ArchersIT Posted November 9, 2007 Posted November 9, 2007 Hi there, We have a well locked down group policy that has been protecting our systems for some time (Windows 2003 domain - XP SP2 clients). We have recently started applying a mandatory profile to the students to change some settings that are not GP enabled and to speed up the setting up of new profiles. Unfortunately there are occasionally problems loading this profile and if that happens it attempts to load a default profile. In this case the group policy is not applied to the student and they have access to everything. Obviously they dont have permissions to do harm to other computers or the servers but they can make a mess of the one they are on. Looking back through posts on here I have enabled the GP settings to log students off if the roaming profile does not load properly, but this does not seem to have made a difference. Has anyone had any experience of this? Any thoughts what to do? Cheers Jonathan
ajbritton Posted November 9, 2007 Posted November 9, 2007 If they are running as limited users then they should not even be able to muck up the computer they are logging on to.
ArchersIT Posted November 9, 2007 Author Posted November 9, 2007 They are running as limited users, but without the GP they have access to the C drive and all the desktop settings etc. So far they have only mucked about with desktop colurs etc, but the teachers want to know why they can suddenly do this when it was banned before. Without the GP applied they will also be able to run all the programs that are currently banned. Also, I learned a long time ago that it is better to have many layers of security. While I believe they cannot do any damage, I would rather them not have access to begin with. I am just confused as to why it would not apply the group policy to their new temporary profile when it was applying OK before... Jonathan
ajbritton Posted November 9, 2007 Posted November 9, 2007 When the mandatory profile was created, where the permissions on it changed to Everyone using the 'Copy To' utility?
ArchersIT Posted November 9, 2007 Author Posted November 9, 2007 Yes - the madatory profile itself is working fine - we have over 1000 students and it has been working for two weeks, it is just that yesterday and today (with no changes being made) one or two children have failed to pick up the profile and receieved the default one instead. This would be fine if the GP was then applied, but it seems to stop the GP as well. Jonathan
Kyle Posted November 9, 2007 Posted November 9, 2007 Are you using redirected folders in the GPo concerned? I have been looking into this just lately and i'm sure iread that there is an issue with using mandatroy profiles and redirected folders......especially if you redirect My Documents' Any one else heard this?
ArchersIT Posted November 9, 2007 Author Posted November 9, 2007 I have redirected folders on one of my year groups - but it is one of the other year groups that these students have been in! Thanks for the thought though - I will have an investigate around. Jonathan
ArchersIT Posted November 9, 2007 Author Posted November 9, 2007 Can you not make it "super mandatory"? I would love to Any hints.... Jonathan
SYNACK Posted November 9, 2007 Posted November 9, 2007 There is an option in AD GPO that logs off the user automatically af the application of the profile errors out. Policy > Computer Configuration > Administrative Templates > System > User Profiles > Log Users off when roaming profile fails This should kick the users off if the mandatory profile fails to load properly so they can't mess with anything. They can then just log in again to regain access so long as it grabs the mandatory profile the next time.
ajbritton Posted November 9, 2007 Posted November 9, 2007 EduGeek guide to profiles Mandatory Profiles (inc SuperMandatory)
ajbritton Posted November 9, 2007 Posted November 9, 2007 Are you using redirected folders in the GPo concerned? I have been looking into this just lately and i'm sure iread that there is an issue with using mandatroy profiles and redirected folders......especially if you redirect My Documents' Any one else heard this? This will certainly fail if the registry permissions in the mandatory profile have not been changed. This is the same reason that will also cause GP to not take effect.
ArchersIT Posted November 9, 2007 Author Posted November 9, 2007 Ok - thanks for all the responses. I have set the Group Policy setting and started to change the mandatory profiles to Super Manditory (I said I believed in belt and braces!). This has done the trick on my test account, I will let you know if there are any problems with rolling out to the rest of the school. Many thanks again Jonathan
Kyle Posted November 9, 2007 Posted November 9, 2007 This will certainly fail if the registry permissions in the mandatory profile have not been changed. This is the same reason that will also cause GP to not take effect. I am intrigued by this,. can you explain in more detail AJ. Your quote above seems to be a friar description of a lot of problems i am experiencing.
ArchersIT Posted November 9, 2007 Author Posted November 9, 2007 What are the benifits of Super Mandatory? So far the only difference seems to be that it requires the profile to be loaded or they cant log in - this is different from a mandatory profile where if it cant be loaded it will try to load the default profile. Jonathan
SpuffMonkey Posted November 9, 2007 Posted November 9, 2007 What are the benifits of Super Mandatory? If the profile doesn't apply - they can't logon - it stopped our little dears pulling the network cables out all the time.
ajbritton Posted November 9, 2007 Posted November 9, 2007 This will certainly fail if the registry permissions in the mandatory profile have not been changed. This is the same reason that will also cause GP to not take effect. I am intrigued by this,. can you explain in more detail AJ. Your quote above seems to be a friar description of a lot of problems i am experiencing. When creating a mandatory or default user profile (which obviously have to be copied from wherever they are created), it is essential that the profiles are NOT copied by dragging/dropping the folder from 'C:\Documents and Settings\username', but instead by doing the following; 1 - Go to the System Properties dialog box 2 - Select the Advanced tab 3 - In the User Profiles section, click Settings 4 - Select the profile you want to copy and click 'Copy To' 5 - Enter or browse to the path you want the profile copied to 6 - Change 'Permitted to use' to Everyone (NB - Location does not matter) 7 - Click OK If you don't do this, the permissions inside the registry (stored in the NTUSER.DAT file) will not allow folder redirection or group policy processing amongst many other things.
Osprey Posted November 11, 2007 Posted November 11, 2007 A so called "super mandatory" or as I call it sometimes, a mandatory mandatory profile, is that if you can't access the mandatory profile you can't log on at all.
Kyle Posted November 12, 2007 Posted November 12, 2007 Thanks AJ, This is exactly as i did mine. Looks like my problems are with something else not the profile.
fooby Posted November 12, 2007 Posted November 12, 2007 The main area to look is always the windows event logs, after that, there are more logs for gp events and such. fooby
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now