Desktop Logon Optimization and speed / Mandatory Profiles - My Setup

[Zenden]

Good Morning All,

 

I spent a portion of the half term break trying to get as much speed as possible into the student logon process in our ICT Suites and found a few useful bits and bobs i thought it was worth sharing (as well as for me to check back on when i inevitably forget what i have done!). I know there are a few (very useful) posts on here regarding this already but i found some things which have not yet been noted so I hope someone finds them useful.

 

After creating and copying the profile to our network share i did the following:

 

Remove all policy entries under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies and HKCU\Software\Policies

 

Remove all startup entries from HKCU\Software\Microsoft\Windows\CurrentVersion\Run and RunOnce

 

Delete all log, blf and regtrans-ms files which have been created in the root of the profile

 

(Adobe CS3) Wipe %appdata%\Adobe\Acrobat\Distiller 8\Cache Folder

 

(Adobe CS3) Delete %appdata%\Adobe\Fireworks CS3\Styles\Style Defaults.stl

 

Delete %appdata%\Microsoft\Windows\IECompatCache\index.dat and %appdata%\Microsoft\Windows\IECompatCache\Low\index.dat

 

Delete %appdata%\Microsoft\Windows\IETldCache\index.dat and %appdata%\Microsoft\Windows\IETldCache\Low\index.dat

 

 

These tweaks brought the size of our profile down from 7+MB to 1.3MB

 

I also made the following tweaks to the library-ms files in %appdata%\Microsoft\Windows\Libraries by dragging them into notepad and editing their contents:

 

Remove the content of the tag in the library files. If this tag has content then it seems to stop the redirected/user specific folders from being included in the libraries and instead shows the local profile of the user who the profile was based on (eg C:\Users\profileuser\Documents etc)

 

Remove the last tag (both the tag and its contents) in the library files. This is the link to the public documents/pictures/music/videos folders. Removing them stops them from appearing under libraries when users login and just leaves their homefolders.

 

Once this was complete the login times reduced from 90 seconds to around 45-60. (7 year old PCs and 100Mb Switches).

 

I then setup an XCOPY Script to copy the mandatory profiles to the local c drive of the machines as the copying of the profile via the network was responsible for around 21 seconds of the login time. Script pasted below:

 

IF NOT EXIST C:\Installed MKDIR C:\Installed

IF NOT EXIST C:\Installed\__LOGS MKDIR C:\Installed\__LOGS

IF NOT EXIST c:\installed\Profiles\installed.txt goto install

IF EXIST c:\installed\Profiles\installed.txt goto installed

:installed

::echo "already installed"

goto end

:install

eventcreate /l system /so ProfileScript /t information /id 1 /d "The Mandatory Profile Batch Script has detected that it has not previously ran on this computer and has begun"

MKDIR "c:\Profiles"

XCOPY "\\domain.local\netlogon\profiles\DEPLOY\*" "c:\Profiles\*" /O /S /E /H /Y /C >C:\Installed\__LOGS\ProfileScriptlog.txt

XCOPY "\\domain.local\netlogon\Deployments\Installed\*" "c:\installed\Profiles\*" /S /E /H

:end

 

 

Quick outline of the script:

 

It checks if the file c:\installed\Profiles\installed.txt exists. if it does then it knows this script has already been ran and finishes without copying anything. If it doesn't exist then it runs and creates an event log in the system log. It creates the folders c:\installed\Profiles and C:\Profiles . It then copies all the mandatory profiles within the DEPLOY folder into c:\Profiles and logs the process to c:\Installed\__LOGS\ProfileScriptLog.txt. Once completed it copies Installed.txt from a network share into c:\installed\profiles\installed.txt to stop the copy job running at every bootup.

 

I then used a GPO to assign the profile c:\profiles\student to the ICT suites.

 

I also did a number of Registry tweaks via Group Policy Preferences to the workstations to increase speed:

 

Created/Changed HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DelayedDesktopSwitchTimeout (REG_DWORD) to 5 to vastly increase the final "Preparing your desktop" stage of login.

 

Changed the IsInstalled REG_DWORD values to 0 and deleted the StubPath values for a number of items under HKLM\Software\Microsoft\Active Setup\Installed Components :

 

{7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book

 

{44BBA840-CC51-11CF-AAFA-00AA00B6015C} - WinMail

 

{89820200-ECBD-11cf-8B85-00AA005B4383} - Web Platform Customisations

 

{89820200-ECBD-11cf-8B85-00AA005B4340} - Windows Desktop Update

 

 

Login times now down to 27 seconds on a very old Athlon X2 machine and 17 seconds on a new i3.

 

This has been mostly successful and is fully functional for users using the mandatory profile. However, if a user logs in who doesn't use any kind of roaming profile and a fresh local profile is created then the library files are never created for them so windows explorer shows nothing under libraries and also nothing under favorites (where desktop/downloads should be). After a lot of research i have found that restoring the registry items for Windows Desktop Update fixed the Favorites issue and restored Desktop/Downloads however i have not found a fix for the libraries, in the meantime all users have the mandatory profile applied to them when they login in the ICT Suites.

 

So in conclusion, massive increase in login speed but an issue with libraries. Has anyone else been down this route/ have anything to add/ can advise on the creation of library files at login?

[wehr]

Hi,

 

if your main goal is to reduce logon time you could also use a shared mandatory dummy user for all users:

 

Using ZCM Bundles to speed the login for students at shared computers | Novell User Communities

 

 

The logon time is about 5 seconds - 10 seconds to ready opended internet explorer.

 

I use this for some stand-up computers since 1 year now. At first sight it seems wierd to share a dummy user amongst all users. But we have shared computers anyway.

In one year there has been no issue with this solution. However its fundamental to configure the machine correctly since we cannot rely on the SID as security boundary.

 

Logon with a Windows Dummy User could also be achieved with pgina (pGina)

 

best regards

 

Markus

[Zenden]

Hi,

 

if your main goal is to reduce logon time you could also use a shared mandatory dummy user for all users:

 

Using ZCM Bundles to speed the login for students at shared computers | Novell User Communities

 

 

The logon time is about 5 seconds - 10 seconds to ready opended internet explorer.

 

I use this for some stand-up computers since 1 year now. At first sight it seems wierd to share a dummy user amongst all users. But we have shared computers anyway.

In one year there has been no issue with this solution. However its fundamental to configure the machine correctly since we cannot rely on the SID as security boundary.

 

Logon with a Windows Dummy User could also be achieved with pgina (pGina)

 

best regards

 

Markus

 

That looks quite interesting but unfortunately wouldnt be suitable for our environment. It could be useful for stations for print job releasing etc though so i will keep it in mind.

[Chris_Jones]

Hmm, my previous reply seems to have disappeared into the Ether, try again

 

Just implemented this in a test environment, using an old Core 2 Duo and a fresh image.

Got Login times down from 37-40 Seconds to 22-24 quite an impressive reduction.

 

How did you work out which things to cut out? did you use some kind of logging tool to monitor the login process?

[Zenden]

Hmm, my previous reply seems to have disappeared into the Ether, try again

 

Just implemented this in a test environment, using an old Core 2 Duo and a fresh image.

Got Login times down from 37-40 Seconds to 22-24 quite an impressive reduction.

 

How did you work out which things to cut out? did you use some kind of logging tool to monitor the login process?

 

Glad to see it helped you out. Regarding the mandatory profile, I just hunted through the folders looking for large sizes so that was quite easy. Regarding the tweaks, it was mostly through research and trial and error, I did a lot of timing of the login process with verbose logging on so I could see which bits were taking the most time. I also checked the group policy event logging to see the exact times which policies were taking to rule those out. By the end I knew that "please wait for the user profile service" and "preparing your desktop" were the biggest culprits and found through research that the first one was copying the profile across the network and the second one was related to the active setup stub paths and the desktopswitchtimeout.

 

I am still hunting and trying to improve on it and was hoping that this thread would lead to others sharing new tricks

 

Let me know anything more you find.

[Zenden]

Minor Bug found with this setup - The DesktopSwitchTimeout setting causes the PC to load the desktop before loading a wallpaper (if you set wallpaper by group policy) sometimes. This issue is intermittent and actually resolved itself because the wallpaper loads afterwards.

[eean]

This is a very useful guide, thank you. Got this job to do next week in a short space of time so want to ask you a few questions so I'm as prepared as possible.

 

I then used a GPO to assign the profile c:\profiles\student to the ICT suites.

I didn't know you could assign a profile in GPO, I've always done it in Active Directory users and computers. Is it a computer or user setting, if so did you have to use loop back to restrict it to students logging onto ICT suite computers?

 

This has been mostly successful and is fully functional for users using the mandatory profile. However, if a user logs in who doesn't use any kind of roaming profile and a fresh local profile is created then the library files are never created for them so windows explorer shows nothing under libraries and also nothing under favorites (where desktop/downloads should be).

I don't understand this, can you clarify?

 

Do you have documents, start menu and desktop redirected to the network or to a local location?

Are you renaming user.dat to user.man?

What version of windows are you on?

 

What I'm looking to do is have some class logins for the youngest and individual logins for our middle pupils - each year group will need it's own customised default profile and they should get fresh copy at login.

Older children/staff might have a profile saved onto the local machine or the network after they've received a good default, not sure yet.

 

Any updates to the method?

 

Thanks!

[Arthur]

Let me know anything more you find.

The following article lists more folders you can exclude...

 

Reduce logon times by excluding the bloat « Aaron Parker

[Zenden]

This is a very useful guide, thank you. Got this job to do next week in a short space of time so want to ask you a few questions so I'm as prepared as possible.

 

 

I didn't know you could assign a profile in GPO, I've always done it in Active Directory users and computers. Is it a computer or user setting, if so did you have to use loop back to restrict it to students logging onto ICT suite computers?

 

 

I don't understand this, can you clarify?

 

Do you have documents, start menu and desktop redirected to the network or to a local location?

Are you renaming user.dat to user.man?

What version of windows are you on?

 

What I'm looking to do is have some class logins for the youngest and individual logins for our middle pupils - each year group will need it's own customised default profile and they should get fresh copy at login.

Older children/staff might have a profile saved onto the local machine or the network after they've received a good default, not sure yet.

 

Any updates to the method?

 

Thanks!

 

 

 

Glad it was useful for you.

 

The GPO is a computer based GPO and is found at Computer Configuration\Policies\Administrative Tempaltes\System\User Profiles\Set roaming profile path for all users logging onto this computer

 

To clarify about the library file issue:

 

Windows 7 libraries are controlled/setup by library-ms files hidden in the appdata portion of the userprofile. They are automatically created for a user when their profile is first created. I have found that by setting things up as I have done (removing the active setup for bits and bobs) that if a user logs in who does NOT have a roaming or mandatory profile and also does NOT already have a local profile on the computer and therefore a new one is created when they login that the library-ms files do not get created and the libraries appear completely blank. I am guessing this problem is caused by the removal of the activesetup for windows desktop update but I have not got to the bottom of it. It doesn't particularly matter since all users who login to the pc are using the mandatory profile anyway but I thought it was worth noting.

[Zenden]

This is a very useful guide, thank you. Got this job to do next week in a short space of time so want to ask you a few questions so I'm as prepared as possible.

 

 

I didn't know you could assign a profile in GPO, I've always done it in Active Directory users and computers. Is it a computer or user setting, if so did you have to use loop back to restrict it to students logging onto ICT suite computers?

 

 

I don't understand this, can you clarify?

 

Do you have documents, start menu and desktop redirected to the network or to a local location?

Are you renaming user.dat to user.man?

What version of windows are you on?

 

What I'm looking to do is have some class logins for the youngest and individual logins for our middle pupils - each year group will need it's own customised default profile and they should get fresh copy at login.

Older children/staff might have a profile saved onto the local machine or the network after they've received a good default, not sure yet.

 

Any updates to the method?

 

Thanks!

 

oops didn't answer a coupleo f your questions with my first reply. We redirect docs/downloads/music/videos/pictures and we use mandatory profiles (user.man)

[Chris_Jones]

just implementing some more of these tweaks on our site.

 

I've modified the copy script to use robocopy, as its installed by default in win7 and to run at every start up, so any changes are detected and copied

 

IF NOT EXIST C:\LocalProfiles MKDIR C:\LocalProfiles

IF NOT EXIST C:\LocalProfiles\__LOGS MKDIR C:\LocalProfiles\__LOGS

ROBOCOPY \\fileserver\profileshare$\PupilProfile.v2\ c:\LocalProfiles\PupilProfile.v2\ /MIR /R:10 /W:10 /LOG+:C:\LocalProfiles\__LOGS\ProfileScriptlog.txt /NDL

:end

 

the log file is set to append new info, this amounts to roughly 1K at each login if there are no changes, so a full year of 5x startups a day would leave a file of about 1.5 Meg

 

 

I've also removed the TranscodedWallpaper.jpg and Thumbs.db files from Profile.v2\AppData\Roaming\Microsoft\Windows\Themes

We use wallpaper specified from group policy so this was just 600K of useless data being copied each logon.

 

Profile size now 1.62MB, 133 Files in 80 Folders. logon time 10s over wireless on a new i3

[Zenden]

Thank for the info Chris, Can you clarify your use of robocopy as I dont have much experience with it. If you make a change to the central profile does it copy out only those individual changes and otherwise copy nothing? if so, that is very useful! Also, do you find the slight issue where sometimes the desktop loads before the wallpapaer? if not can you clarify how you are setting the wallpaper?

 

and finally one more question, can i add your setup to my original post so this becomes a central place for the info?

[Chris_Jones]

Robocopy with the /MIR parameter copies changes from the source to the destination, including removing files from the destination that have been removed from the source. This should make it easy to keep the local copies up to date.

 

I haven't noticed an issue with wallpaper delays in testing, though I haven't gone live yet with all the pupils - I'm giving it a few days to make sure the local copy exists on all PCs first.

We deploy wallpaper via a separate GPO which uses the User Configuration - Policies - Administrative Templates - Desktop - Desktop - Desktop wallpaper Policy.

 

Feel free to add the info to the main post - I'm putting it up here for people to share after all!

[Zenden]

Fantastic, thanks again Chris. I will give your robocopy script a go. I assume the switches included in that copy the files with the same permissions aswell?

[Chris_Jones]

if you want to preserve permissions you need to add /SEC on the end as well.

[Zenden]

are you not preserving permissions Chris? I had assumed this would be needed for the profile to work?

[Chris_Jones]

not at the moment, I'm just letting windows use the default permissions.

 

It works fine as it prevents and permanent changes to the profile since it is .man

even if you delete things off the desktop or add other junk on, these are not written back at logoff.

 

I didn't want to start copying permissions as well at this stage, just to try and avoid any access issues. even if the pupils do manage to modify the profile it will be re-synchronised at next boot.

[eean]

I tried this method a few months ago without much luck, although, to be fair, I didn't give it enough time.

To clarify: you are using one .man profile for multiple users?

What are you using to make the profile 'generic'? I was getting errors about the profile loading (in balloon pop ups by the clock) and windows said it had only loaded a temporary profile.

 

Have you tried specifying the profile location in active directory users and computers on the individual user, rather than for the whole machine in group policy? Does that work?

 

Thanks!

[Zenden]

I think I will need more info eean. I am following a standard method for creating a mandatory profile that you would follow if you held the profile anywhere else, the only difference is that it is on the C Drive rather than on the network. Sounds to me like the profile was corrupt somehow. Have you tried manually copying the profile onto a pc as a test rather than doing it through gpo script?

 

It also shouldn't matter where you specify the profile path, I just wanted it to apply to all users who use the machine as I am applying this setup only to PCs which are treated like hotdesks with people swapping and changing (eg IT Suites, Teacher PCs in classrooms). I didn't want it to always apply to certain users as they are given more freedom to customise their configurations on their own PCs in their offices or on their own laptops.

 

Definitely sounds to me like the issue is with the profile itself rather than anything specific about this setup.

[Zenden]

just a little more info regarding the profile and making it 'generic'. Hopefully this clarifys it a little.

 

If you host a mandatory profile on your server eg \\server\profiles\profile1 then when someone logs in the PC copies \\server\profiles\profile1 to c:\users\username\ and then that folder is theirs to use but when they logoff changes aren't saved. The process is no different in this case, it is just copied from c:\profiles (or wherever you are putting it) to C:\Users\username . Once it is copied, only then does the user interact with the profile and only on their specific copy.

 

So their shouldn't need any extra work to keep it generic other than standard mandatory profile setup.

 

Does that make sense?

[synaesthesia]

I will hasten to point out that in some cases the above isn't entirely true - profiles can and will often partially "hang around" if files do get changed in there, often ones from appdata if it's not redirected; then there's always some rogue little bits of software (Cubase is a bugger for this) that write to it and prevent it from getting cleared at logoff. Although it deletes the necessary stuff like desktop, documents etc, it keeps enough behind often to stop the folder being deleted and also the registry profile list, commonly leaving behind those nasty username username.domain username.domain.000 etc folders in your Users folder.

Delprof2 is wonderful, though!

Just a brief warning to be wary

[Zenden]

Fair point, but that would just mean that the users "copy" had changes that stick around, it wouldn't affect the central/original copy which is what I think eean was asking (unless I have misunderstood!) and would be an issue no matter where the central profile is stored. My setup (and this thread in general) is specifically about how hosting the profile on the c drive and a few tweaks to the profile and registry can dramatically decrease login times. Edited October 3, 2013 by Zenden

[synaesthesia]

I think you mean decrease, but yeah It's just more to note that profiles won't always cleanly delete and to watch out for it where appopriate

[Zenden]

post edited - that will teach me for not proof reading my posts!