Windows 10 1903 Mandatory Profile

[Shad00]

Hi guys, I'm trying to set up a mandatory profile for my Windows 10 1903 clients with no success. Currently I'm stuck because I can not load the profile, event viewer reports Error ID 1521.

 

Description: Windows cannot locate the server copy of your roaming profile and is attempting to log you on with your local profile. Changes to the profile will not be copied to the server when you log off. This error may be caused by network problems or insufficient security rights.

 

For the C:\man.v6 folder the permission are :

 

All application packages -> Full control

Authenticated users -> Read & Execute

Administrators -> Full Control

SYSTEM -> Full control

 

For the C:\man\ntuser.man the permission (given with regedit) are :

 

All application packages -> Full control

Unknown Account (S-1-15-3-1024-1065365936-1281604716-3511738428-1654721687-432734479-3232135806-4053264122-3456934681) -> Read

Authenticated users -> Full control

Administrators -> Full Control

SYSTEM -> Full control

 

I'm using the gpo: Computer configuration - Administrative templates - System - User Profiles and set the setting "Set roaming profile path for all users logging on to this computer" -> C:\man

 

Has this ever happened to you? It's driving me crazy, any suggestion will be very aprecciated!

[3s-gtech]

What profile setting have you put for the user in AD (profile path)?

[Shad00]

Thank you for your reply.

Maybe I misunderstood your question, but I'm not using Windows Server for this mandatory profile. I use the gpo to use the profile saved in C:\Man.v6 locally on this pc.

[3s-gtech]

So you're setting a roaming profile path for a mandatory profile, going by the GPO? I've never seen that done elsewhere, nor tried it myself, so I have no idea if it'll work. I would suggest at this stage you either switch to a more modern profile setup (like UE-V) or a slightly more standard MP setup (where the profile path is set via AD object rather than GPO).

[Shad00]

Yes, I'm setting up a roaming profile path for mandatory profile by gpo. I got this working on my Windows 7 clients (worked fine), but on Windows 10 clients it's not as easy as it was for 7. It would be nice to keep the profile on every local pc, not on server.

[the_quick]

We had mandatory profiles on Windows 7 and they worked great. But I couldn't make them work under W10, so moved to local profile, with GPO to delete them on restart. I'm not 100% sure if W10 fully support mandatory profiles

[3s-gtech]

It does, but it's a pig to set up and get it really working right. I did it the very old (Windows XP era) bodge-it method which still works nicely (it involves the Default profile, copying it off and editing it manually), but I don't recommend others even look into this as it's totally unsupported.

[Shad00]

I'm going for a in-place reinstall to make sure files are ok, when it ends I'm going to try again. If it succed I won't change anything, if it fails I will downgrade to 1809 or 1803, what do you think guys?

[Shad00]

I ended up installing Windows 10 1803 and got this working. I don't know what I was doing incorrectly I guess it was on giving the wrong permission on the ntuser.dat file from regedit (where the column says "applies to" make sure you have "This key and subkey" for SYSTEM, Administrators, ALL APPLICATION PACKAGES, Authenticated Users and Restricted).