Can you have a local mandatory profile?

[dtakias]

Hi,

 

Is it possible to have a local mandatory profile? A profile that will be mandatory and not load of the network? If I go on the local profile and rename the extension to .man then I get errors during logon that profile cannot be found. I have even tried to move the profile to another location on the local hard drive and rename it to .man but i get the same errors...

[mullet_man]

You can,

 

What you need to do is use the computers Default User in the Documents and Settings folder.

 

This is how we do it,

 

Log onto a computer using a an account with Admin rights

Set the profile up to how you want it

Run Office, and all other programs etc, so that they load into the profile.

Once you are happy, restart the computer login as Admin and then goto System Properties (right click My Computer - Properties)

Goto Advanced tab

Click onto User Profiles Settings tab

Then click onto the username you just created

Click copy to

Then find Documents and Settings\Default User

Make sure you choose Everyone in the permitted to use tab.

Then choose Ok.

 

This will then overwrite the Default User profile with your newly created one, and then everyone who logs on the computer will pickup that profile assuming they have no profile path in AD.

 

Hope this is correct just quckly ran through. Try it on a test PC first.

[dtakias]

I think ive seen that somewhere. Yes but how will this profile be mandatory If I dont rename the extension to .man ?

[Gatt]

Be Careful with making the Default User mandatory - any new Admins (including Local Admins) who havent logged on before or have had their profile deleted (by delprof, say..) will be created using that mandatory profile!

[powdarrmonkey]

I think ive seen that somewhere. Yes but how will this profile be mandatory If I dont rename the extension to .man ?

 

You do need to rename the extension. Steps above will give you a clean default profile for users to copy, if you rename the extension it will become a true mandatory profile.

[mullet_man]

Be Careful with making the Default User mandatory - any new Admins (including Local Admins) who havent logged on before or have had their profile deleted (by delprof, say..) will be created using that mandatory profile!

 

Yeah always make sure you have logged in as your Admin account before doing this or your gonna get this default profile.

[farmerste]

when you have set up the local profile, and copied it over the default user profile, don't forget you need to rename the local 'administrator' to 'admin', or when you have run sysprep, the administrator account gets copied over the default user, and you would have lost all your work.

 

i always use local default user profiles, and i have never renamed any extensions on local machines, so i don't know if changing anything to .man will make any difference or not.

[dtakias]

Ok I see what you all mean. But in that case I will not have a true mandatory profile. I need the changes not to be saved by the profile. If I just copy it over to the defauolt profile their changes will still be there when they logon again.

 

And if I rename to .man I will get error messages during logon!

 

I just need the ability to have the teachers logon locally(NOT IN THE DOMAIN) in case they have to and NOT have their settings saved by the profile when they logoff!

Edited February 18, 2008 by dtakias

[dtakias]

I have already created and configured a local profile , I just need to find a way to make it mandatory.

[ITWombat]

I have already created and configured a local profile , I just need to find a way to make it mandatory.

 

Yes this is the point people are missing. Yes you can configure the Default User profile to produce a standard profile but each user gets a copy only once. Network mandatory profiles overwrite the cached profile on each log in.

 

If you are going down the local mandtory path why not just use the disk protection feature of Microsoft's SteadyState (formerly Shared Computer Toolkit) or may be Deep Freeze by Faronics.

[dtakias]

Yes this is the point people are missing. Yes you can configure the Default User profile to produce a standard profile but each user gets a copy only once. Network mandatory profiles overwrite the cached profile on each log in.

 

If you are going down the local mandtory path why not just use the disk protection feature of Microsoft's SteadyState (formerly Shared Computer Toolkit) or may be Deep Freeze by Faronics.

 

Actually I was looking at the SteadyState in the afternoon. Its looks like a really useful utility. Although I am not sure about the disk protection feature as some programs have been configured to have access on the C drive and I don't want something to go wrong with them.

 

So as I understand it, its not possible to have a local mandatory profile the way you have it when using roaming profiles.

[dtakias]

when you have set up the local profile, and copied it over the default user profile, don't forget you need to rename the local 'administrator' to 'admin', or when you have run sysprep, the administrator account gets copied over the default user, and you would have lost all your work.

 

i always use local default user profiles, and i have never renamed any extensions on local machines, so i don't know if changing anything to .man will make any difference or not.

 

I am just one step before syspreping an image and I am not sure if i should copy the desired profile on the default profile. The problem is that i have made various scripts to run programs as administrator and as you say i need to rename administrator acocunt. If i rename the administrator account then some of the programs might not work. IF i dont rename can something go wrong during Sysprep? The administrator account is fully configured and I dont want it to be messed up during imaging...

Edited February 20, 2008 by dtakias

[dtakias]

I wasnt aware that i need to copy the local profile to the default user profile.

 

Since I am using roaming mandatory profiles what is the point of copying the local profile to the default user profile? Do you do it in case you don't want to use roaming profiles for some users? Does the local computer use it when there is no profile available for the user who is about to login?

[dtakias]

I've read that the SP2 version of Mini-Setup uses the Administrator account profile rather than Default User profile to apply customisations to the new user.Does that mean that i will have to copy the local user profile to administrator? Maybe that is the reason that I will need to rename the administrator account to something else like admin. Any sysprep guru to confirm this ?

[farmerste]

firstly i dont use roaming profiles, my understanding of roaming profiles is a profile stored on the network which everone who logs onto a machine will get regardless of the type of machine, or its location/hardware etc.

 

i use local default user profiles, as i honestly believe it to be the best way, and you can have lots of different desktops/settings for different machines depending upon their use /location. This is in my opinion much easier than trying to maintain profiles on a network, and tie them into active directory etc.

 

I have 'played' with mandatory profiles on the network, and i have found the work involved, and the outcome to be un-satisfactory .

 

if you like i'll try and give you a blow by blow account of how i set up a machine, but i take great pride in making images that i consider to be perfect, by that i mean users (small children, and special needs) should not be confused by popups asking how they would like things configured. So my blow by blow account might be a bit of a tome.

[rosswilson]

if you like i'll try and give you a blow by blow account of how i set up a machine, but i take great pride in making images that i consider to be perfect, by that i mean users (small children, and special needs) should not be confused by popups asking how they would like things configured. So my blow by blow account might be a bit of a tome.

 

I would certainly appreciate an account of how you handle Default Profiles It would come very useful indeed.

 

Thank you for your kind offer,

 

Ross Wilson

[farmerste]

firstly you need to start with a domain user, without any special AD policies applied ( preferably none, just a member of domain users), but you might want to make them a power user, or some other AD group specific to your environment.

 

next you need to logon to the machine you are going to use to make the master image, as a domain admin. Now add all the software you need, and apply any tweaks- e.g registry, .inf files etc

 

now log in as the domain user you are going to use to build the default user profile with, and configure the desktop, add network printers/devices, and most importantly check that everything works. basically how ever you set up this user will get 'used' by all all those who log onto this machine ( or copies/images of this machine elsewhere) when you are happy, log out .

 

log in as domain admins again, ensure you show all hidden files, and under advanced settings- users- copy the above profile to the 'default user', and give permissions for everyone to use it.

 

i now delete the 'stubpath' entries in the registry to stop windows trying to set up new setting for users that now log in ( microshaft really don't know how their computers are used, and in schools, especially with SEN and small kids this 'per-user' setup is frustrating, and overwhelming for some ). I also rename the Administrator account to admin, so that it doesnt get copied-over the default user account ( this is fixed in sp3 i think).

 

remove from domain,syprep the machine- and image it to......? wherever.

 

job done

 

actually i spend ages on the default user profile, running dvds, testing flash,shockwave, qtime, real, acrobat, printer settings etc..etc. But i have found the effort is well worth it.

I also use cleanslate to lock down the pc, but other software is available such as deep freeze etc, i am also looking at using 'reborn' cards to make a robust desktop without any type of antivirus required, except on the server, and machines that are left on mostly without a reboot.