Profiles and Permissions Query

[TechSupp]

Got a strange one or it is to me. Just tried setting up a default user profile so that all students will use the same mandatory settings. Set up the profile OK and set permissions to use it. Created a test user and set it to use the created default profile I created. All seemed well untill I realised it didn't run the logon scripts. Reset to its original profile and they ran OK. Reset to the default profile, logged on and browsed the script folder on the server from the client PC. Tried to run the script manually and got a permission denied! Yet it works with the original profile. Anyone tell me why and how I can sort it out? Didn't think profiles would change how permissions are used.

[maniac]

When you set permissions to use it, did you also open the user.man file in registery editor, and then set the permissions within that registry tree so students can write to it? And don't forget to unload the hive afterwards, else it locks everyone out of the profile!

 

These are seperate to the file permissions and I find mandatory policies will not work properly unless this is done to them.

 

Mike.

[DMcCoy]

how did you copy it? When you use the user profile section in computer properties its sets the registry key permissions as well. If you just copy the files it won't work.

[torledo]

When you set permissions to use it, did you also open the user.man file in registery editor, and then set the permissions within that registry tree so students can write to it? And don't forget to unload the hive afterwards, else it locks everyone out of the profile!

 

These are seperate to the file permissions and I find mandatory policies will not work properly unless this is done to them.

 

Mike.

 

I've also setup a mandatory profile for users, used the user profiles tab in system to copy/create the profile, set permissions to everyone, and then renamed ntuser.man.

 

Do I still need to to do the steps you've mentioned namely open ntuser.man in regedit and edit the permissions. Didn't think this was a requirement - also I thought the point of the ntsuer.man file was that it couldn't be written to and this step seems to negate the reason for using a mandatory profile in the first place.

[maniac]

The fact that you make the registry tree read/write still does not make it possible for changes to be saved. The profile is a mandatory policy, so changes are not saved back to it. All it means is students will have the right to make local changes to the current_user registry group when logged on.

 

This means scripts and GPOs can be applied properly, without the change I find constant problems applying GPOs and running scripts. It's No more dangerous that running a roaming profile, as in a roaming profile users by default have full rights to this area of the registry.

 

I don't actually know the answer to your question Torledo, as I've never come across the method of copying the profile using the system options, I've always copied it manually and made the changes manually as this was the way I was taught to do it about 3 years ago, and its always worked for me!

 

Mike.

[torledo]

The fact that you make the registry tree read/write still does not make it possible for changes to be saved. The profile is a mandatory policy, so changes are not saved back to it. All it means is students will have the right to make local changes to the current_user registry group when logged on.

 

This means scripts and GPOs can be applied properly, without the change I find constant problems applying GPOs and running scripts. It's No more dangerous that running a roaming profile, as in a roaming profile users by default have full rights to this area of the registry.

 

I don't actually know the answer to your question Torledo, as I've never come across the method of copying the profile using the system options, I've always copied it manually and made the changes manually as this was the way I was taught to do it about 3 years ago, and its always worked for me!

 

Mike.

 

I've always had problems with software distribution GPO's so maybe this has something to do with HKCU permissions on my machines.

 

So let me get this straight apply r/w permissions to the entire HKCU registry tree ? What's the best way to make this change for a group of machines. Can it be done in the master/reference ghost image (which is going to be sysprepped) ?