Windows 10 EDU Image with Custom Profile and Delete Profile upon Log-off

[xwarsawx74]

Hello EDU Geeks,

 

 

This is my first time posting on this blog and I hope my descriptions below would give you an idea on what I'm looking for...

 

About our lab environment:

 

 

I work at a school with over 200+ PC's that are being accessed by students 24/7. Each student access these PC's using their domain account. We use HP z820's, HP Z1, and HP Z440s all on Windows 10 EDU. These PC's are mainly used for Graphic Design such as 3D Modeling/Rendering and largely used for the Adobe CC Suite.

 

What is needed:

-An image with Windows 10 EDU that contains all software, plug-ins, add-ons, and apps used at our school.

-Users would log-in using their Domain Account and upon log-off their profiles should delete to save space on the HDD.

-Every user that logs-in, would have the same Desktop settings and content applied to (Mandatory Profile/Custom Profile).

-The Mandatory Profile should be stored locally on the PC and not stored on our network (No roaming profiles).

- What should be used to capture the image MDT or SCCM?

 

 

What I have done so far:

- I modified the Default User Profile with custom settings and policies so that when a student logs in, they all have the same desktop with the same shortcuts and applications.

- I have deleted the Start Up Apps that Windows 10 installs using the "Remove-AppxProvisionedPackage cmdlet" in PowerShell (This was done to reduce log-on time).

 

-I have set Group Policy to Delete Profiles over “X” amount of days but it does not seem

To be efficient.

 

 

If you guys can guide me in the right direction that would be greatly appreciated

 

 

Thanks EDU GEEKS!

[timbo343]

Im sure someone else will be able offer their thoughts but there's an option in Group Policy to delete the roaming profile (also applies to mandatory profiles) and unload the registry at logoff. We do it at our place to reduce the number of profiles on the local machine.

 

There's also an option in Group Policy to specify a specific profile to use on that machine.

 

You could use delprof to delete the profiles when the machines boot up.

 

Why dont you host the mandatory profile on a network share then if anything changes you only have to update 1 profile.

[xwarsawx74]

Hi Timbo343,

 

Thank you for the response

 

I enable the "Delete user profiles older than a specified number of days on system restart" to 1.

 

For delprof, are you referring to the "Delete cached copies of roaming profiles"?

 

I guess I can host the mandatory profile on a dedicated shared network but wouldn't that affect Windows Startup time?

I figured, if I can find a way to store the mandatory profile locally it can help with the startup time, + we are using SSD's (if it makes a difference).

 

Cheers man and much appreciated!

[dr_Wiley]

Hi

 

I would recommend using 1703 as a base for windows 10. It will allow you to lock down the pages in the settings app rather than having to block the whole app. It also has some useful group policies for Edge. There is an issue with setting the lockscreen background but as its only cosmetic I wouldn't worry to much and a fix should be released in the next Cumulative update - https://blogs.technet.microsoft.com/kimberj/2017/05/05/known-lock-screen-issues-1703

 

Ive also found login times to be quicker for all users (after I've logged in the admin user once) than in previous builds.

 

As Timbo343 says host the v6 mandatory profile on a network share if possible. If its small the logon times shouldn't be affected greatly. Steps to creating a v6 Mandatory Profile - https://docs.microsoft.com/en-us/windows/client-management/mandatory-user-profile

 

Definatly use MDT to create and capture the image, its just easier in my opinion. Then use sccm to deploy.

The steps provided by Johan Arwidmark are nice and easy to follow - Deployment Research > Research

 

To delete user profiles you will probably want to use the gpo and Delprof 2 in a shutdown script - https://helgeklein.com/free-tools/delprof2-user-profile-deletion-tool/

 

Hope that helps

[timbo343]

Hi Timbo343,

 

Thank you for the response

 

I enable the "Delete user profiles older than a specified number of days on system restart" to 1.

 

For delprof, are you referring to the "Delete cached copies of roaming profiles"?

 

I guess I can host the mandatory profile on a dedicated shared network but wouldn't that affect Windows Startup time?

I figured, if I can find a way to store the mandatory profile locally it can help with the startup time, + we are using SSD's (if it makes a difference).

 

Cheers man and much appreciated!

 

In terms of the deleting Mandatory profiles at logoff, you need the following configured:

 

Computer Config > Admin Templates > System > User Profiles >

 

Delete cached copies of roaming profiles - Enabled

Do not forcefully unload the users registry at user logoff - Disabled

Do not log users on with temporary profiles - Enabled

 

This will remove any profiles using Roaming or Mandatory profiles at log off.

 

Our login times are around the 1m 06secs for mandatory profiles. Breaking this time down we have:

- Processing the Group Policies: 15secs

- Preparing Windows: 51secs.

 

God knows what's happening behind preparing windows!

[xwarsawx74]

Hi Kevrage,

 

Nice, 1703 is a recent update... It's great that MS is now allowing us lock down the pages. I can definitely deploy this version of windows!

I do require custom backgrounds and lock screens on our Windows 10 EDU, Image hope it gets fixed soon.

 

For deployment, MS also released a new command line tool "MBR2GPT" that converts disk from MBR to GUID without deleting any Data. I can definitely take advantage of the GPT Partitions format.

 

Since our image will contain up to 500gb worth of software, will the loading times be affected if the mandatory profile gets stored on a net shared drive? I don't think it will be a small profile :\

 

Got it! I will use MDT to capture and SCCM to deploy I already have a dedicated server up and running for it.

 

Hey and thanks for those super useful links! They are sure helping me out

 

You guys are very helpful!

[mullet_man]

Bloody hell what software takes up 500gb? Here's me thinking CS6 was a bugger for taking up a lot of space.

 

Interesting to see if 1703 improves login speeds for us, I haven't tested on a student device yet.

[xwarsawx74]

Hey Timob343,

 

I just made the changes on a test image I'm working on...

 

Yeah man, our current image is a Windows 7 Pro image, I'm surprised it was a faster boot-up time than Windows 10 and that being we had 500gb worth of software/add-ons and a couple of

start up applications.

 

Actually, I just came across this blog by James Ranking: https://4sysops.com/archives/improving-windows-10-logon-time/

He briefly explains what differentiates Win 7, 8, and 10 boot-up time.

[mullet_man]

And yes totally agree use MDT for your captures, i also use it for deployments too, find it really good after I got my head around it.

 

Got MDT for OS and SCCM for apps, trying to keep OS image as slim as possible.

[xwarsawx74]

Haha! Yeah man, we store more data than the damn government here!

 

It's actually multiple software such as Maya, AutoCad Suite, Adobe CC, MS Suite, Unreal Engine, Unity, 3DS Max, Render'ers pretty much all software used by Digital Media Majors and thats including Add-ons/Plug-ins.

Ha! believe me sir, that's just the Windows side. I still have to work on a Mac image with similar software and make it dual-boot

[mullet_man]

Haha

 

Woah that sounds like it will keep you busy!