Koldov Posted February 28, 2014 Posted February 28, 2014 (edited) Hi All, As I can't seem to get a working Windows 7 mandatory profile working, I'm looking for alternatives and it got me thinking... What are the benefits of a mandatory profile (with folder redirection) versus a heavily locked down OU? Scenario is we only have 13 classes, all children log-on as their class = 13 log-ins and 13 profiles, so storage for each profile on the local PC is a non-issue. All work is stored in their home folder on the server and their PC access is really only on the ICT suite computers. All pupils sit in one OU with one GPO attached. I'm aware that going through all the GPO's and GPP's is a massive job to lock it down hard enough for them not to do any damage and close all the little loopholes, but really every turn in making a mandatory profile and folder redirection has hit an error which requires masses more research and trial and error. Obviously there is no black and white way to do anything and everyone has a different opinion on how to achieve it. From white icons, or no Start menu icons, to no wallpaper or not picking up desktops shortcuts! It seems that everything is a problem and I'm not getting any clear, simple, comprehensive answers... Time is running out for me to accomplish getting rid of all the XP and I've been driving myself mad trying to work it out, pulling my hair out and losing sleep! Can I just put 7 on these PC's and lock down an OU hard enough through GPO to ensure they can't do anything they aren't supposed to? Kol. Edited February 28, 2014 by Koldov
simpsonj Posted February 28, 2014 Posted February 28, 2014 I've used this guide t o get a machine ready to create a mandatory profile: http://idsuwarno.files.wordpress.com/2010/06/sysprep-a-windows-7-machine.pdf Then this to copy the profile and make it mandatory: Customize the default local user profile when preparing an image of Windows But, in fairness, I tend to have both a mandatory profile and a load of GPOs to lock down students...
synaesthesia Posted February 28, 2014 Posted February 28, 2014 Both here too. One of my favourite things about mandatory is no ruddy profile resets when things *will* go tits up for no apparent reason! That and a little extra security due to malware not hiding itself in profile locations. (in conjunction with delprof)
Koldov Posted February 28, 2014 Author Posted February 28, 2014 I've used this guide t o get a machine ready to create a mandatory profile: http://idsuwarno.files.wordpress.com/2010/06/sysprep-a-windows-7-machine.pdf Then this to copy the profile and make it mandatory: Customize the default local user profile when preparing an image of Windows But, in fairness, I tend to have both a mandatory profile and a load of GPOs to lock down students... That is no small undertaking! Ah, bless XP with it's 'copy to' button out in the open 'letting it all hang out'! So kind of like an nLite thing? Both here too. One of my favourite things about mandatory is no ruddy profile resets when things *will* go tits up for no apparent reason! That and a little extra security due to malware not hiding itself in profile locations. (in conjunction with delprof) Yeah, the way it was set up here was with XP mandatory profiles and GPO's which I've locked down further since I started. I even made a new mandatory profile for XP, just created a user and hit the 'copy to' button. That was after a couple of minutes reading... The profile was small and worked first time! It appears 7 is a bit more of a complicated beast. I tried to make a new user, but there is no copy to button... Then I tried another suggestion about just copying the user's folders, then deleting some of it and a bit of registry-fu (it was 70MB, but I can't find out what to lose as it's not well documented because it's unsupported). Anyway this just plain gave me issues, as I guess I deleted some important stuff (trying to get it to 1 or 2MB). So then I got told about folder redirection (especially APPDATA), but sometimes it works, sometimes it doesn't... I've got no Start Menu, no Desktop, white Taskbar icons.... Kol.
mrbios Posted February 28, 2014 Posted February 28, 2014 (edited) Then I tried another suggestion about just copying the user's folders, then deleting some of it and a bit of registry-fu (it was 70MB, but I can't find out what to lose as it's not well documented because it's unsupported). Anyway this just plain gave me issues, as I guess I deleted some important stuff (trying to get it to 1 or 2MB). So then I got told about folder redirection (especially APPDATA), but sometimes it works, sometimes it doesn't... I've got no Start Menu, no Desktop, white Taskbar icons.... Kol. Definitely do it the supported way, don't try the alternative methods as you'll eventually run into headaches later down the line. It takes a little while to get the setup done for the windows 7 way but if you use vmware workstation rather than faffing about with a physical machine (or other VM system like virtualbox etc) then it's nice and quick. I had an "alternative" method mandatory profile for the first 2 years of windows 7 here, there was always an issue i could never resolve that drove me mad (it mainly effected wireless devices like laptops) then i built it the supported way on a whim one day, and low and behold, not only is the profile tiny, i have absolutely no issues with it. 816kb mandatory profile that nothing ever gets added to is soooooo much nicer than roaming ones. Edited February 28, 2014 by mrbios
karlr Posted February 28, 2014 Posted February 28, 2014 As I have understood it, one of the main motivations for using mandatory profiles as opposed to local profiles (e.g. leaving the profile field blank in AD) is to prevent all of the extra bits and pieces running the first time a user logs onto a machine. These can significantly increase the login time, and of course the user might get nagged about settings things up (or invited to take the Windows Xp tour, etc). Since it appears that your students will be logging in to all of the computers with shared logins, this likely isn't an issue as all of the computers should have a cached profile for each login anyway (assuming you don't clear out profiles on a regular basis). Even with well baked GPOs and everything set up with preferences however, there is still a chance that something could creep into the local profiles; the benefit of mandatory profiles here would be that the registry hive would be restored on each login - you could also zap the cached profiles once a day to try to keep things clean (do mandatory profiles delete files that shouldn't belong at login, or do they just copy down the profile and overwrite as needed?)
synaesthesia Posted February 28, 2014 Posted February 28, 2014 For reference, it's been a long time since we created our profiles (and the last new one was a modified copy of the original) we used a tool that ungreyed out the option that allowed you to copy a profile (doable in windows XP by default but wasn't in 7). Unfortunately I can't remember what that tool was! Fairly sure I'd have found it on here though.
Koldov Posted February 28, 2014 Author Posted February 28, 2014 (edited) Thanks, but I'm even having trouble with the 'supported' way! Take for example typing 'create a Windows 7 Mandatory Profile' into Google... Great! The first hit is a technet.microsoft page, this will tell me all I need! Creating a Mandatory User Profile Oh wait! First line in and it tells me I should have done this (another link). Configuring Standard User Accounts Ok I think that will be it... No! Half way down I need to do this... Customize the Default User Profile by Using CopyProfile - Which looks like a Windows 8 thing! And get this... Windows Automated Installation Kit for Windows 7 Anyway, by this time I'm a bit lost... Unfortunately I'm a 'doing' learner (kinesthetic) and after reading all of that and flicking between pages, it just doesn't sink in. Why can't they put the whole procedure on one page. I'm sure someone has but none of them are 'official' and it always says, 'oh we changed this' or 'you don't need to do this bit' or 'use this bit of 3rd party software to do that bit' AAAAAAAAAGH! I don't have any 'clean' installs of 7 and the last one I did took a day due to 168 updates, (and all the other stuff I have to do) let alone installing software, office (more updates) and AV etc... I don't think I have any machines capable of running a VM either... MS should know that probably 90% of their Business/Corporate/Education customer base are going to need to do this, why would they make it even half this stupidly long winded. Apparently they took the 'copy to' button out because it took extraneous information with it! Errrr... OK stop it doing that then! XP was not this convoluted... Kol. Edited February 28, 2014 by Koldov
free780 Posted February 28, 2014 Posted February 28, 2014 Provided you have instructions for the mandatory profile you could just go through them and create the gpo and gpps.
karlr Posted February 28, 2014 Posted February 28, 2014 MS should know that probably 90% of their Business/Corporate/Education customer base are going to need to do this, why would they make it even half this stupidly long winded. You'll have fun trying to get the libraries feature to function as you want it as well... not much in the way of group policy for those. Oh well, at least you don't have to configure the Start Screen or anything like that (yet). I think you are going to struggle to get everything tweaked nicely though, without having virtual machines or at least some spare boxes you can rebuild as needed. The whole CopyProfile/sysprep thing being a great example of such a time.
mrbios Posted February 28, 2014 Posted February 28, 2014 Oh wait! First line in and it tells me I should have done this (another link). Configuring Standard User Accounts Ok I think that will be it... No! Half way down I need to do this... Customize the Default User Profile by Using CopyProfile - Which looks like a Windows 8 thing! Welcome to Technet, where a step by step guide leads to an unlimited set of pre-requisite guides leaving stressed users lost in a never ending labyrinth of text. If you think this one is bad, then go take a look at their step by step systems for setting up AD FS and Office 365 hybrid deployments with an on premise exchange.
Koldov Posted March 3, 2014 Author Posted March 3, 2014 OK, well I've snagged an extra 1GB of ram from home and am clearing out some HDD space to enable a VM... Any recomendations for a free easy to use VM solution. Oracle Virtual Box? Kol.
karlr Posted March 3, 2014 Posted March 3, 2014 You won't go too far wrong with Oracle VM VirtualBox, yes. There is also VMWare Player, but technically this is for personal/non-commercial use only.
Koldov Posted March 4, 2014 Author Posted March 4, 2014 Cool, so I've got my VM in Virtual Box up and running Windows 7... How much configuring do I have to do before I pull the profile from it? I mean should I do all 168 Windows updates? Install AV? Office? What is actually going to be copied over in this profile anyway? The last time I needed to change something on our old XP profile, I just browsed to it on the server and dropped the 'web shortcut' and a 'favourite' into the required folders and they appeared... How do you get a shortcut to appear when you tell it you want it to go to c:\Program Files\Office while you are on the server and it tells you that shortcut is invalid because you don't have Office installed on the server...? Do I put stuff on the Start Menu now? Favourites? Desktop Icons? Or control all of that later via GPO/GPP? Kol.
zag Posted March 4, 2014 Posted March 4, 2014 Locking down the GPO is the way to go in schools. We completely remove the profile on all users in the school. Students don't need profiles. I have no idea why anyone would do that by design in a high user educational environment.
mrbios Posted March 4, 2014 Posted March 4, 2014 (edited) Locking down the GPO is the way to go in schools. We completely remove the profile on all users in the school. Students don't need profiles. I have no idea why anyone would do that by design in a high user educational environment. Logon times seemingly identical (816kb profile has to go over then network on mandatory). profiles on the machine are 50% of the size when mandatory (it's all trivial though as it's 51mb vs 101mb). Mandatory profiles instantly unload on logoff, presumably there's a way of doing this for local profiles too though but it's not obvious to me at the moment. Overall i prefer mandatory profiles for the above small advantages, and knowing that they're forced into conformity via the profile, so even if some rogue technician deletes a GP things will still be set to a point. Prior to the existence of GPPs it was also the only easy way of solving a particular issue where a program wouldn't load without an empty folder in the user profile that students couldn't create(started with a dot), nowadays that's removed and GPP does it on logon though in the specific area that folder is required, but still my point is that it used to be a solution to a problem even if it isn't one anymore. Changing to local from mandatory is such a trivial change that it's not even worth it. The other reason i use mandatory profiles, is that you know the profile is that way and will forever be that way, and you won't run into issues like this: http://social.technet.microsoft.com/Forums/windows/en-US/7fb93109-218c-43d7-b29a-ceaffc598b58/user-profile-service-service-failed-the-logon-user-profile-cannot-be-loaded?forum=w7itprogeneral Edited March 4, 2014 by mrbios 1
karlr Posted March 4, 2014 Posted March 4, 2014 (edited) How much configuring do I have to do before I pull the profile from it? I mean should I do all 168 Windows updates? Install AV? Office? Ideally it would be a full image that you are using in production.. in reality you're probably going to want at *least* your core applications (esp. office). The last time I needed to change something on our old XP profile, I just browsed to it on the server and dropped the 'web shortcut' and a 'favourite' into the required folders and they appeared... How do you get a shortcut to appear when you tell it you want it to go to c:\Program Files\Office while you are on the server and it tells you that shortcut is invalid because you don't have Office installed on the server...? Do I put stuff on the Start Menu now? Favourites? Desktop Icons? Or control all of that later via GPO/GPP? No, don't put any shortcuts/favourites etc into the profile. It should be purely things that can't be easily controlled via GP or will affect first logon. You can push start menu shortcuts down using GPP - the targeting options mean you can configure it to only create a shortcut if that particular piece of software is installed on the computer. I have seen cases where creating shortcuts via GPP can cause slowdown however, mainly because Anti-Virus wants to scan the target of your shortcut (which can be quite bad if it's a network location that you haven't excepted from scanning). An alternative is to use folder redirection (or use GPP to just *copy* a folder full of pre-configured shortcuts). Edited March 4, 2014 by karlr 1
Koldov Posted March 5, 2014 Author Posted March 5, 2014 On with the updates, AV and office install then... Shame they are not going to release a Service Pack 2 for 7.... Kol.
birchanger Posted March 6, 2014 Posted March 6, 2014 This thread's very interesting to me as profiles are a bane of my life. Everyone at the moment has roaming profiles. Perhaps half a dozen times a day I get students that either get almost logged in before before being thrown back out, or whose redirection policy is permanently failing to apply. These faults are both fixed by deleting the profile. In addition we sometimes get very slow logins. haven't got to the bottom of it but profiles may be part of the problem. We have a very comprehensive set of policies. I suspect too comprehensive, but there's no shortage of nailing down and redirecting going on. So, I reckon that we need either mandatory policies or none. Now I have to admit that I hadn't heard of the latter - how's that work? If we go for mandatory, given that we have everything in policy, what would you put in that profile? What would be better placed in the profile rather than set by GP? Setup here is all Win 7 / Server 2008R2.
gshaw Posted March 6, 2014 Posted March 6, 2014 Cool, so I've got my VM in Virtual Box up and running Windows 7... How much configuring do I have to do before I pull the profile from it? I mean should I do all 168 Windows updates? Install AV? Office? The way I did mine on Windows 7 was to make my base image as a virtual machine then snapshot it just before running sysprep. Then after the image was captured to SCCM I reverted the snapshot to work on the profile. That way you'll be working on a machine that matches the base state of how all your other workstations will be. Personally I'd say do it without AV as the scanning increases the likelihood of problems. Once done replace the original sysprep file with the basic "copyprofile" one and run sysprep to generate the supported profile. At this point I deviate from the Microsoft guide as they say click the Copy To button and provide a UNC path. With my machine being on virtual (and thus not part of a domain) I found it easier to do the copy to a local folder on the VM then extract it manually (e.g. via the C$ admin share). Finally copy it to a suitable place on the network and test, worked perfectly for me with Windows 7 and about 220 machines. Boot time from powered off state to working desktop was 1 minute 30 seconds
karlr Posted March 6, 2014 Posted March 6, 2014 Perhaps half a dozen times a day I get students that either get almost logged in before before being thrown back out, or whose redirection policy is permanently failing to apply. Do you have "Move the contents of Documents to the new location" enabled for your redirection policies? I have seen cases where this will fail when copying for example "My Music", with an error about security descriptors So, I reckon that we need either mandatory policies or none. Now I have to admit that I hadn't heard of the latter - how's that work? If we go for mandatory, given that we have everything in policy, what would you put in that profile? What would be better placed in the profile rather than set by GP? Anything that is going to affect their first logon experience should be baked into a mandatory profile. You will still be relying on GP for the vast majority of things however. I'm wondering if "User Experience Virtualization" (UE-V) is any good. Roaming profiles may be bad, but not having personal/app settings synced for roaming users also isn't great..
the_quick Posted March 13, 2014 Posted March 13, 2014 Mandatory here as well. We started with roaming and it was causing few issues, mainly with logging in - the profile grew and it than took longer to load it. Or sometime it just got corrupted - really annoying. Switched to mandatory and never looked back. Ours in not tiny, around 30MB but lots of software settings embedded in it, like office, serif apps etc.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now