S2016 mandatory profile that works for multiple users

[ceps]

Hello,

 

i am new here, for school we need to make an exercise. we have servers 2016 and we need to make mandatory profiles for some users and then be able to test with other users.

i have looked on the internet and i have found a way for this to work. but the profile only works for 1 user. when i use it for other users i get a temporary profile. i can't use the mandatory profile for other users in the domein.

so the way i do it now is i just done 2 users i created the mandatory profile for both, but it's not a good way, because if you have a lot users it gonna take a really long time. i need a way so i can make 1 profile available for other users in domain.

any help would be really helpfull

thank you

[elsiegee40]

When a user is on a mandatory profile, a temporary one is always created on the local machine while that user is logged in. This happens with roaming profiles too.

 

This enables the user to work independently of others; the difference being that a mandatory profile isn't saved back to the server when the user logs out.

[3s-gtech]

I'm guessing you may mean that only the originating user can actually load the profile, although when that happens you tend to get an error rather than another profile. Ad elsiegee40 says, a mandatory profile does create a temp copy of itself on the local machine. This should delete on logoff and write nothing back.

 

It's worth checking that you have your mandatory profile permissions in place. Not only do all users who will access the profile need read NTFS permissions on it, but they also need read permissions on the profile hive (NTUSER.man/dat) which you can grant by opening the hive in regedit then right-click Properties/Security.

[ceps]

@elsiegee40 :you completely not understood what i was saying. this doen't help in anyway. sorry but your post is useless to me. i don't know what your trying to say Edited September 30, 2017 by ceps

[ceps]

@ 3s-gtech: yes that was my point. the originating user can load the mandatory profile and it works the way it should. if i make changes and logoff, when i log back in the changes are undone. erything fine for that user. but when i use this mandatory profile for other users it doesn't work, and i get a temporary profile message.

i have given just to be sure everyone FC on the mandatory shared folder i created, in there is the mandatory profile (profile > %username%.V6) i also gave to be sure everyone FC. and took ownership

and i have made domain admin owner of the folder

Edited September 30, 2017 by ceps

[3s-gtech]

It's the registry permissions that really matter here, you need to sort those too.

 

1) Open Regedit

2) Choose Load hive

3) Choose your ntuser file

4) Change the permissions on the hive

5) Choose Unload hive

6) Don't be rude to the mods!

[ceps]

i also did the registry thing. i gave permissions there also FC everyone....

about 6) yes i'm sorry, i was not trying to be rude, just saying... if i have offended anybody i apologize. was not trying to be rude.

[3s-gtech]

Have you renamed ntuser.dat to ntuser.man, then placed it in a folder called profile.man.v5 (v5 for Windows 10, v2 for Windows 7 etc) then made sure that the profile path for the user in AD is profile.man? There are some great guides online to help otherwise - those are what guided me through.

[ceps]

the profile is like this: you see ntuser.man ( server 2016 seems to be .v6)

on the profile tab i have entered the path to the mandatory profile > like so:

 

 

do i need to put the .v6 ? is that the problem ?

[3s-gtech]

No you mustn't put the v* in there, just in the folder name. Have you given full read and write sharing permissions to the 'mandatory' folder on your server?

[ceps]

hi, 3s-gtech, first thanx for all your support.

yes i have given full read and write sharing permissions on the server. i folled different guides on youtube. and none seem to work. i can't seem to get the mandatory profile accessible for other users... thanks for all your help with this. i appreciate it.

i don't think i'm gonna be able to get this to work for me...