Profiles - what to do.

[mattianuk]

I think I have messed up profiles, they work and all, but I have the following issues:

 

Current setup: staff and students have roaming profiles, I set their profiles to folders on a share. I redirect everything, including app data as well via GP.

 

I cannot however, go into profiles on the shares without taking ownership. I know it's permission, but worried about fiddling?

 

Also, I have messed up names and locations. What is the best ways to move profiles? Recreate them?

 

Also, should I delete them at any point, if not corrupt - using delprof or the Gpo object?

 

Everything is working, 13-15 secs login, but that's on an i5 ssd .. So I just wanted to resolve these niggles and check I'm doing it right. I wondered about mandatory, but can't find a good guide, and figure if I redirect everything is there any point? Or actually as I do redirect, does mandatory make more sense?

 

Only thing I have had issues with is chrome profiles :/

[ZeroHour]

There is a GP setting which states that when creating the profile the creator owner has exclusive permissions.

In the folder redirection area there should be a settings tab->Grant the user exclusive rights which is on by default.

Existing profiles will need to be reset from the folder above which can be fix the problem quickly.

Can you give an outline of your share structure?

[mattianuk]

Will do when I get in thanks!

[mattianuk]

Right

 

I share the folder as \\servername\Profile, share permissions I have staff and students as full. THis obviously works

On the NTFS permissions for the folder, I have Creator owner with special permissions

Systems with full

Local admins on the server with full

Me with full control (I did this for testing)

Staff with modify/read

Students with special permissions

 

And administrator with full.

 

Looking through these - it obviously isn't set to cascade down and I have a far to many permissions in there (from playing around) - because none of the other folders have these.

 

What should they be, and if I set for the other folders to inherit, will this mess up the whole 'its working' situation?!

[mistersparky]

Right

What should they be, and if I set for the other folders to inherit, will this mess up the whole 'its working' situation?!

We setup our roaming profile permissions as per the article here - Security Recommendations for Roaming User Profiles Shared Folders: Group Policy. Its a little dated, but it all makes perfect sense and works just fine for us.