Mandatory Profile Win 10

[artfulmatt]

Hi,

 

Trying to use the "copy to" function within advanced system settings and profiles.

 

I've logged on as a domain account with no profile path set in AD and a local profile is created on the Win 10 domain machine.

 

I now log off and back in as a local admin account and the try to copy the local profile to a share. For some unknown reason the Copy To is greyed out for every account except the default profile? I've googled and found lots of solutions to Windows 7 and nothing seems to be working?

 

Anyone know a way around it?

 

Cheers,

 

Matt.

[3s-gtech]

In Windows 10, you can only copy the Default Profile from the machine (as it turns out). So, copy that, then adjust the permissions on the profile so that you can make adjustments to it in its new location (whether local or on a share). When happy, lock it down.

[ColinP]

I worked around this by using sysprep and copying the current profile as the default switch

[sted]

I worked around this by using sysprep and copying the current profile as the default switch

i think thats the only official supported way of doing it

[Bruce123]

Some forums suggest renaming c:\users\default to default-old and renaming the folder of the user you want to export the profile from to default.

 

You can then use "Copy to..". Then rename them back again.

 

As an aside, does anyone know precisely what Copy to... does (compared to just copying the profile)?

 

I assume:

 

Sets permissions of all user registry keys to Everyone Full Control (assuming Everyone Full control is selected with Copy to...)

And perhaps removes all user specific info (e.g. the username from the path in folder redirection)?

 

Anything else?

 

Thanks,

 

Bruce.

[3s-gtech]

 

I assume:

 

Sets permissions of all user registry keys to Everyone Full Control (assuming Everyone Full control is selected with Copy to...)

And perhaps removes all user specific info (e.g. the username from the path in folder redirection)?

.

 

IME, it does neither of these things. However, just straight copying the profile folder creates an unuseable profile.

[artfulmatt]

Thanks, what permissions are meant to be set on it?

[3s-gtech]

Full Control to Authenticated Users on the registry hive (ntuser.man). You can set the profile folder on the share to have read only permissions once you've customised it.

[artfulmatt]

Awesome - working :-D ....Now for modifying the startmenu !! oh joy this is gonna be fun !

[Bruce123]

IME, it does neither of these things. However, just straight copying the profile folder creates an unuseable profile.

 

I think it must do the former, otherwise for a mandatory profile that is used by multiple users (or used by any user other than the original creator), won't have full access to all of the registry keys, which they would need.

 

Thanks,

 

Bruce.

[3s-gtech]

I've always had to set those permissions on the hive myself, but that may be overkill. Without doing so, you may find that the profile can't be loaded (this may have changed in Windows 10, but I did it anyway).

[timbo343]

Im having a torrid time creating a windows 10 mandatory profile. @stgoodyeara has managed to successfully create one which im using but i would love to create one myself that works. During logon, i get SIGNING OUT displayed and an error message displays - loading your settings failed (access is denied) even though this .man has the correct permissions via loading the hive.

 

Also, when MS release the anniversary update, we will have to rename the profiles from

.V5 to .V6 as the V5 profiles dont work on the anniversary update, users are logged in with a TEMP profile.

[artfulmatt]

Microsoft have really made something which should be fairly simple, bloody complicated !!

 

Have modified the startmenu layout and exported the xml via powershell - great and easy !!

 

Now the prob begins....We have server 2008 R2 as the DC and would use GP to import the xml file, but the ADMX file is missing as we are using the local store and not a central store :-( Really don't want to start mucking around with Group Policy for the sake of a menu lol

 

Other option is to use the import shell command, but can't find where to add the file? I talks about using Windows Image File, but we don't use that to image our machines so rather stuck at the moment.....

[timbo343]

Im having a torrid time creating a windows 10 mandatory profile. @stgoodyeara has managed to successfully create one which im using but i would love to create one myself that works. During logon, i get SIGNING OUT displayed and an error message displays - loading your settings failed (access is denied) even though this .man has the correct permissions via loading the hive.

 

Also, when MS release the anniversary update, we will have to rename the profiles from

.V5 to .V6 as the V5 profiles dont work on the anniversary update, users are logged in with a TEMP profile.

 

Just found out where i was going wrong with the signout error. When editing the hive's permission, i didn't tick Replace all child permission entries with inheritable permissions from this object.

 

Now i need to find out why the start menu is broken!!! FFS MS!!!

[timbo343]

Just got the man profile working!!! :D

[timbo343]

Just got the man profile working!!! :D

 

I may have spoken too soon, i need to do some further testing.

[timbo343]

So, day 3 of trying to get a mandatory profile to work... still failing.

 

The Problem... User logs in for a second time and start menu isnt showing. If a user logs on to a machine for the first time after power on or reboot, the start menu shows. If this user logs off and back on the start menu doesnt show. The only thing to do here is to restart the machine.

 

I have now narrowed my problem down to something that is possibly in use why else would a restart of the machine sort the problem out but i cant think what it is. Im pretty sure its something in the NTUSER.MAN file which is causing the problem but what?

 

Update... its not the ntuser.man file.

Edited June 8, 2016 by timbo343

[Asgard]

Tim, as I have already emailed , ill post it here so that others can see the steps I have taken to get to a sort of empass.

 

I know have a confirmed Mandatory profile, which logs on/off fine, and you can click the start menu(not fully working - see below) and edge is available off the taskbar..... a major result from this morning.

 

My steps based on having a dedicated "mandatory" local account to do all user customisations before copying it up to the netlogon share rather than using the default profile - which works fine but has none of our app customizations built in - unless I start look at importing reg keys etc;

 

So here are my steps;

 

1. Login to the gold image machine as .\mandatory

2. Open Regedit

3. Right Click on HKCU and give the following full permissions – logging in as a domain admin first

a. Everyone

b. All Application Pools

c. Authenticated Users

4. Close Regedit

This is essentially instead of doing it via loading the hive - which seems to really help the start menu (I think)

 

5. Reboot the machine

6. Login as domain administrator – run Windows Enabler

7. Copy the profile to \\%domaincontroller%\netlogon\profiles\johnpaul.v5 with everyone as permissions

8. Change a user to use that as their profile

9. Reboot the computer (giving AD enough time to replicate)

10. Login as that user

11. Start Menu is clickable and edge works on the task bar

 

However!.

 

It does not pull in the start menu xml that we have configured, nor the start menu contained within the mandatory profile, but the start menu is fully clickable!

 

I think the way of loading the hive for me didn't work because the DeviceAccess registry key seems to be permanantley locked even if I give everyone full permission - if I do it locally and then export the full mandatory profile it works.

 

Just a real puzzler why the XML isn't imported, but RSOP says its ran!?!?!?!

I'm also wondering if the 'copyprofie=true' that I applied to sysprep (built via Audit mode) is throwing its 5p in and further muddying the waters.

 

Witchcraft Microsoft, Absolute shocking Witchcraft at play

Edited June 9, 2016 by Asgard

[JLUsuario]

@timbo can you share the details? Step by step would be very useful. Thanks!

[timbo343]

I can do but ive only got it working on LTSB. I couldnt get it to work on education or enterprise. What version of win10 are you running?

[Kiyo]

I'm in the same boat, timbo343. I've had multiple failures here and need to get something working for our university students. If you shared your steps with JLUsuario can you do the same with me? Could really use your help on this one. Thx.

[timbo343]

@Kiyo, try this. Please note, i and @stgoodyeara have only tried this on LTSB 2015. See attached.

Creating a Windows 10 Mandatory Profile.docx