things up? (we have some different software in different classrooms). Teachers can mess their own profile up, we'll just wipe it and they start clean.

Also, what rights would I have to give to redirected start menu and desktop (preferrably I wouldn't put those in place if not necessarily needed), and the new Default User profile on server? Is the NETLOGON share on domain controller or can I put it in our fileserver? Because it it's DC, it's pretty much no go.

I'd be glad if anyone can give me another push in the right direction. We have a 2k3 server book, and even it talked about mandatory profiles (must be pretty oldschool book).

[mark]

@MikeR - The redirected folders you can make read only on the server - so no one can change them.
For different software configurations/start menu's I use loopback processing - although that is deemed slightly evil too I think. It works for me - although it stopped working when something else in the gpo broke - otherwise - no problems.

[Geoff]

Hi - I use default user settings on the local PC for this - if I put it in the NETLOGON share - which would be applied - local or network??

Network overrides local.

[sahmeepee]

@MikeR - The redirected folders you can make read only on the server - so no one can change them.
For different software configurations/start menu's I use loopback processing - although that is deemed slightly evil too I think. It works for me - although it stopped working when something else in the gpo broke - otherwise - no problems.

Loopback processing is primarily evil because it slows down the application of GPOs so much when you use it in merge mode. Other than that it's not too serious, just not required for most situations.

[mark]

So the Default Local profile get's applied in the absense of a netlogon version.

So how else do you get around different start menu's then sahmeepee? - is that in the local profile too? I usually tidy the local machines menu's so that the default is 'safe' - what should I be doing?

[sahmeepee]

So how else do you get around different start menu's then sahmeepee? - is that in the local profile too? I usually tidy the local machines menu's so that the default is 'safe' - what should I be doing?

We don't redirect start menus so I'm not entirely sure what you're trying to do. We install all the software on the PC, move anything unsafe from the "default user" and "all users" start menus into the local admin start menu (just for safe keeping really, the admins can get at unsafe progs via start>run... anyway) then take an image of the PC.

If you have something (e.g. SIMS) installed on a pupil machine and you don't want them poking around in the shortcuts for it on the start menu, you can set permissions on C:\Documents and Settings\All Users\Start Menu\Programs\SIMS.net\ via group policy. They'll be able to see the start menu folder, but it'll appear empty when they go to it.

Like I say, I'm not quite sure what you need it to do!

[mark]

Just wanted to know what you do if you want different start menus - without using loopback. I think you answered my question: it's picked up from the default and all user settings on the local PC. By set permissions you mean making it read only somehow?

[sahmeepee]

We're almost on the same lines

I mean: if you set NTFS permissions on a start menu folder and the stuff inside it to (say) "DENY - Full Control" for a domain-wide group containing all pupils, then when a pupil logs in the folder appears to be empty, whereas a teacher would see it as normal.

Default User and All Users start menus aren't writable by normal users by default, so they can't screw them up.

[mark]

Cool *goes off to test!*