First Recent Attempt At Mandatory Profiles Not Working - Help!

[Fazza]

I've read for some time of the amazing 10 second logon boasts to Windows 8.x due (to some part) to Mandatory Roaming Profiles and recently I've had some time to start having a go myself. I've used them before (back in the Windows NT4 days) where all you had to do was copy the profile to a network share, point the user account(s) to it, change it from .dat to .man and it just worked!

 

I've had a go with creating my own profile from scratch (details of what I did below) and also from copying the Default user profile to the network share (just for proof of concept). And the copy of the default user one works (I put a text file on the Desktop in the mandatory profile as proof) but the one I made from logging on as a new local user doesnt.

 

Here's are my notes on what I did to create a mandatory profile:

 

• Create a local user called 'profileuser'

• Log on as that local user

• Make any required changes

• Log off

• Log on as local administrator

• Open File Explorer and browse to c:\users and copy the profile

• Load the NTUSER.DAT file in to the registry editor:

○ Regedit > click on HKEY_LOCAL_MACHINE

○ File > load hive

○ Enter a name for the key/hive

○ Expand HKEY_LOCAL_MACHINE

○ Right-click on the hive you've just loaded

○ Set permissions for Authenticated Users to FULL CONTROL and remove the 'profileuser'

○ Add Domain Admins and local admin and give both FULL CONTROL

○ Right-click on the hive > Find and replace 'profileuser' with %username% except for the Shell Folders entries

• Shell Folders:

○ HKEY_LOCAL_MACHINE > 'Loaded Hive Name' > Software > Microsoft > Windows > Current Version > Explorer > Shell Folders

○ Delete them all apart from !Do not user this registry key and Fonts

• Delete this key: HKLM > Loaded Hive Name > Software > Microsoft >Active Setup > Installed Components > {89820200-ECBD-11cf-8B85-00AA005B4340}

• Click on the hive you loaded in

• File > Unload Hive

• Click Yes to unload

• Delete the following folders from the profile:

○ AppData\Local

○ AppData\LocalLow

○ The .log1 file(s)

○ The .log2 file(s)

○ The .blf file(s)

○ The .regtrans-ms file(s)

• Copy the profile to the network share (everyone has Full Control on the share and NTFS permissions for testing purposes)

• Use one of the following extentions on the folder name depending on the OS you're using:

§ .v2 - for Windows 7

§ .v3 - for Windows 8

§ .v4 - for Windows 8.1

§ .v5 - for Windows 10

• Create a Group Policy - Computer Configuration > Policies > Administrative Templates > System > User Profile > Set Roaming profile path for all users logging onto this computer

 

When I log on myself (domain admin rights) then it works OK, but when I log on as a pupil it just logs me straight back out.

 

What are we doing wrong?

[3s-gtech]

Worked with @Garacesh on this one recently. He got it working - I believe it was the initial Copy To phase that needed changing - you can't just copy the profile from C:\Users.

[Fazza]

you can't just copy the profile from C:\Users.

 

Any chance you could elaborate further please?

[Garacesh]

Thanks for the ping, @3s-gtech, but I don't know anything about profiles for Win8, I only set them up for W10.

 

If Windows 8 is anything like 10, though, your base profile wants to be copied from the Default Profile. Here's the documentation I've written for mandatory profiles on W10, based on this post by @gavinh.. It might work. Worth a try.

 

 

With Windows 10, you cannot log in with a user, modify the profile, then rename it from .DAT to .MAN
This results in a working profile with a broken start menu. The first user to login with a .DAT profiel creates a restricted registry entry in HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\DeviceAccess
You are currently unable to edit, delete or rename those keys. This key restricts the Start Menu to the user that first logs in to modify the profile (when it is .DAT) and will only present the start menu to that user.
Instead, registry values have to be exported/imported to the .MAN profile as to ensure no user ever logs on to create those keys. 


-----
Tl;Dr
-----
Copy the 'Default Profile' from a workstation twice, make one .MAN. Set permissions. Login to the .DAT profile, make modifications, reboot, load .DAT hive, export keys, load .MAN hive, import keys.


------------------
Full instructions
------------------
Log into Windows 10 as the local administrator
Right Click Start Menu, select 'System' > 'Advanced system settings'
Select 'Default Profile', Click 'Copy To'. Do this twice, providing 2 different locations (eg. C:\DefaultProfile.V5 and C:\ModificationProfile.V5)
Rename one NTUSER.DAT to NTUSER.MAN, this will be the mandatory profile. Leave the other as NTUSER.MAN
Ensure the group 'Authenticated Users' has Read access to the .MAN folder, and full control of the .DAT folder.

Run Regedit. Select HKEY-Users.
Click File, Load Hive, select the the first NTUSER file. Give it a sensible name (e.g. ProfileHive)
Right click on the hive, select Permissions. Grant Full Control to the group 'Authenticated Users'.
Select the hive, click File, Unload Hive. Repeat these steps for the second NTUSER file.

Create a user account in AD, in a new OU so that it has no user policies applied.
Ensure the user profile points to the profile folder containing the NTUSER.DAT
Log in with the new user
Configure the profile as required. 
Reboot the machine.

Log back in as the local administrator.
Run regedit and load the modified NTUSER.DAT hive. Give it a sensible name (i.e. ProfileHive)
Click File, Export. Save the Reg file somewhere sensible. The name does not matter.
Unload the NTUSER.DAT hive. Load the NTUSER.MAN hive. USE THE SAME HIVE NAME AS THE FIRST HIVE.
Click File, Import. Select the exported Reg file.
Unload the hive.

The .LOG#, .BLF and .REGTRANS-MS files can be deleted.

To configure the mandatory profile further, the same steps must be completed again. It is worth keeping a copy of the .DAT profile to ensure all previous modifications are kept when adding further changes.

Edited May 20, 2016 by Garacesh

[3s-gtech]

It's identical for 7, 8 and 10 as far as I can ascertain.

[Fazza]

Thanks for the replies guys!

 

I created my instructions after finding someones blog and as I followed it I wrote down what I was doing and it's those instructions I have posted above.

 

Like I say, when I used the Default Profile (using Copy To) it works OK - but no quicker than not using a mandatory profiles - if anything the logons as a few seconds longer when using this.

 

My understanding is that when a user logs on to a computer, a cached profile is created (if one doesnt already exist) by using the local Default Profile as a template. By copying this to a network share and making it a mandatory one etc. I'm cant see how this is supposed to make logons quicker as purported by lots of people saying they have 10 second logons etc. even on old dual-core machines from the dark ages!

[Garacesh]

Like I say, when I used the Default Profile (using Copy To) it works OK - but no quicker than not using a mandatory profiles - if anything the logons as a few seconds longer when using this.

The Default Profile (like any other profile) can be changed into a mandatory profile by renaming it from NTUSER.DAT to NTUSER.MAN. The advantage of building your profile on top of the Default profile is that nobody has logged in using the Default Profile.

Also, the more you cut out of your profile, the better. My mandatory profile (e.g. Staff.V5) contains only NTUSER.MAN and a few folders in AppData. If the file/folder/value/whatever is not modified, you can remove it from the Mandatory Profile folder. If it's something that's needed, Windows will regenerate it to the C:\Users\%USERNAME% folder when the user logs on.

 

Edit: Example. My Staff Profile only has ntuser.man and Appdata (Local/Roaming). All Local contains is the Microsoft/Windows/WinX directories, because I want them to have a modified WIN+X menu. The rest of the AppData/Local stuff isn't important, so that gets stripped out and Windows can regenerate it on-the-fly if it's needed.

Edited May 20, 2016 by Garacesh