W10 - Mandatory Profile issues

[Scottyboy99]

Morning All,

 

We're currently in the process of testing Windows 10 for students (we already have some staff testing it for us who are giving helpful feedback), for students we would like to stick with a Mandatory profile, mainly because it is easier to manage one profile rather than 4000+ roaming profiles, and it is quick to log on.

 

I have configured a Mandatory profile for Windows 10 and assigned it to our test student account, however when logged on with this profile the user's start menu does not open, the action centre doesn't work, nor does Cortana.. has anybody else experience this? If so, have you found a fix?

 

Cheers

[3s-gtech]

Have you redirected AppData at all? I think you will struggle with a 'pure' mandatory profile with Windows 10 - it seems very dependent on having writable individual profile data but redirecting AppData may help here.

[Scottyboy99]

Have you redirected AppData at all? I think you will struggle with a 'pure' mandatory profile with Windows 10 - it seems very dependent on having writable individual profile data but redirecting AppData may help here.

 

We currently have roaming AppData redirected to the users Home drive

 

Cheers

[synaesthesia]

I stumbled across this whilst testing it in preview phase and redirected appdata to the home drive however found it was merely permissions stopping it from working. I gave full permission to %username% and SYSTEM and all worked OK from there.

[Scottyboy99]

I stumbled across this whilst testing it in preview phase and redirected appdata to the home drive however found it was merely permissions stopping it from working. I gave full permission to %username% and SYSTEM and all worked OK from there.

 

Thanks for the info, we have these permissions in place for the home drive and the mandatory profile itself, is there another location that needs these permissions?

 

Cheers,

[gavinh]

The problem appears to be when a user first logs on a restricted registry entry is created in:

HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\DeviceAccess

You currently unable to edit, delete or rename those keys. and the Start-Menu is restricted to the first User to log in.

 

---------------

Quick notes

---------------

Copy the 'Default Profile' from a workstation, rename to \\ServerName\ProfileShare\profilename.V5\ ntuser.man set NTFS and registry permissions for 'Authenticated users' and use that for a mandatory profile. If you want to make changes; log in as a different user and export its ntuser.dat registry values and import to the \\ServerName\ProfileShare\profilename.V5\ ntuser.man

 

------------------

Full instructions

------------------

Step1

Log into Windows 10 as an administrator

Right Click Start Menu

Select 'System' > 'Advanced system settings'

Click on 'Default Profile'

Click 'Copy To'

e.g \\ServerName\ProfileShare\profilename.V5

 

Run regedit click on HKEY-Users and Load Hive - browse to \\ServerName\ProfileShare\profilename.V5\ntuser.dat

Give hive a name e.g. hive

Set the permissions on the hive (FULL CONTROL for 'authenticated users)

unload hive

Set the NTFS permissions on: \\ServerName\ProfileShare\profilename.V5 (READ for 'authenticated users') make sure owner is 'Administrators'

rename 'ntuser.dat' to 'ntuser.man'

This will be your mandatory profile which can be given / copied and assigned to any user.

WARNING: never log on with your mandatory profile without renaming 'ntuser.dat' to ntuser.man, otherwise this will Break the Start-Menu for all other Users using the profile.

 

Step2

If you want to modify the mandatory profile:

Login as another user and make any necessary changes.

run regedit and load the ntuser.dat from chosen users profile and load to a registry hive under HKEY-Users (keep the the same name as before. e.g. hive)

export the registry keys

unload hive

load the ntuser.man from your mandatrory profile to registry hive (keep the same name as before. e.g. hive)

import the registry keys you have just exported

unload hive

delete the .LOG1 or .blf files if you want

Done

 

DISCLAIMER: This works for us but no guarantees, hopefully Microsoft will fix this! so those steps may not be necessary in the future and standard practices may resume. Good Luck!!

Edited December 8, 2015 by gavinh

[heper]

@gavinh

your procedure works brilliantly, thanks!

one remaining issue: startmenu search doesn't work

 

i'm having an additional problem: we are using super-mandatory profiles.

this make windows rebuild the entire profile on logon. on windows7 this worked fine.

On windows 10 this increased our logon-time to over 2 minutes.

 

It takes ages before the %appdata%\Local\Microsoft\ folder is generated. (around 100MB)

this folder has useless things like appdb caches ...

 

any clue to speedup login time?

Edited December 9, 2015 by heper

[Scottyboy99]

The problem appears to be when a user first logs on a restricted registry entry is created in:

HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\DeviceAccess

You currently unable to edit, delete or rename those keys. and the Start-Menu is restricted to the first User to log in.

 

---------------

Quick notes

---------------

Copy the 'Default Profile' from a workstation, rename to \\ServerName\ProfileShare\profilename.V5\ ntuser.man set NTFS and registry permissions for 'Authenticated users' and use that for a mandatory profile. If you want to make changes; log in as a different user and export its ntuser.dat registry values and import to the \\ServerName\ProfileShare\profilename.V5\ ntuser.man

 

------------------

Full instructions

------------------

Step1

Log into Windows 10 as an administrator

Right Click Start Menu

Select 'System' > 'Advanced system settings'

Click on 'Default Profile'

Click 'Copy To'

e.g \\ServerName\ProfileShare\profilename.V5

 

Run regedit click on HKEY-Users and Load Hive - browse to \\ServerName\ProfileShare\profilename.V5\ntuser.dat

Give hive a name e.g. hive

Set the permissions on the hive (FULL CONTROL for 'authenticated users)

unload hive

Set the NTFS permissions on: \\ServerName\ProfileShare\profilename.V5 (READ for 'authenticated users') make sure owner is 'Administrators'

rename 'ntuser.dat' to 'ntuser.man'

This will be your mandatory profile which can be given / copied and assigned to any user.

WARNING: never log on with your mandatory profile without renaming 'ntuser.dat' to ntuser.man, otherwise this will Break the Start-Menu for all other Users using the profile.

 

Step2

If you want to modify the mandatory profile:

Login as another user and make any necessary changes.

run regedit and load the ntuser.dat from chosen users profile and load to a registry hive under HKEY-Users (keep the the same name as before. e.g. hive)

export the registry keys

unload hive

load the ntuser.man from your mandatrory profile to registry hive (keep the same name as before. e.g. hive)

import the registry keys you have just exported

unload hive

delete the .LOG1 or .blf files if you want

Done

 

DISCLAIMER: This works for us but no guarantees, hopefully Microsoft will fix this! so those steps may not be necessary in the future and standard practices may resume. Good Luck!!

 

Thanks for that, unfortunately this didn't solve the problem this end :-(

 

Starting to get a bit fed up.. Might stick with Windows 7 a bit longer

[gavinh]

Hi just to clarify we are currently running: Windows 10 Education V1511 build 10586.17

 

We have redirected start menu, desktop and appdata and use an xml file to control the Start Layout.

 

Logon times seem fine so far (about 30 seconds on slowest workstations) but it does to appear to copy 100mb into the c:\users\userprofile\appdata\local\microsoft folder, which should get removed on logout.

 

Below are our profile Computer Group Policy settings

 

System/User Profile

Policy Setting Comment

Add the Administrators security group to roaming user profiles Enabled

Delete cached copies of roaming profiles Enabled

Delete user profiles older than a specified number of days on system restart Enabled

Delete user profiles older than (days) 1

 

Policy Setting Comment

Do not log users on with temporary profiles Enabled

Wait for remote user profile Enabled

 

Windows Components/App Package Deployment

Policy Setting Comment

Allow deployment operations in special profiles Enabled

 

-----------

I didn't notice Cortana/search not working as I hid that from the task bar as didn't really see the need for our students. Found out if you copy the hidden folder C:\users\Default to \\ServerName\ProfileShare\profilename.V5\ ntuser.man instead of copying the "Default Profile" and follow the rest of my procedure it seems to work OK. Sorry I didn't pick that up before.

 

Now apart from removing the settings menu from the start menu, and other silly things for the students to mess with, we are ready to roll out Windows 10 to all our workstations. So instead we will leave Microsoft to put out their 200434393 service/security/patches/updates and also wait till the Sun is hot and the days are longer

Edited December 10, 2015 by gavinh

[mprudhomme13]

System/User Profile

Policy Setting Comment

Add the Administrators security group to roaming user profiles Enabled

Delete cached copies of roaming profiles Enabled

Delete user profiles older than a specified number of days on system restart Enabled

Delete user profiles older than (days) 1

 

Policy Setting Comment

Do not log users on with temporary profiles Enabled

Wait for remote user profile Enabled

 

Hi,

 

To start sorry for my english.

I work in high schools in France and I have exactly the same configuration.

 

 

The mandatory profile works well and the start menu also with domain controllers in 2008R2.

 

 

But the same configuration and the same client with domain controllers in 2012R2 or 2016 Technical Preview 4, the start menu doesn't work

 

 

Really strange, i don't understand the problem.

[Garacesh]

 

Step2

If you want to modify the mandatory profile:

Login as another user and make any necessary changes.

run regedit and load the ntuser.dat from chosen users profile and load to a registry hive under HKEY-Users (keep the the same name as before. e.g. hive)

export the registry keys

unload hive

load the ntuser.man from your mandatrory profile to registry hive (keep the same name as before. e.g. hive)

import the registry keys you have just exported

unload hive

delete the .LOG1 or .blf files if you want

Done

 

Question: What registry keys?

I get that some stuff like Cortana can be disabled via policy, but what about things like modifying items pinned to the task bar? I'd like to get rid of multiple desktops (for the kids, at least) and pin a few different programs, but if logging in with the default profile will break the start menu, how can I make the changes? When you say login with a different user, do you mean a different user using the default profile, or using one Windows generates itself?

[gavinh]

Question: What registry keys?

I get that some stuff like Cortana can be disabled via policy, but what about things like modifying items pinned to the task bar? I'd like to get rid of multiple desktops (for the kids, at least) and pin a few different programs, but if logging in with the default profile will break the start menu, how can I make the changes? When you say login with a different user, do you mean a different user using the default profile, or using one Windows generates itself?

 

Yes log in with a user and let Windows generate a new profile, make any changes and log out. Then load its ntuser.dat file to a registry hive and export all its registry entries or just the ones you require. Import the registry settings into the copy of the 'Default' profile taken from c:\users\default. Hope this helps.

Edited December 14, 2015 by gavinh

[Garacesh]

How do I know which ones I require?

Do I need to do some kind of comparison? Or will keys be identical besides whichever ones I've changed? Will there not be an issue with one profile being mandatory and one being roaming? (Or whatever .DAT is)

 

I've kind of inherited a deployment server and I've not done this kind of stuff before, sorry

[gavinh]

How do I know which ones I require?

Do I need to do some kind of comparison? Or will keys be identical besides whichever ones I've changed? Will there not be an issue with one profile being mandatory and one being roaming? (Or whatever .DAT is)

 

I've kind of inherited a deployment server and I've not done this kind of stuff before, sorry

 

ntuser.dat contains all the users registry entries, renaming it to ntuser.man locks the profile so no changes can be made. No there is no problem as such copying entries from one ntuser.dat to another ntuser.man file, apart from you may get some reference to the other user. This doesn't seem to cause us any problems and can be easily sorted later if it causes any issues. A cleaner way but more work is to just copy over the reg setting you want need such as "%HKEY%\Control Panel\ will be control panels changes. "%HKEY%\Software\Microsoft\Internet Explorer (internet explorer) etc..

 

I've now found this article which may better explain things, and even though it is for Windows 8 still seems relevant here:

http://stealthpuppy.com/customize-the-windows-default-profile/

Edited December 15, 2015 by gavinh

[Garacesh]

Has anybody gotten the default profile working by booting into Audit mode and modifying the Administrator profile?

 

I'm trying to do this as it lets me turn off all the stalker settings, modify libraries (Desktop, Documents et-al) to point at their user area (which should fix a sporadic Win7 issue that doesn't map documents properly) but whenever I sysprep and reboot it fails.

"Windows could not complete the installation. To install Windows on this computer, restart the installation."

 

I'm pretty much just giving every avenue a bash to see what works since we're six months away from making the switch, so I have plenty of time.

[Scottyboy99]

Hi everyone

 

I created a Mandatory profile using the method above, all working ok apart from the pinned taskbar shortcuts (see screenshot below), Once logged on they appear as blank pages and only work if I right-click on them to launch the program.. Not ideal. Has anyone else come across this?

 

Cheers

 

[arjanver]

Followed this guide, but start menu isn't working(it won't display/popup)

[rebelldtu]

Im having the same issue. I have heavily modified the default profile and copied it up to the server and made it Mandatory. Some settings dont stick such as the reassignment of default applications and changes to privacy settings and application usage. However everything other than Search and Action Menu seems functional at this point. I renamed .man back to .dat gave everyone full permissions to the profile and made some changes, switched back to .man but this broke the whole profile. I used to use this method in Win 7 but definitely no joy in Win 10 using this method... As soon as the Mandatory profile is removed from the user all is well with search and action centre.. I have also applied the GPO setting for special profile deployment but this hasnt helped.

Scottyboy99....Mandatory profiles are not able to set Taskbar and Start Menu Options you can set this independently by changing the tiles to suit your layout then use power shell Export-Startlayout... copy it to a server share and use GPO to deploy it to all machines.

[Garacesh]

Did anyone have a problem with trying to login as a user with a mandatory profile sits on "Preparing Windows", and then just immediately signs back out?

 

Having trouble getting past this. Might be due to the registry keys I deleted in the ntuser.man hive, but hoping someone else has a solution.

 

Both the profile folder and the ntuser.man have full control given to our Pupils AD Group and 'Authenticated Users'

[3s-gtech]

Sorry if it's the same as stated, but have you given Full Control on the registry hive (within RegEdit) too?

[Garacesh]

Sorry if it's the same as stated, but have you given Full Control on the registry hive (within RegEdit) too?

Yup, that's what I meant by

the ntuser.man [has] full control given to our Pupils AD Group and 'Authenticated Users'

Sorry if I wasn't quite clear enough. First time doing this kinda stuff. Old NM sorted out our W7 mandatory profiles.

 

I loaded the hive, modified the permissions, changed most of the \PupilProfile\'s to \%USERNAME%\ where appropriate (Or C:\LocalProfiles\PupilProfile.V5\ where required), deleted a few registry strings relating to the Start Menu (and I believe it was 3 other keys, because they wouldn't let me modify them), unloaded the hive, deleted the .LOG files.

Edited April 12, 2016 by Garacesh

[3s-gtech]

Did you also select the tickbox to replace all child permissions (under Advanced on the Security tab). I'm not convinced this is the issue, but it's good to check. Can clients definitely access the share where the profile is, and is the profile path correct (without the .v5 extension) in AD?

[Garacesh]

The path is correct (I learned 'without .V5' the long way, after my C:\LocalProfiles folder ended up with both a PupilProfile.V5 and a PupilProfile.V5.V5 lol)

 

Child permissions were inherited. I s'pose I could just try making it available to 'Everyone', see if that works?

 

The profile is on the C:\ drive so I can't see why they shouldn't be able to access it. I shall double-check the permissions on the LocalProfiles folder once my testbed finishes reimaging.

[Sccmrules]

Just tried mandatory profile (simply copy the Default and renamed folder to .V6) on Windows 10 TP Enterprise Build 14332 and Start Menu and Search work fine. This build is quite responsive.

NOTE: This build 14332 is .V6

[Garacesh]

The problem appears to be when a user first logs on a restricted registry entry is created in:

HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\DeviceAccess

You currently unable to edit, delete or rename those keys. and the Start-Menu is restricted to the first User to log in.

 

---------------

Quick notes

---------------

Copy the 'Default Profile' from a workstation, rename to \\ServerName\ProfileShare\profilename.V5\ ntuser.man set NTFS and registry permissions for 'Authenticated users' and use that for a mandatory profile. If you want to make changes; log in as a different user and export its ntuser.dat registry values and import to the \\ServerName\ProfileShare\profilename.V5\ ntuser.man

 

------------------

Full instructions

------------------

Step1

Log into Windows 10 as an administrator

Right Click Start Menu

Select 'System' > 'Advanced system settings'

Click on 'Default Profile'

Click 'Copy To'

e.g \\ServerName\ProfileShare\profilename.V5

 

Run regedit click on HKEY-Users and Load Hive - browse to \\ServerName\ProfileShare\profilename.V5\ntuser.dat

Give hive a name e.g. hive

Set the permissions on the hive (FULL CONTROL for 'authenticated users)

unload hive

Set the NTFS permissions on: \\ServerName\ProfileShare\profilename.V5 (READ for 'authenticated users') make sure owner is 'Administrators'

rename 'ntuser.dat' to 'ntuser.man'

This will be your mandatory profile which can be given / copied and assigned to any user.

WARNING: never log on with your mandatory profile without renaming 'ntuser.dat' to ntuser.man, otherwise this will Break the Start-Menu for all other Users using the profile.

 

Step2

If you want to modify the mandatory profile:

Login as another user and make any necessary changes.

run regedit and load the ntuser.dat from chosen users profile and load to a registry hive under HKEY-Users (keep the the same name as before. e.g. hive)

export the registry keys

unload hive

load the ntuser.man from your mandatrory profile to registry hive (keep the same name as before. e.g. hive)

import the registry keys you have just exported

unload hive

delete the .LOG1 or .blf files if you want

Done

 

DISCLAIMER: This works for us but no guarantees, hopefully Microsoft will fix this! so those steps may not be necessary in the future and standard practices may resume. Good Luck!!

 

Having finally decided to delve into profiles I was tearing my hair out trying to get them working.. This fixed everything. Thank you!