Windows 7 - Mandatory Profile Issues

[mshill]

Hi All

 

We have decided to move pupils over to mandatory profiles but are getting some strange issues. First logon on machine everything works fine but every time after that we get an error with antivirus not starting and I.E. won't start at all when we try to run it.

 

Any ideas why first logon would be fine but every other logon after that has the above issues?

 

Regards

[Guest obsidianpillar]

What permissions have you got to the share that's holding the Mandatory Profile? Was it created from Sysprep?

[mshill]

Hi, the user has the permissions needed to read the profile. Its almost like the second logon it uses a local appdata instead of the redirected one as taskbar shortcuts appear on the second logon.

 

As soon as I add Prevent running First Run wizard via group policy I.E no longer runs for a user with a mandatory profile.

 

Regards

[Guest obsidianpillar]

What's going on with your folder redirection, are you redirecting AppData or are you leaving it as "Not Configured"?

 

Also, are you using the "Exclude directories in roaming profile" policy specifying AppData in it?

 

Those are the top two I can think of which we use in our Environment. Are there any specific settings which you have configured in your profile or have you exported the Default Profile from within Windows 7?

 

Are you assigning the policy on a per-user or per-computer basis?

 

 

Just trying to build up a bigger picture here, I've heard of issues similar to this before and sorted it out with changing some Group Policy settings. If we can't get it sorted and you don't want to create another profile I can send you my Windows 7 one which I deploy in all environments (no modifications added) and see if that works?

 

Cheers.

[mshill]

We re redirecting appdata to a network folder and this gets created fine on the first logon.

 

I have just tried the exclude rule with appdata and doesn't seem to have an impact. We are assigning the policy on a per user basis.

 

Maybe there is an issue with our profile just strange first login works all fine then every login after that get all the issues.

 

Regards

[Guest obsidianpillar]

Try removing the AppData folder redirection on a test user and see how that works on second logon.

[mshill]

It is like the first login it creates appdata fine and works and every login on that machine afterwards it reverts to a local app data as the 3 taskbar icons that appear are in appdata on the local machine. Checked event logs and it is saying folder redirection for appdata applying successfully.

[Guest obsidianpillar]

It is like the first login it creates appdata fine and works and every login on that machine afterwards it reverts to a local app data as the 3 taskbar icons that appear are in appdata on the local machine. Checked event logs and it is saying folder redirection for appdata applying successfully.

 

Folder redirection will apply successfully however your redirecting AppData to remember the user's settings and to "roam" with them. This essentially defeats the point of using a Mandatory Profile. Try removing the AppData redirection and see if the IE problem replicated as it stores the IE information within the Profile. Test then let me know.

[mshill]

Cheers for the help Tom.

 

I have setting redirection to not configured and the exact same thing happens as if the appdata was redirected.

 

Regards

[mshill]

I have also tried recreating the mandatory profile and we still get same issue after 2nd logon. Suggests there is a group policy issue

[Guest obsidianpillar]

Stick the user object into an OU with no inheritance, see if the problem replicates. If it doesn't gradually apply each policy one by one and see what's triggering it.

[mshill]

"Prevent running First Run wizard" is the GPO that causes the issue with IE not running

[Guest obsidianpillar]

"Prevent running First Run wizard" is the GPO that causes the issue with IE not running

 

What customisations (if any) are you making to the mandatory profile? Why don't you just re-create the profile but with the "First Run" already completed and leave the policy as not configured? You want to leave AppData redirection complexly alone, you are doing all the normal pre-requisites such as changing the NTUSER to .man from .dat etc? It's strange that this one policy is conflicting so much.

[SkreeM1980]

What is the event log saying about the logon/profile load? It sounds a bit like the first logon is actually using the machine's default profile not the mandatory one, and then the registry hives on the PC go all screwey.

[Guest obsidianpillar]

What is the event log saying about the logon/profile load? It sounds a bit like the first logon is actually using the machine's default profile not the mandatory one, and then the registry hives on the PC go all screwey.

 

Could be the problem? Do you think using DelProf2 would work, or just a re-image? I remember if it was a user that previously had a local profile it could cause some problems but when I last had to do it we circumvented such problems by assigning profiles based on computer. Try assigning the profile to a fresh PC (one that the user hasn't logged onto yet) with the profile assigned in its object in AD.