Koldov Posted February 17, 2014 Posted February 17, 2014 Hi All. Bit late to the party as always, but need some advice. We have mandatory profiles here for pupils and have done for as long as I've been here but have only ever used XP. They have never given me any problems and do exactly what we need. Now with the change to 7 I wonder if anyone here can help with this question. Not all of our PC's are going to be changed over at once, so although I really need to get this sorted I am a bit confused if I can actually make it work. Our mandatory profile is picked up through the profile tab in AD as per the below picture: If I change the 'profile path' option to look at this new .V2 profile I need to make, will it then not apply to any machine the pupils log onto still running XP? Is it all or nothing or can I make it look for the XP profile 'or' the 7 profile? Kol.
fairm010 Posted February 17, 2014 Posted February 17, 2014 You name the profiles the same thing for example Student.v2 - win 7 Student - XP Then just point to \\server\share\Student in AD and the PC will differentiate between the two.
3s-gtech Posted February 17, 2014 Posted February 17, 2014 Yup, use the same profile name but add .v2 to the name of the profile directory, placing that in the same share as the XP profile. Don't change the profile path in AD - it's smart and can tell if it needs the v2 profile itself.
Koldov Posted February 17, 2014 Author Posted February 17, 2014 Ah I see, all our profiles are just chucked into one massive folder called.... 'Profiles'... and then named explicitly in the AD user properties profile path. If I sub-folder these two profiles, I would not have to drill down so far and name the explicit profile? Just point it to the sub-folder? Kol.
3s-gtech Posted February 17, 2014 Posted February 17, 2014 You'd put: \\servername\sharename\profile into AD. Then you'd have two folders in \\servername\sharename called: profile (containing the XP profile) profile.v2 (containing the Vista/7 profile) That's it.
Koldov Posted February 17, 2014 Author Posted February 17, 2014 Thanks I think I can bash my way through that one now! Can anyone point me to a guide for creating the pupil mandatory profile? Something a bit specific for our sector? Not like the generic MS ones... We are on a domain and I will be reinstalling 30 ICT computers over this week. We don't have any imaging server or software apart from an old copy of GHOST 11 (not the full suite just the imaging part) so it will be a real PITA as it will all be manual installation/update/AV/programs/office . Anyone got a nice simple, clean, pukka, works-every-time guide? Kol.
3s-gtech Posted February 18, 2014 Posted February 18, 2014 Uggh, I've tried to find my guide that I did on here a while back. There's an MS approved way (involving sysprep, much faff and time) or there's my way, which involves: Create a user with no GPs applied, log on to a PC, set the profile settings that you'd like (e.g. loading Office for the first time, Creative Suite for the first time, etc). You then log off, log in as admin, copy the profile to a share accessible to everyone, and load the ntuser.dat into Regedit. You then change the permissions on the hive you have loaded into Regedit so that Everyone has full control. You can use this opportunity to change settings on the hive via regedit, and cut its size down a bit if needed. Change the NTFS permissions on the share for the profile so that students can Read but not Write to it. Now change ntuser.dat to ntuser.man. Change the profile path of a test student to point to the profile directory (don't include .v2 in that name). Now log in, test, tweak, test and re-test. I cannot accept any responsibility for this causing havoc on your particular domain! I can only say that we have been running with this exact system for nearly four years now, and the profiles have been reliable (and they delete from workstations at logoff etc). For best result, I combined this with redirected AppData - that way, programs that don't like redirected Appdata also get a nice local Appdata folder that is deleted when they log off. Logons are quick for us as a result - it's best to try to keep the profile below 1MB. 1
Koldov Posted February 20, 2014 Author Posted February 20, 2014 You then log off, log in as admin, copy the profile to a share accessible to everyone, and load the ntuser.dat into Regedit. ...it's best to try to keep the profile below 1MB. Hmmm... OK, struggling a bit with this one as: a) The copy to button is greyed out, is there another way? b) All profiles I create show as 50-70MB! I thought I was hiding and deleting stuff! Where has all this extra stuff come from? Appdata? I can see why you wouldn't want to pull that down everytime 30 kids log-on, but how do I remove this now and redirect it? Kol. P.S. Sorry for stupid questions, I've never done this before...
3s-gtech Posted February 20, 2014 Posted February 20, 2014 a) Copy and paste the profile folder (C:\Users\username) in Explorer. Shouldn't be greyed out there. b) Most of that size will be guff stuffed into the profile - things like Media Player items. Go through it looking at the folder sizes and cut out the chuff - there's not much that'll need to stay.
MordyT Posted February 20, 2014 Posted February 20, 2014 We are on a domain and I will be reinstalling 30 ICT computers over this week. We don't have any imaging server or software apart from an old copy of GHOST 11 (not the full suite just the imaging part) so it will be a real PITA as it will all be manual installation/update/AV/programs/office . Kol. Please don't. If you don't have the time or equipment to setup a full blown wds or mdt at the very least capture an image with imagex sysprep that image and then deploy that to the other 29
Koldov Posted February 20, 2014 Author Posted February 20, 2014 (edited) a) Copy and paste the profile folder (C:\Users\username) in Explorer. Shouldn't be greyed out there. b) Most of that size will be guff stuffed into the profile - things like Media Player items. Go through it looking at the folder sizes and cut out the chuff - there's not much that'll need to stay. There's not a lot in there really apart from AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat = 32MB Is that an Internet History cache? I haven't even been on the internet in this profile! Safe to delete? I've deleted history etc. Didn't make a difference... There is also a big folder to do with Windows Mail? Please don't. If you don't have the time or equipment to setup a full blown wds or mdt at the very least capture an image with imagex sysprep that image and then deploy that to the other 29 So I take it you don't suggest using that old copy of Ghost? Thing is I'm getting close to the wire on this one and don't have a lot of time to learn the 'nuances' of new software (well, new to me)... Anyway it doesn't look like I'm going to have the mandatory profile thing down in time, so I'm not going to put Win7 on the machines if I can't lock it up. Kol. Edited February 20, 2014 by Koldov
3s-gtech Posted February 20, 2014 Posted February 20, 2014 Safe to delete both files. Then have a look at FOG, if you want a simple alternative to Ghost. Free and awesome.
MordyT Posted February 20, 2014 Posted February 20, 2014 So I take it you don't suggest using that old copy of Ghost? Thing is I'm getting close to the wire on this one and don't have a lot of time to learn the 'nuances' of new software (well, new to me)... Anyway it doesn't look like I'm going to have the mandatory profile thing down in time, so I'm not going to put Win7 on the machines if I can't lock it up. Kol. To be honest, setting up MDT would take less then a day from scratch for someone who never used it before. You could simply setup one PC, open MDT, tell it to capture a image, and it does the rest. Other alternatives such as fog or clonezilla as well. Just don't setup each one. Ghost works as well.
Koldov Posted February 21, 2014 Author Posted February 21, 2014 Ok thanks for your help so far. A couple of questions though... A folder called Pupil.pdm.V2 has been written back to the profiles folder to which admin has no access to. Does anyone know what that is? Also nothing has come up in the Start Menu at all! I had removed most of it in the original profile I created but then pinned some standard programs there, but they do not appear. Kol. Edit: Ah well, it seems I have bigger problems... First log-in is fine, but subsequent log-ins throw up errors, MSCEP complains, GPO's don't apply, some web pages don't load and desktop icons don't appear! I am out of time to get this rolled out over the half-term, so I guess I can take my time until April the 8th...
3s-gtech Posted February 21, 2014 Posted February 21, 2014 Don't use the mandatory profile for the desktop, Start Menu, proxy settings etc - they all need to be redirected. Set the permissions on the profiles folder so that it cannot be written back to - you do not want one person changing your mandatory profile! Do you have all the required Windows 7 admx files in your sysvol ready to use? 1
Koldov Posted February 25, 2014 Author Posted February 25, 2014 (edited) OK, thanks to @3s-gtech, that shows I have some glaring gaps in my knowledge. It appears that I don't have the W7 admx files (or Office 2010 or IE 10 for that matter). I have read that it shows 'from local machine' somewhere when viewing GPO's and I have seen that (although I can't find where I read that now). I have also read that a central store needs creating, but I'm not sure if that has been done either. My permissions are a bit of a mess, for ease it looks like they have been set up as 'Everyone' for practically everything on the server, but I inherited it and have never had time to go through every folder listing permissions... Going to really have to grab the bull by the horns and just put it out there and say I feel I'm going to need a lot of help on this one... Kol. Edited February 25, 2014 by Koldov
3s-gtech Posted February 28, 2014 Posted February 28, 2014 Just give us all a shout if needed. My setup was like that when I took it on (worked pretty well to be fair, just a bit 'open') but I've morphed it into a fairly decent setup. Get a Central Store setup in your Sysvol, and get all the necessary ADMXs in there (not a big job, or hard to do). Then GP will start to fly. Permissions wise, go slowly and steadily, changing bit by bit as you can test. Don't go changing all the permissions in one go - you may stuff it up (from experience)! In many cases, you may be able to get away with changing from Full Control to Read and Execute, but I usually like to use Authenticated Users instead of Everyone when possible.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now