Mandatory profiles.. Where do I even begin?

[Garacesh]

I've tried creating a local user, copying off all the files, modifying the registry hive so Authenticated Users have full control... And that didn't work. This is before we even begin to start cutting down the profile (even the redundant Contacts, Desktop, Downloads etc still exist, as well as AppData in its entirety)

 

So now I'm basically stuck. AFAIK, that was what you did, and then you cut down AppData from there. But I can't even log in as my test user. It sits on "Preparing Windows" for a while, then jumps straight to "Signing out".

 

Any guides I could be pointed at? I'm not finding any guides for Windows 10 online, and whilst I can't imagine too much has changed, I'd think that there would be some differences between .V5 profiles and earlier versions.

[3s-gtech]

Where are you storing the centralised profile? Do the users have read NTFS and share permissions to it? What do the error logs say on the PC when you try to log in?

[Garacesh]

Where are you storing the centralised profile?

Locally, copied from the server as part of a startup script.

Do the users have read NTFS and share permissions to it?

Yes.

What do the error logs say on the PC when you try to log in?

What, you mean besides the Cortana errors repeated over and over, because I've disabled it via policy?

 

Not sure how relevant any of these are..

Failed to process policy info.
Error details: "The parameter is incorrect.
".

The Windows logon process has failed to spawn a user application. Application name: . Command line parameters: C:\Windows\system32\userinit.exe.

Windows failed to apply the Group Policy Internet Settings settings. Group Policy Internet Settings settings might have its own log file. Please click on the "More information" link.

Windows failed to apply the Group Policy Registry settings. Group Policy Registry settings might have its own log file. Please click on the "More information" link.

Windows failed to apply the Group Policy Files settings. Group Policy Files settings might have its own log file. Please click on the "More information" link.

Windows failed to apply the Folder Redirection settings. Folder Redirection settings might have its own log file. Please click on the "More information" link.

[3s-gtech]

Have you tried doing it from a central UNC share? Bear with me on that one - it does work well if kept compact - I have seen 500+ of my machines logged in at once (quickly too) from that one profile (which is DFS-R shared via the sysvol). It should be straightforward to check and re-check the permissions and any sharing oddness from here.

 

How did you copy the files across? For my Windows 10 profile I used the Copy To box in System Properties/User Profiles and it worked very nicely.

[Garacesh]

Have you tried doing it from a central UNC share? Bear with me on that one - it does work well if kept compact - I have seen 500+ of my machines logged in at once (quickly too) from that one profile (which is DFS-R shared via the sysvol). It should be straightforward to check and re-check the permissions and any sharing oddness from here.

 

How did you copy the files across? For my Windows 10 profile I used the Copy To box in System Properties/User Profiles and it worked very nicely.

 

I haven't tried doing it from a central UNC share, no.

 

The profile is copied across from our file server (alongside other things such as wallpapers, themes, the start menu, etc) to the local disk as part of a ROBOCOPY /MIR script that runs at Startup via GPO. The reason I have it this way is so that if network connectivity dies, all the resources are held locally and provided the user has already logged on, they can still get on with work and save it to a USB device if need be. If the profile, start menu, etc are held on the network I'm not too sure how that plays out if the network connection drops. It's also useful for laptops, tablets and other such wireless devices to host it locally - the files are modified very rarely once they're established. This does have the disadvantage of needing a power cycle to update desktop/start menu/etc but given the low frequency of software changes, it's not really a problem.

 

Bear in mind I have very little knowledge of profiles, so I have no idea what you're on about when you mention a Copy To box

If you're asking how I obtained my original copy of the profile (the .DAT and associated files that get modified to become the mandatory profile), I've simply copied it from the local machine. My first attempt involved creating a local account (ProfileUser) and copying off the C:\Users\ProfileUser directory, the second involved creating a test pupil account and logging in with that (letting it create the profile on the C:\ drive in the location where the mandatory profile should exist) and copying that off.

 

I hope I'm making sense.

Edited May 9, 2016 by Garacesh

[3s-gtech]

 

This is the proper way, I haven't tried yours since back in XP days and I can't remember how successful it was then. You can use this method with a domain user - log on as that user with a local profile (nothing in the profile path in AD), change the settings you want, log off, then use this options.

 

If the network goes down, using a mandatory profile like this (super mandatory in our case, with the .man extension) users cannot log on if the profile is not available. Here, this suits us as it stops users pulling the network lead out and bypassing any GPOs - the logon just fails.

[Garacesh]

[ATTACH=CONFIG]36645[/ATTACH]

Awesome - question, how do I get to that screen? Instinct was to check netplwiz but I can't find anything resembling that.

 

This is the proper way, I haven't tried yours since back in XP days and I can't remember how successful it was then. You can use this method with a domain user - log on as that user with a local profile (nothing in the profile path in AD), change the settings you want, log off, then use this options.

I recall the method I'm using working with Windows 7, fairly certain that's how the old NM got the profile working. Maybe not, though. I can't say for certain.

 

If the network goes down, using a mandatory profile like this (super mandatory in our case, with the .man extension) users cannot log on if the profile is not available. Here, this suits us as it stops users pulling the network lead out and bypassing any GPOs - the logon just fails.

Even with a local copy of the mandatory profile the logon fails if they pull out the cable, as the logon process requires connection to a domain controller to authenticate the credentials. GPO sets cached credentials to 0.

Speaking of super-mandatory, what's the difference (besides one having a folder called Profile.v5 and the other being Profile.man)?

Renaming the NTUSER.DAT file to NTUSER.MAN makes the profile read-only so nothing gets changed. What are the benefits of super-mandatory?

[DJ-1701]

Awesome - question, how do I get to that screen? Instinct was to check netplwiz but I can't find anything resembling that.

 

Go to Control Panel -> System and Security -> System

 

Click Advanced system settings (link on left)

 

In the User Profiles section, click 'Settings...'

[3s-gtech]

Right click on Computer / Properties (the System dialog in Control Panel) then click on Advanced system settings (the System Properties dialog) and the Advanced tab of that. Then click User Profiles.

[MartinRouterKing]

I think you also may need to use a tool called windows enabler to enable the copy to.

[Garacesh]

Go to Control Panel -> System and Security -> System

 

Click Advanced system settings (link on left)

 

In the User Profiles section, click 'Settings...'

 

Right click on Computer / Properties (the System dialog in Control Panel) then click on Advanced system settings (the System Properties dialog) and the Advanced tab of that. Then click User Profiles.

 

It won't let me copy the profile I set up.

 

The only profile I can copy is the Default Profile (which I haven't modified as it's not actually an account..)

[3s-gtech]

Yup, you need to login as a user with a local profile first (with no GPs applied to it), then log back on as your local admin and use Copy To on that account.

[Garacesh]

That's exactly what I did. ProfileUser is a local account that I've logged into and customised.

When taking that screenshot, I was logged in as the local administrator.

 

Do I have to have logged in during the same session? I rebooted after modifying the profile to make sure no system files were in use or anything.

[sted]

That's exactly what I did. ProfileUser is a local account that I've logged into and customised.

When taking that screenshot, I was logged in as the local administrator.

 

Do I have to have logged in during the same session? I rebooted after modifying the profile to make sure no system files were in use or anything.

 

I don't think that works on anything post xp (possibly vista) the official way of creating a mandatory profile is to sysprep the machine I believe but I gave up on mandatory about the time I switched to win7 and with win 10 ive gone local profiles seems happier

[3s-gtech]

It needs to be a domain account, not local. This method works up to and including Windows 10.

[Garacesh]

It needs to be a domain account, not local. This method works up to and including Windows 10.

 

 

So I've logged in as an AD user that exists in an OU with no policy applied to it and modified the profile... And it doesn't show up in the User Profiles list! Just Default Profile and the local admin

[3s-gtech]

Has that AD user got a blank Profile field in AD, so that it creates a local profile for that user when they log in? If it's still set as mandatory, it gets deleted on logout.

[Garacesh]

Has that AD user got a blank Profile field in AD, so that it creates a local profile for that user when they log in? If it's still set as mandatory, it gets deleted on logout.

 

No. Their profile is set to be located at C:\PupilProfile (which didn't exist so when test account was first logged in it was created) and that folder does exist, containing all the libraries (contacts, desktop, documents etc), NTUSER.DAT, ntuser.ini and the AppData folder.

[3s-gtech]

Make it blank, then try again. It copies the profile from the default location, so if you move it or specify it elsewhere the Copy To command won't work. Keep it as simple as possible at this stage.

[Garacesh]

Make it blank, then try again. It copies the profile from the default location, so if you move it or specify it elsewhere the Copy To command won't work. Keep it as simple as possible at this stage.

 

So the profile has to be C:\Users\etc?

I'll give it a try.

[3s-gtech]

The profile has to be:

 

 

Completely blank.

[Garacesh]

Still no good. Can't copy it off.

 

 

Profile path has been left blank, so has generated under C:\Users\15profiletest

[3s-gtech]

Okay, plan C. Just copy the Default Profile. You'll get it how you want afterwards anyway, but at least it gives you a base that works. Once that has copied, put it in your local profile folder or profile UNC share, set the AD profile path and you can customise it (leaving the extension as .dat).

[AJWhite1970]

I don't think that works on anything post xp

 

It's not supported but still works without issue with 7, 8 and 10

[Arthur]

The only profile I can copy is the Default Profile (which I haven't modified as it's not actually an account).

You're meant to use the "CopyProfile" method to customise the default profile.

 

Default Network User Profiles for Type 2–5 Computers

We just learned that Windows XP has a Copy To button, but it shouldn’t be used to copy a regular user’s profile directory and make it the Type 1 Default Network Policy.

 

Turns out that Copy To button is still there for Windows Vista, Windows 7, Windows 8, and Windows 10. On Windows Vista, it worked just like Windows XP—but it turns out, again, using it on “regular users” and uploading their profiles was not a supported item.

 

So, that’s why, starting in Windows 7, and continuing on through Windows 10, the Copy To button only works with the Default Profile. Indeed, if you try to click on any user listed in the User Profiles dialog, the Copy To button grays out—unless you select the Default Profile, and then it works!

 

So, how do we configure the Default Profile before we use that Copy To button? That’s the discussion in this section. But before we talk about that, remember how profiles between Windows XP (Type 1) and Windows Vista, Windows 7, and Windows 8 and 8.1, and Windows 10 (Types 2–5) are incompatible?

 

Well, that’s about to matter a whole lot, right here. And we need to cover this first. This is a little weird, so stay with me.

 

We need to know a certain piece of Windows magic. That is, Windows Vista and later will read profile directories from the network only if they end in a special moniker: .v2.

 

That’s right—the directory names must have a .v2 hanging off them for Windows Vista and later to read it.

 

Buuut … Remember what I said at the beginning of the chapter and reiterated later:

 

There are really multiple types of “v2” profiles, which are .v3, .v4, and .v5.

 

So now, we’ll provide our name with the special “v-something” designation.

 

• Version 2 Windows Vista, Windows 7, and Server 2008 and Server 2008 R2 use designation .v2.
  
• Version 3 Windows 8 and Server 2012 use designation .v3.
  
• Version 4 Windows 8.1 and Server 2012 R2 use designation .v4.
  
• Version 5 Windows 10 and Windows Server 2016 use designation .v5.
  (Note. v6 will be used for the Windows 10 Anniversary Update / Redstone builds)
  

Then, when users log onto modern machines for the first time, Windows will recognize the special directory (Default User) with the extra-special .v2, .v3, .v4, or .v5 moniker and download the profile just for that operating system.

 

There’s a very lengthy, visceral thread if you want to read about it here: http://tinyurl.com/mzwnos. (Though there is no mention of the monikers past .v2.)

 

But, ultimately, there is a specific set of rather lengthy and arduous instructions to create a local user profile on Windows 7 and later then upload it to the network as the Default Network Profile for Type 2, 3, 4, or 5 machines.

 

That KB article is 973289, and without going into the excruciating details, here’s the gist. Again, these are the general steps—please consult the actual article for specific step-by-steps:

 

• Log on as the local administrator, and craft the profile the way you want to.
  
• Create an Unattend.xml file with a special parameter, called CopyProfile = True.
  
• Use an elevated command prompt and run SYSPREP to neuter the machine.
  
• When the computer starts up, it will magically copy the administrator's settings into the Default User’s local profile.
  

But then there are still two more steps so that everyone can use the profile that was just copied up:

 

• Click the Copy To button to open the Copy To dialog box, and in the “Copy profile to” field, enter the full path plus the default user of the NETLOGON share of a Domain Controller, as shown previously in Figure 9.9. Now, to create your Type 2 profile (say, for a Windows 7 machine), you would type in \\dc01\netlogon\Default User.v2.
  Or if you were on Windows 10, it would be \\dc01\netlogon\Default User.v5. Note that no quotes are needed (as is often the case with items that have spaces in them). You can see an example in Figure 9.10. The Default User.V5 folder will be automatically created.
  
• Click the Change button in the “Permitted to use” section, and change the default from the original user to Everyone. This lets everyone use the profile in the domain.
  

You can test your Default Network Profile by creating a new user in the domain and logging onto any corresponding machine type (.v2, .v3, .v4, or .v5). Remember, you’ll only see the magic for users who have no Local Profiles already on their own PCs.

 

Source: http://shop.oreilly.com/product/9781119035589.do (pages 597-598)