Profile Types

[angrycomputingteacher]

Hey,

 

I've just moved over from a workgroup to a domain and I'm not sure which profiles to use. Roaming or Mandatory Profiles? I've tested the roaming profiles with folder redirection and I managed a 12-second log out (that's on my DC).

 

What does everyone else use?

[ITJS2015]

Mandatory for staff with network home drives and local admins set as a gp on staff laptops

[ledow2]

Roaming for all, with redirection for the sake of simplicity (documents are then stored outside the profile making profile resets really simple - just move the old profile out of the way, and a download to their desktop doesn't get downloaded to every machine they ever touch). :-)

 

It all depends on what you want to do.

 

Do you want your users to be able to change their own settings to their own preference and pick up those settings everywhere they go (roaming)?

Do you want to strictly enforce every possible setting in a one-off config that's tricky to update, before your users are using the system (mandatory profiles)?

 

Personally I think the latter are silly. Roaming profiles have more of a network usage, but it's nowhere near detrimental - ignoring DOCUMENTS, gigabit to the desktop means an Gigabyte PROFILE (stupendously huge on a managed system) takes 8 seconds to download. And that's only if the machine has NEVER seen that user before, otherwise only the difference is transferred. First logins on computers they've never used pull down their entire roaming profile but they shouldn't be allowed to let their profile get out of hand anyway (it's easy to exclude any folder likely to get out of hand, e.g. Downloads, Google Drive, etc. from profiles).

 

Power users object strongly to not being able to change simple settings (and in those cases, you really don't want to have to change every setting on their behalf every time) and if your GPOs and security are in such poor state that you're relying on mandatory profiles to enforce settings, you really need to look again at what you're offering people. When a user changes a harmless setting and logs off, they expect that setting to be present on their account when they next log in!

 

Many places use mandatory profiles but I find them completely inflexible and users are never happy with them. They are also a pig to update a simple setting on, in comparison.

Roaming profiles have to be configured PROPERLY (i.e. separate documents and profile, store in separate places on the network, don't let them get out of hand, make sure permissioning on the shares is correct so they can update their roaming profile correctly, etc.) but they then work like people expect.

 

And in the rare circumstance they go wrong (500+ users, I do a profile reset about once every six months and usually because of other problems that occurred during logoff, e.g. power or network events), you just move the profile folder and the next login recreates it.

 

But at least then users can do simple things for themselves.

[angrycomputingteacher]

Roaming for all, with redirection for the sake of simplicity (documents are then stored outside the profile making profile resets really simple - just move the old profile out of the way, and a download to their desktop doesn't get downloaded to every machine they ever touch). :-)

 

It all depends on what you want to do.

 

Do you want your users to be able to change their own settings to their own preference and pick up those settings everywhere they go (roaming)?

Do you want to strictly enforce every possible setting in a one-off config that's tricky to update, before your users are using the system (mandatory profiles)?

 

Personally I think the latter are silly. Roaming profiles have more of a network usage, but it's nowhere near detrimental - ignoring DOCUMENTS, gigabit to the desktop means an Gigabyte PROFILE (stupendously huge on a managed system) takes 8 seconds to download. And that's only if the machine has NEVER seen that user before, otherwise only the difference is transferred. First logins on computers they've never used pull down their entire roaming profile but they shouldn't be allowed to let their profile get out of hand anyway (it's easy to exclude any folder likely to get out of hand, e.g. Downloads, Google Drive, etc. from profiles).

 

Power users object strongly to not being able to change simple settings (and in those cases, you really don't want to have to change every setting on their behalf every time) and if your GPOs and security are in such poor state that you're relying on mandatory profiles to enforce settings, you really need to look again at what you're offering people. When a user changes a harmless setting and logs off, they expect that setting to be present on their account when they next log in!

 

Many places use mandatory profiles but I find them completely inflexible and users are never happy with them. They are also a pig to update a simple setting on, in comparison.

Roaming profiles have to be configured PROPERLY (i.e. separate documents and profile, store in separate places on the network, don't let them get out of hand, make sure permissioning on the shares is correct so they can update their roaming profile correctly, etc.) but they then work like people expect.

 

And in the rare circumstance they go wrong (500+ users, I do a profile reset about once every six months and usually because of other problems that occurred during logoff, e.g. power or network events), you just move the profile folder and the next login recreates it.

 

But at least then users can do simple things for themselves.

I've just setup myself a roaming profile user with redirected folders. I will see how I go.

[Rob_D]

For staff we use roaming profiles with redirected, Documents (photos/videos/music/etc), desktop, start menu, and appdata. Desktop and start menu are locked down. Logons are reasonable, and profile resets are really easy.

 

Students get a mandatory profile with redirected, Documents, desktop and start menu.

 

Roaming profiles are way easier than mandatory to set up, just be aware of the disk space costs of having potentially thousands of profile folders. Looking at our system, 500 staff profiles report as about 5gb, and that doesn't include the appdata.

[timbo343]

Windows 10 with mandatory profiles for both staff and students with redirected docs, desktop, pictures, downloads, videos.

 

Used to have roaming for staff but the profiles caused too much of a headache with the start menu - will see how they get one.

 

You could use UEV which is the new way to do profiles however ive got got it setup yet.

[tinca492]

Roaming profiles here with the usual folder redirections

Pupils also use roaming but shared Desktop

All restrictions through separate GPOs for Teachers, Pupils, etc etc

 

Normally v reliable until teacher backs up their 64Gb memory stick to their Desktop!! and then complains of slow login

 

I do monitor the size of Desktops share to deal with this sort of issue though.

[Guest obsidianpillar]

I despise Roaming Profiles in many usage cases. The only time we use it is if we have a "Roaming" laptop i.e it gets moved on and offsite quite a bit. We're pushing for RemoteApp more which would allow us to have Mandatory.

 

Mandatory is easier for simplicity and less network traffic. You could store the Mandatory Profile on the endpoint however make sure you get the permissions right! We redirect everything apart from AppData and update our profile if we have a program that requires it. We have the same build on everything we support so there's no issue for us.

 

Generally speaking if you have all software locally and do folder redirection Mandatory is the best for Students and Staff.

 

Admin Staff/Teachers with Laptops that leave school go Roaming with Offline Files enabled for simplicity.

 

If you have DirectAccess/RemoteApp, go Mandatory.

 

Tom

[3s-gtech]

Another one standing up for venerable mandatory profile. Yes, they can be a pig to work on - changing the .man to .dat, altering permissions, log on to a test user then change back to .man. I do many changes in regedit though which is very quick.

 

Positives - no profiles clogging up workstations. Nice compact profiles, logons are fairly quick on the wired machines (wireless is a bit slow, but that's not our main infrastructure). Plus, students can't log on with the network cable unplugged which can be used to bypass GP settings otherwise.

[angrycomputingteacher]

I've setup roaming profiles for everyone. For the laptops, how do I set them up so they can automatically use Offline Files for the document, picture etc libraries.

[Guest obsidianpillar]

There's a section under Group Policy which can be configured on a Per-User or Per-Workstation basis. I believe the settings reside in Computer Configuration > Administrative Templates > Network > Offline Files or User Configuration > Administrative Templates > Network > Offline Files

 

The options should be easy to configure to your requirements within that page. Run a "GPUPDATE /FORCE" to update Group Policy on the endpoint devices. If you decide to configure it on a per-user basis, a logoff and logon would suffice. However, if you are working on a computer level then a restart would be required to propagate the settings.

 

Hope this helps.