Group Policy not applying if problem with mandatory profile

[ArchersIT]

Hi there,

 

We have a well locked down group policy that has been protecting our systems for some time (Windows 2003 domain - XP SP2 clients).

 

We have recently started applying a mandatory profile to the students to change some settings that are not GP enabled and to speed up the setting up of new profiles.

 

Unfortunately there are occasionally problems loading this profile and if that happens it attempts to load a default profile. In this case the group policy is not applied to the student and they have access to everything. Obviously they dont have permissions to do harm to other computers or the servers but they can make a mess of the one they are on.

 

Looking back through posts on here I have enabled the GP settings to log students off if the roaming profile does not load properly, but this does not seem to have made a difference.

 

Has anyone had any experience of this? Any thoughts what to do?

 

Cheers

 

Jonathan

[ajbritton]

If they are running as limited users then they should not even be able to muck up the computer they are logging on to.

[ArchersIT]

They are running as limited users, but without the GP they have access to the C drive and all the desktop settings etc. So far they have only mucked about with desktop colurs etc, but the teachers want to know why they can suddenly do this when it was banned before. Without the GP applied they will also be able to run all the programs that are currently banned.

 

Also, I learned a long time ago that it is better to have many layers of security. While I believe they cannot do any damage, I would rather them not have access to begin with. I am just confused as to why it would not apply the group policy to their new temporary profile when it was applying OK before...

 

Jonathan

[ajbritton]

When the mandatory profile was created, where the permissions on it changed to Everyone using the 'Copy To' utility?

[ArchersIT]

Yes - the madatory profile itself is working fine - we have over 1000 students and it has been working for two weeks, it is just that yesterday and today (with no changes being made) one or two children have failed to pick up the profile and receieved the default one instead. This would be fine if the GP was then applied, but it seems to stop the GP as well.

 

Jonathan

[Kyle]

Are you using redirected folders in the GPo concerned?

 

I have been looking into this just lately and i'm sure iread that there is an issue with using mandatroy profiles and redirected folders......especially if you redirect My Documents'

 

Any one else heard this?

[ArchersIT]

I have redirected folders on one of my year groups - but it is one of the other year groups that these students have been in!

 

Thanks for the thought though - I will have an investigate around.

 

Jonathan

[SpuffMonkey]

Can you not make it "super mandatory"?

[ArchersIT]

Can you not make it "super mandatory"?

 

I would love to Any hints....

 

Jonathan

[SYNACK]

There is an option in AD GPO that logs off the user automatically af the application of the profile errors out.

 

Policy > Computer Configuration > Administrative Templates > System > User Profiles > Log Users off when roaming profile fails

 

This should kick the users off if the mandatory profile fails to load properly so they can't mess with anything. They can then just log in again to regain access so long as it grabs the mandatory profile the next time.

[ajbritton]

EduGeek guide to profiles

 

Mandatory Profiles (inc SuperMandatory)

[ajbritton]

Are you using redirected folders in the GPo concerned?

 

I have been looking into this just lately and i'm sure iread that there is an issue with using mandatroy profiles and redirected folders......especially if you redirect My Documents'

 

Any one else heard this?

 

This will certainly fail if the registry permissions in the mandatory profile have not been changed. This is the same reason that will also cause GP to not take effect.

[ArchersIT]

Ok - thanks for all the responses. I have set the Group Policy setting and started to change the mandatory profiles to Super Manditory (I said I believed in belt and braces!). This has done the trick on my test account, I will let you know if there are any problems with rolling out to the rest of the school.

 

Many thanks again

 

Jonathan

[Kyle]

What are the benifits of Super Mandatory?

[Kyle]

This will certainly fail if the registry permissions in the mandatory profile have not been changed. This is the same reason that will also cause GP to not take effect.

 

 

I am intrigued by this,. can you explain in more detail AJ. Your quote above seems to be a friar description of a lot of problems i am experiencing.

[ArchersIT]

What are the benifits of Super Mandatory?

 

So far the only difference seems to be that it requires the profile to be loaded or they cant log in - this is different from a mandatory profile where if it cant be loaded it will try to load the default profile.

 

Jonathan

[SpuffMonkey]

What are the benifits of Super Mandatory?

 

If the profile doesn't apply - they can't logon - it stopped our little dears pulling the network cables out all the time.

[ajbritton]

This will certainly fail if the registry permissions in the mandatory profile have not been changed. This is the same reason that will also cause GP to not take effect.

 

 

I am intrigued by this,. can you explain in more detail AJ. Your quote above seems to be a friar description of a lot of problems i am experiencing.

 

When creating a mandatory or default user profile (which obviously have to be copied from wherever they are created), it is essential that the profiles are NOT copied by dragging/dropping the folder from 'C:\Documents and Settings\username', but instead by doing the following;

 

1 - Go to the System Properties dialog box

2 - Select the Advanced tab

3 - In the User Profiles section, click Settings

4 - Select the profile you want to copy and click 'Copy To'

5 - Enter or browse to the path you want the profile copied to

6 - Change 'Permitted to use' to Everyone (NB - Location does not matter)

7 - Click OK

 

If you don't do this, the permissions inside the registry (stored in the NTUSER.DAT file) will not allow folder redirection or group policy processing amongst many other things.

[Osprey]

A so called "super mandatory" or as I call it sometimes, a mandatory mandatory profile, is that if you can't access the mandatory profile you can't log on at all.

[Kyle]

Thanks AJ,

 

This is exactly as i did mine. Looks like my problems are with something else not the profile.

[fooby]

The main area to look is always the windows event logs, after that, there are more logs for gp events and such.

 

fooby