Windows 10 mandatory profile

[Arthur]

I suffer the same issue. More precisely I have the problem to create a local mandatory profile and with the usual procedure start menu and cortana don't work.

Even with Windows 7 the method you are using above was unsupported and issue prone. Try the SysPrep + CopyProfile method or the Reg Add method if you know exactly what needs changing in the profile.

 

   
       
           true
       
   

[msette]

I know it is unsupported but as now it is the only one which worked (not completely) for me. Besides the result isn't worth the effort needed by the other methods.

I reported it as a starting point for detecting the real trouble. Just in case of Microsoft doesn't care of it.

Cheers

[samb56]

Really keen to give this method a go!!!!, Can you PM me details for example when you say make a new user are you talking about a domain user or a local user etc.

 

Thank you

 

- - - Updated - - -

 

I suffer the same issue. More precisely I have the problem to create a local mandatory profile and with the usual procedure startmenu and cortana don't work.

Here is a little step toward a partial solution:

1) Create a new user, let it be Template, with administrative privileges.

2) Login Template and configure as your taste. Note the initial oobe saying Windows is configuring apps. Logout.

3) Login as Administrator, rename the Default profile as Default.bak. With WindowEnabler copy the Template profile (the usual method) to Default profile (give Everyone full access).

4) Create a new directory into c:\Users: Mandatory.V5 and give Everyone full access on it. Create the Target local user and redirect its profile directory to c:\Users\Mandatory. Logout.

5) Login as Target (no more oobe - maybe it recognizes already registered apps). Now start menu should work. Cortana not yet. Logout.

6) Now you can close the profile Mandatory.V5 by renaming NTUSER.DAT as NTUSER.MAN.

7) To replicate the process into another pc, it's enough to copy the Default profile there and start from point (4).

 

Waiting for a better solution. Bye

 

Really keen to give this method a go!!!!, Can you PM me details for example when you say make a new user are you talking about a domain user or a local user etc.

 

Thank you

[Arthur]

I know it is unsupported but as now it is the only one which worked (not completely) for me.

Your profile doesn't work properly because it likely contains user-specific settings from the user you copied the profile from.

 

Besides the result isn't worth the effort needed by the other methods.

Trying to get an unsupported solution working is clearly time well spent.

 

The CopyProfile method doesn't take that long.

[Ripleys]

Is Windows ICD not something you are looking for?

[loosus456]

Back in November, 2014, I reported to Microsoft that mandatory profiles were broken. Mandatory profiles were actually broken in Windows 8.1 as well if you used the official CopyProfile method, although the effects were slightly less noticeable. It still wasn't kosher to deploy in a production environment like that.

 

I have reported these issues in Microsoft's Windows 10 Feedback app and in the Windows 10 UserVoice website. I have done this, again, since November, 2014.

 

Nothing has changed.

 

Microsoft gives not two damns about enterprise or education. If they'd acknowledge these issues, I might have less heartburn, but I'm not sure they are even on Microsoft's radar. Windows 8 had these issues for the entire time the operating system was mainstream, and Microsoft did not so much as wink to IT professionals that they were issues.

 

I really wonder if mandatory profiles are even officially supported, anymore. Where is the (recent) documentation on how to properly, officially create them? Good luck finding it. I'd be surprised if current Microsoft programmers/engineers even know that mandatory profiles are a "thing." The folks that worked on mandatory profiles in Windows 7 are probably long gone.

[Mustang]

Back in November, 2014, I reported to Microsoft that mandatory profiles were broken. Mandatory profiles were actually broken in Windows 8.1 as well if you used the official CopyProfile method, although the effects were slightly less noticeable. It still wasn't kosher to deploy in a production environment like that.

 

I have reported these issues in Microsoft's Windows 10 Feedback app and in the Windows 10 UserVoice website. I have done this, again, since November, 2014.

 

Nothing has changed.

 

Microsoft gives not two damns about enterprise or education. If they'd acknowledge these issues, I might have less heartburn, but I'm not sure they are even on Microsoft's radar. Windows 8 had these issues for the entire time the operating system was mainstream, and Microsoft did not so much as wink to IT professionals that they were issues.

 

I really wonder if mandatory profiles are even officially supported, anymore. Where is the (recent) documentation on how to properly, officially create them? Good luck finding it. I'd be surprised if current Microsoft programmers/engineers even know that mandatory profiles are a "thing." The folks that worked on mandatory profiles in Windows 7 are probably long gone.

 

I think you answered your own question in your last paragraph.

 

When we moved to Windows 7 we could see that mandatory profiles were not really supported anymore so we stopped using them then.

 

What do you actually need mandatory profiles for? you can pretty much create a locked down mandatory style profile with group policy / preferences anyway.

Mandatory profile also have issues with some cryptography providers/certificates and Microsoft have stated that they will not add support for these providers to mandatory profiles, the Sage Payroll activation and uk HMRC tax website would be examples of these providers that do not work.

[loosus456]

I think you answered your own question in your last paragraph.

 

When we moved to Windows 7 we could see that mandatory profiles were not really supported anymore so we stopped using them then.

 

What do you actually need mandatory profiles for? you can pretty much create a locked down mandatory style profile with group policy / preferences anyway.

Mandatory profile also have issues with some cryptography providers/certificates and Microsoft have stated that they will not add support for these providers to mandatory profiles, the Sage Payroll activation and uk HMRC tax website would be examples of these providers that do not work.

 

We already use DeepFreeze, so we would not -- if we were using mandatory profiles -- use it for locking-down computers. In fact, we want just the opposite: we want users to do anything they want with these computers but have them reset when reboot. DeepFreeze accomplishes that.

 

The problem is that profiles are wiped out each time the computer is rebooted, as well, which means that login times are always extremely slow.

 

So, we essentially wanted to use mandatory profiles to speed-up login times, and they actually do accomplish that. But they are so broken that we gave up on them and just bought SSDs to get in the ballpark of what you can get with mandatory profiles. Such a a shame.

 

In addition to the things you listed, Microsoft also does not allow mandatory profiles to use the Store in Windows 8.1 and Windows 10, which would be a problem for us as we have classes where the students have to do things in the store on occasion.

 

Add up the problems with mandatory profiles, and it's just not worth the hassle.

[FN-GM]

@MalekoUK did you manage to get the Start Menu issue sorted please? I am having the exact same thing.

 

Thanks

[MalekoUK]

@MalekoUK did you manage to get the Start Menu issue sorted please? I am having the exact same thing.

 

Thanks

 

Still no luck, tried many solutions and still have the same problem. Highly irritating.

[DrCheese]

I don't think any of us have, I'm just leaving it until after Christmas now.

[FN-GM]

Still no luck, tried many solutions and still have the same problem. Highly irritating.

 

I think I might just dump Mandatory profiles and let them use the local default. Then set the group policy to delete them on startup.

[MalekoUK]

I think I might just dump Mandatory profiles and let them use the local default. Then set the group policy to delete them on startup.

 

To be fair, that's the kind of route we will go down when we can be bothered to try again!

[FN-GM]

Have you tried with a super mandatory profile?

[MalekoUK]

Have you tried with a super mandatory profile?

 

Super Mandatory?

[3s-gtech]

Profile file is a .man, and:

 

Super-mandatory user profiles are similar to normal mandatory profiles, with the exception that users who have super-mandatory profiles cannot log on when the server that stores the mandatory profile is unavailable.

[chrisjasztrab]

Found this thread via Google. Looks like MS has created a TechNet article on how to do this in Windows 10

 

https://technet.microsoft.com/en-us/itpro/windows/manage/mandatory-user-profile

[alfatec]

Make sure you create your default profile as a local admin, preferably logged in as admin under audit mode. Do not create as a domain user. There are loads of posts about creating it but I think the MS is the best. We have created

it by doing the MSN method and it all works fine. All down to permissions on the hive and creating as a non domain user.

[chrisjasztrab]

Thanks for the extra tips. Since the anniversary update removed a lot of the GP that I was planning on using to control the machine, I went ahead and purchased the Education Edition. Is there any pro's or cons to using AppLocker rather than GP?