artfulmatt Posted November 19, 2018 Posted November 19, 2018 Hi all, We are now looking at rolling out Windows 10 and upgrading from Windows 7. We currently use Windows 7 mandatory profiles which are saved locally to reduce logon times. I've entered Audit mode and modified the profile/start menu and then using unattend.xml I've used sysprep to save the profile back as the default profile. I've then used the copy default profile method and saved it as student.v7 as we did for .v2 profiles. What seems to happen now as I logon as a student, is it seems to ignore the v6 profile which is 11mb and create a local profile which is 7GB ? Has anyone got a working guide as to how to setup mandatory profiles which are removed on logoff? Thanks, Matt.
ReBoot Posted November 19, 2018 Posted November 19, 2018 When you login are you getting a temporary profile which suggests you have a path set but the profile is missing or is the login normal which suggests the path is incorrect (for your mandatory profile). From memory the user will need the profile path set, you will need the profile extensions enabled (.V2, .V7 ...) via group policy, NTUSER.DAT will need renaming to NTUSER.MAN and there is also a group policy to control whether profiles are deleted on logoff. Sorry I can't remember all the details. Also I think the file permissions need to allow everyone read access to the profile. There is a Microsoft guide here https://docs.microsoft.com/en-us/windows/client-management/mandatory-user-profile which seems to cover everything.
Arthur Posted November 19, 2018 Posted November 19, 2018 I've then used the copy default profile method and saved it as student.v7 as we did for .v2 profiles. v7 doesn't exist. The profile version only goes up to 6 (even with Windows 10 v1809).
artfulmatt Posted November 20, 2018 Author Posted November 20, 2018 v7 doesn't exist. The profile version only goes up to 6 (even with Windows 10 v1809). Sorry meant V6 - just checked the profile and it is V6 lol
artfulmatt Posted November 20, 2018 Author Posted November 20, 2018 When you login are you getting a temporary profile which suggests you have a path set but the profile is missing or is the login normal which suggests the path is incorrect (for your mandatory profile). From memory the user will need the profile path set, you will need the profile extensions enabled (.V2, .V7 ...) via group policy, NTUSER.DAT will need renaming to NTUSER.MAN and there is also a group policy to control whether profiles are deleted on logoff. Sorry I can't remember all the details. Also I think the file permissions need to allow everyone read access to the profile. There is a Microsoft guide here https://docs.microsoft.com/en-us/windows/client-management/mandatory-user-profile which seems to cover everything. No temporary profile? And the profile in AD is unchanged (%systemdrive%profile/student) we've used this for windows 7 for years. I'd need to keep that whilst we have both windows 7 and 10 on the domain. NTUser has been changed to .man and permissions are correct (Authenticated users = read)
Arthur Posted November 20, 2018 Posted November 20, 2018 NTUser has been changed to .man and permissions are correct (Authenticated users = read) Did you add permissions for 'ALL APPLICATION PACKAGES'? http://www.edugeek.net/forums/windows-10/167878-windows-10-mandatory-profile.html#post1437886
artfulmatt Posted November 20, 2018 Author Posted November 20, 2018 Did you add permissions for 'ALL APPLICATION PACKAGES'? http://www.edugeek.net/forums/windows-10/167878-windows-10-mandatory-profile.html#post1437886 I hadn't but that permission as I understand is only used to get the tiles working on the startmenu?
Arthur Posted November 20, 2018 Posted November 20, 2018 I hadn't but that permission as I understand is only used to get the tiles working on the startmenu? You need those permissions on the profile files/folders too. www.htguk.com/how-to-create-mandatory-profiles-in-windows-10-creators-update-1703
ReBoot Posted November 20, 2018 Posted November 20, 2018 A long shot but I have this enabled on all my Windows 10 machines using mandatory profiles. Not found a concise explanation as to exactly what it does yet. Hive HKEY_LOCAL_MACHINE Key path Software\Microsoft\Windows\CurrentVersion\Explorer Value name SpecialRoamingOverrideAllowed Value type REG_DWORD Value data 1 (or 0 to disable) Base Decimal
artfulmatt Posted November 20, 2018 Author Posted November 20, 2018 A long shot but I have this enabled on all my Windows 10 machines using mandatory profiles. Not found a concise explanation as to exactly what it does yet. Hive HKEY_LOCAL_MACHINE Key path Software\Microsoft\Windows\CurrentVersion\Explorer Value name SpecialRoamingOverrideAllowed Value type REG_DWORD Value data 1 (or 0 to disable) Base Decimal Thanks, i'll have a google - I enabled the same GPO for cached profiles and although we have one already for windows 7 machines, I created a new one and that seems to work? Why I don't know. plus rather than assiging a load of GPO's to the machines, I've modified the registry hive to remove access to areas of the OS. Starting to get somewhere now. FINALLY !!! haha
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now