Locking down desktops and mandatory profiles

@tarquel

I think you need to really note the difference between roaming profiles and mandatory profiles.

Roaming profiles ... bad!

Mandatory Profiles ... very good.

You start up each application on one test user with a roaming profile ... you make sure everything works fine. You configure all those little bits you want (running M$ Clip art organiser, changing a few other Office options ... first run of Mozilla, setting up partidular websites to have trusted IE status so you don;t get flippin warning messages when trying to access PP presentations via a web browser).

You log of the test user allowing all the settings to be saved back to the server. You then change NTUser.dat to NTUser.man ... it is now a mandatory profile. You then point the profile of each user to it (or change the name of it to the profile all users need)

If you need to update the profile to take into account the stuff ... you make a copy, give it a name like profiletest ... you point a test user's profile at it ... you log on, make changes, etc ...

You copy it back in later on.

This can create a large mandatory profile which is why some people like to make sure the defualt user on each workstation has all the settings configured for OO.o etc ... we just use the mandatory profile.

Thanks for the detail tony.

I did/do understand the idea behind it - i just meant that either way they still are going to be transfered to the local machine when a user logs on, although I assume that a manditory one uses the local default user and makes changes to the local one when logging on [thus the manditory bit lol] in combination with them not being able to change it right? [sorry very tired tonight lol

I meant that if the manditory profile got corrupted and you had all the pupils pointing to it, then all the pupils wouldnt be able to log on until you fix the profile, whereas with roaming ones and (in my case) having seperate individual ones for each user, if their profile gets corrupt then it wont effect everyone else. Thats all i meant.

I guess its slightly longer than using manditory ones but still - its all personal preference at the end of the day.

Mattpant was telling me that his manditory profile has ended up changing to 100MB lol

Hang on - if it is manditory and not change, how does/can it get bigger?

I'll stick to individual roaming profiles for now i think lmao ;)

Regards
Nath.

@tarq: Indeed the network copy of the Default User profile does have to be copied across the network (if it's not cached on the local machine ;) ) but it will only be going one way since nobody can save to it (and hence it cannot be broken).

It also means that you get a consistant look to Windows and the apps - easier to teach with :D

It seems lots of people have thier own idea about roaming profiles, and I'm not sure if you're all singing from the same songsheet! And this seems too big a topic and so messy[/all over the place] on the forum to leave alone. Seems we're gonna be talking about it 'till the cows come home.

How about this. Sticky a thread and put the method you use to do it in the first post. Include the pro's and con's, and let people criticise it in the thread. Keep updating the first post as needs be, deleting the queries as they become irrelevant [to keep it tight]. One thread for each method, then we'll at last have definitive information on each methodology, warts and all.

What do you think?

Sounds like a good idea to me.

I'm glad I started this thread, lots of good inputs. It seems this is a complicated subject though with plenty of devotees for each approach. I'm not convinced there is one solution that fits all.

I think I'm going to stick with using GPOs and mandatory profiles to lock everything. Thanks all.

Andy

Quote:

---

Originally Posted by mark

It seems lots of people have thier own idea about roaming profiles, and I'm not sure if you're all singing from the same songsheet! And this seems too big a topic and so messy[/all over the place] on the forum to leave alone. Seems we're gonna be talking about it 'till the cows come home.

How about this. Sticky a thread and put the method you use to do it in the first post. Include the pro's and con's, and let people criticise it in the thread. Keep updating the first post as needs be, deleting the queries as they become irrelevant [to keep it tight]. One thread for each method, then we'll at last have definitive information on each methodology, warts and all.

What do you think?

---

Would that work better as a wiki?

I just cracked up when I read your sig Mark. :lol:

Quote:

---

Originally Posted by ninjabeaver

Would that work better as a wiki?

---

Let the edit/revert war commence! :)

lmao

N.

No takers then... :(

On linuxquestions.org they have a space named linuxanswers [as well as a wiki]. Poeple then submit articles on subjects.

I thought this would be a great addition to edugeek - edugeek.answers

But maybe this task is just too large. Damn shame coz I think it'd be ver useful. Perhaps a subject for a future conference - then if the speaker was willing to publish something, we'd have a startin point.

I think theres too many roaming profile type threads here lol

It's be nice to combine them and start a new, dedicated thread with a wiki for the answers.

My 2p anyhow

Nath.

I'll put it on the home page on a big Flash banner 'Roaming profiles are BAD. Get over it!'

Think it'll work?

Edugeek answers page or sticky thread on each method.

Quote:

---

Originally Posted by Dos_Box

I'll put it on the home page on a big Flash banner 'Roaming profiles are BAD. Get over it!'

Think it'll work?

---

Nope :P

Roaming profiles RULE! and anyone who says otherwise is girly wuss ;-)