LTSB2016 Mandatory Profile

[timbo343]

Does anyone know how to create a mandatory profile on LTSB2016. We have a mandatory profile on LTSB2015 which is working great however doing the same steps on LTSB2016 does work but stops the start menu working to a point where only the "S" menu section works.

 

Here's the guide which i created:

 

Creating a Windows 10 Mandatory Profile

 

Preparing the Default Profile ready for editing

The default profile will be the account which is used as the Mandatory Profile however we first need to export it and clean it up.

 

Log on to a machine with administrator rights and copy the Default Profile from the local machine by going to System > Advanced System Settings > User Profiles – Settings > Highlight the Default Profile and click “Copy to…”. Copy the profile to C:\ManProfileSetup\Profile. You can if you like use a local profile, rename that to Default profile and copy that over, there are videos on youtube on how to do that.

 

Once the profile has been copied, make sure you can see hidden files and Protected Operating System Files, browse to C:\ManProfileSetup\Profile and delete the following files:

 NTUSER.DAT.LOG1

 NTUSER.DAT.LOG2

 NTUSER.DAT{*characters*}

You should be left with the usual folders (AppData, Desktop, etc) and NTUSER.DAT.

 

Rename the NTUSER.DAT file to NTUSER.MAN. That’s it for now on the Default Profile.

 

Test User Account:

Now in AD, create or copy a user based on the user(s) you want to apply this mandatory profile for. Set the account up with a home directory but don’t issue a Profile. We need to let the account create a local profile on the local machine.

 

Login to the machine with this created account, let it populate everything and log off. This should create a local profile on the machine and leave it there.

 

Log back in to the machine with an administrator account and browse to C:\Users\*test_AD_Account* and copy the NTUSER.DAT file to C:\ManProfileSetup.

 

Run Regedit > click on HKEY_USERS so it’s highlighted > Click on File > Load Hive. Browse to C:\ManProfileSetup, Open up the NTUSER.DAT and give it a name of HIVE.

You can either

• Right click on HIVE and export the settings to a .reg file. Save this .reg file in C:\ManProfileSetup as it needs editing via notepad.

• Edit the HIVE folder whilst in regedit.

 

The following applied to both ways, editing the reg file or editing the HIVE in regedit.

 

Do a search for the test_AD_account username and delete all blocks of keys that this user relates to. You should have the following…

 .\Software\Microsoft\Active Setup – Delete all Active Setup Blocks

 .\Software\Microsoft\Internet Explorer – Delete the Suggested Sites key block

 .\Software\Microsoft\Media Player – Delete the Preferences key block

 .\Software\Microsoft\Windows\Current Version\Explorer – Delete all keys relating to CD Burning

 .\Software\Microsoft\Windows\Current Version\Explorer\Shell Folders – Delete all reg entries barring “!Do not use this reg key” & “Fonts”. Everything else under this key can be deleted.

 .\Software\Microsoft\Windows\Current Version\Push Notifications – Delete the wpnidm key block.

 .\Software\Microsoft\Windows\Current Version\UFH\SHC – delete all reference reg values (not keys) that have the user’s AD login name.

 .\Software\Microsoft\Windows Search\Processed Search Roots – delete the key block “Default” if the user name is found in any strings

 .\Software\WOW6432Node\Microsoft – Delete the Active Setup key Block

 

After searching the HIVE in Regedit for the test username, references found in:

 .\Software\Microsoft\OneDrive\ - delete OneDrive key

 .\Software\Microsoft\Windows NT\Current Version\AppCompatFlags\Compatibility Assistant\Store – Deleted the Store key.

If you’ve edited the HIVE via regedit, you need to export the settings to a reg file as this will be used to import these keys into the Default Profile NTUSER.MAN file

Highlight HIVE that you have exported > Click File > Unload Hive

Now we need to load NTUSER.MAN into regedit. Highlight HKEY_USERS > click File > Load Hive. This time load NTUSER.MAN. Give it the same Hive name as above, so I called it HIVE.

Highligh HIVE and click File > Import. You need to import the reg file that you exported from above with the relevant changes. This will apply the relevant registry settings.

Right click on HIVE > Permissions.

Remove:

 the user account that’s listed

 Remove Restricted Access

 Remove Application Packages

Add:

 “Everyone” – Give this group Full Access

With the HIVE still highlighted, click on File and Unload the Hive.

This is the regedit part finished. Now copy the whole profile barring the NTUSER.DAT and any files that say:

 NTUSER.DAT.LOG1

 NTUSER.DAT.LOG2

 NTUSER.DAT{*characters*}

to the central profile share. Give it a name and don’t forget to use .V5 if you are using a copy of Windows 10 pre 14279. Anything after 14279 you will need to use a V6 profile.

 

Link this profile to a user and the user should be using the mandatory profile you created.

 

 

Has anyone else had this problem or even looking at LTSB2016?

[timbo343]

It seems that technet have a guide on mandatory profiles.. going to give it a go. https://technet.microsoft.com/en-us/itpro/windows/manage/mandatory-user-profile

[dr_Wiley]

Can confirm that the steps in the technet article worked for us

[timbo343]

So, ive found out that the technet way has worked for us too, however ive slightly done it a different way...

 

Copy the Default Profile by via System > Advanced System Settings > User Profiles > Settings > Highlight Default Profile > Copy To > Enter a location and click change under Permitted to Use and add Everyone - now export the profile.

 

Browse to the copied location and change NTUSER.DAT to NTUSER.MAN. Also, delete the contents out of *Profile*\Appdata\Roaming\Microsoft\Windows\StartMenu.

 

The only thing we cant get to work on LTSB2016 is custom folders listed in the Start Menu. For some reason, if we add any shortcuts or new folders to C:\ProgramData\Microsoft\Windows\Start Menu\Programs they don't show up. This has always been the default location for start menu items. Have MS changed the way this works too?

[dr_Wiley]

I don't think so, but we use redirected start menus here so everything just goes in them. One thing I have noticed it that if you are configuring tiles for the start menu and then applying that to your users (export-startlayout) then the shortcuts need to be in the redirected startmenu as well as AppData\Roaming\Microsoft\Windows\Start Menu\Programs

[timbo343]

coming back to the start menu for mandatory profiles, after a little bit of testing, ive had to leave Accessories in there but delete everything else otherwise Windows creates an Accessories folder that cannot be clicked. Keeping Accessories in the Mandatory Profile with Notepad listed means Accessories can be accessed.

 

As for the problem we found with disappearing / not working start menus, we've found that a shortcut to a .exe cannot be listed twice. What i mean bu this is, file explorer (%windir%\explorer.exe) cannot be listed under Windows Accessories nor can it be listed under a custom folder. We tested this with iexplorer.exe. We set up 2 test folders in C:\ProgramData\Microsoft\Windows\Start Menu\Programs and added a shortcut called Internet 1 into Test1 and internet 2 into test2. both were pointing to c:\program files(x86)\internet explorer\iexplorer.exe. It turns out only folder Test1 was showing in the start menu as Test2 had the same shortcut in it. We then added another shortcut to Test2 (eventvwr.exe) and Test2 folder appear only displaying the event viewer shortcut.

 

It seems to me that MS have designed a Smart Start Menu which keeps it's self tidy. A good idea, but a nightmare to administer.

[alfatec]

What sort of login times are you getting?

[dr_Wiley]

With an ssd around the 15-20 second mark on first login, with a mechanical around 40 seconds. One thing I've done is disable the systemapps (which can't be uninstalled) in C:\Windows\SystemApps from installing by renaming the folders.

 

 

I found that even if you disable cortana in a gpo it still installs the app and this adds up to 30 seconds to the logon time, also the start menu takes ages to respond. However be aware that this will break search on the startmenu.

[Homer]

Is that spinning rust in a laptop kevrage or a desktop?

 

I'm really struggling with logon times on laptops at the moment for some reason, nothing has changed but it's all gone a bit wrong! This is Windows 8 but Windows 10 isn't much better.

[timbo343]

The machine ive been testing on has:

- A samsung EVO 128GB SSD

- 2gb Ram

- Pentium Dual Core Processor

- the machine was bought back in 2009

 

Changing the files that @kevrage mentioned has dropped my logins from 40 secs to 20 secs on first login.

[dr_Wiley]

Desktop specifically an Optiplex 380 with 4 GB of RAM