Roaming and Mandatory profile issues

[TBFC]

Hi all,

 

We've been having an ongoing fight with machines with trying to get them to respect what we're setting up, either through ignoring GPOs or just changing behaviour.

 

Students: Our students use Mandatory profiles. We did have an issue last year where Chrome did not work, due to an issue with it interacting with a cryptographic service, but that has been resolved. All machines are now running Windows 10 1809, Enterprise.

Intended behaviour: A student logs in, receives the shared mandatory profile. Does work, signs out. Machines delete the user profile on log-off. Policy in place to delete user profiles older than 1 day, to catch any others. Roughly six months ago, on 1803, this worked.

Actual behaviour: A student logs in, receives the shared mandatory profile. Does work, signs out. The profile stays on the machine (200MB each, minimum). On logging in again, it uses that profile. If there is ever an issue with that profile, it prevents them logging in with a "Group Policy" error - "Cannot load profile", which means their profile must be manually removed from the registry.

The issues we're running into are students not being able to log in (due to the profile error), machine hard drives filling up and students saving work to the machine, rather than network storage (we can't redirect Documents/Appdata due to Creative Cloud throwing a wobbly).

 

Policies configured for the profiles:

Public Key  Policies/Certificate Path Validation Settings/Stores[url="http://www.edugeek.net/"]hide[/url]
  [TABLE="class: info"]
[TR]
[TH]Policy[/TH]
[TH]Setting[/TH]
[/TR]
[TR]
[TD]Allow user trusted root Certificate Authorities (CAs) to be used to validate  certificates[/TD]
[TD]Disabled[/TD]
[/TR]
[TR]
[TD]Allow users to trust peer trust certificates[/TD]
[TD]Enabled[/TD]
[/TR]
[TR]
[TD]Peer trust certificate purposes:[/TD]
[TD]Client Authentication; Secure Email; Encrypting File System[/TD]
[/TR]
[TR]
[TD]Root CAs that client computers can trust:[/TD]
[TD]Third-Party Root Certification Authorities and Enterprise Root Certification  Authorities[/TD]
[/TR]
[TR]
[TD]For certificate-based authentication of users and computers, along with CAs  that are registered in Active Directory, the client computer must use should  also use user principal name (UPN) constraint compliant CAs[/TD]
[/TR]
[TR]
[TD]Disabled[/TD]
[/TR]
[/TABLE]

 

System/User Profiles[url="http://www.edugeek.net/"]hide[/url]
  [TABLE="class: info3"]
[TR]
[TH]Policy[/TH]
[TH]Setting[/TH]
[TH]Comment[/TH]
[/TR]
[TR]
[TD]Add  the Administrators security group to roaming user profiles[/TD]
[TD]Enabled[/TD]
[TD][/TD]
[/TR]
[TR]
[TD]Delete cached copies  of roaming profiles[/TD]
[TD]Enabled[/TD]
[TD][/TD]
[/TR]
[TR]
[TD]Delete  user profiles older than a specified number of days on system  restart[/TD]
[TD]Enabled[/TD]
[TD][/TD]
[/TR]
[TR]
[TD="colspan: 3"] [TABLE="class: subtable_frame"]
[TR]
[TD]Delete user profiles older than (days)[/TD]
[TD]1[/TD]
[/TR]
[/TABLE]
[/TD]
[/TR]
[TR]
[TH]Policy[/TH]
[TH]Setting[/TH]
[TH]Comment[/TH]
[/TR]
[TR]
[TD]Do  not forcefully unload the users registry at user logoff[/TD]
[TD]Disabled[/TD]
[TD][/TD]
[/TR]
[TR]
[TD]Do not log users  on with temporary profiles[/TD]
[/TR]
[TR]
[TD]Enabled[/TD]
[/TR]
[/TABLE]

 

 

 

 

Staff members:

Staff members use Roaming profiles and have a separate set of User OUs and Machine OUs.

 

On first logon, with no network profile, the Start Menu (list of programs, not tiles, redirected via GPO) appears as expected. On second logon, or a logon to a new machine, the Start Menu only contains the automatically-added programs (Mixed Reality, Photos, Cortana...).

Deleting the NTUSER.dat file from the staff member resolves the issue as long as they are using machines they have a profile on. Going to a new machine requires the deletion again.

 

Folder Redirection is set up for all document folders and libraries, to their Network Home Drive. ExcludeProfileDirs is set up with "AppData\Local;AppData\LocalLow;$Recycle.Bin".

 

 

 

Unfortunately I'm at a loss on where to go next, for both issues. Students were fixed and working, and as far as I can see should work ("Delete user profiles older than 1 day" is pretty explicit...). Staff members, everything I try to look up leads me to issues about the Tiles, which we do configure, but I'm much less concerned about.

Has anyone encountered these before, or have any idea where to go from here? I've heard rumblings around Roaming and Mandatory profiles being phased out for... something else, but I've never seen anything explicit on what to do instead - running without profiles just fills the local drives.

 

Many thanks!

Edited January 24, 2020 by TBFC

[BOOT]

Things I found:

Roaming profiles are "unsupported and may be removed in a future version of Windows".

 

Start Menu customisation is broken with roaming profiles; as with roaming profiles the data is stored in a "Cloud Store" and intended to be sync'd (via Microsoft Account\Enterprise State Roaming\etc).

 

The "Delete user profiles older than X days" policy is very much broken; as the profile receives updates on startup\sync\etc and never appears as old enough to delete.

 

Even with 1909 it all still seems to be a "work in progress".

[sydborn]

@BOOT3988, Please this line in your comment -'Start Menu customisation' is that the roaming profile ie

if on the user configuration on GPO under folder redirection \start menu. if you redirect students start menu is that a roaming profile you are referring to in your statement below?

 

Thanks

 

Things I found:

Roaming profiles are "unsupported and may be removed in a future version of Windows".

 

Start Menu customisation is broken with roaming profiles; as with roaming profiles the data is stored in a "Cloud Store" and intended to be sync'd (via Microsoft Account\Enterprise State Roaming\etc).

 

The "Delete user profiles older than X days" policy is very much broken; as the profile receives updates on startup\sync\etc and never appears as old enough to delete.

 

Even with 1909 it all still seems to be a "work in progress".

[BOOT]

@sydborn, By "Start Menu customisation" I'm referring to Start Menu tiles customisation via XML files.

[ComboSmith]

As far as I know roaming profiles aren't properly supported any more, I think you'll save yourself a lot of agro by using local profiles and redirected folders. We spent a week or so trying to get our roaming profiles to work in 1809 and gave up, set up folder redirection and it's been much more managable. We still get the occasional hiccup but it's usually easy to resolve with a reg key or by copying files. You said in your OP that creative cloud throws a wobbler with redirected folders, what does it do exactly? We have creative cloud and redirected folders and we've not had any complaints, we don't redirect the appdata folder

[TBFC]

You said in your OP that creative cloud throws a wobbler with redirected folders, what does it do exactly? We have creative cloud and redirected folders and we've not had any complaints, we don't redirect the appdata folder

From when we first rolled out Windows 10 with folder redirection, we ran into issues with various Creative Cloud apps launching. Different apps got to different stages, but it was at least a problem with Premiere Pro and InDesign. It wanted to use AppData, Documents and the C: profile, and any attempts we made at redirecting them caused the student to be unable to launch them, with them crashing during the "Loading" splash screen.

 

I'd be up for replacing everything with redirected folders and local profiles (after some investigation), but without having proper controls to remove them from the machine on log-off, we're just going to be running into the same issues again.

[ComboSmith]

All of our profiles are under 100mb since the downloads and desktops etc are redirected to their home drive, so it's not too much of a problem to keep them on there even on machines with a 120gb SSD. We run a startup script with Delprof2 that deletes any profiles not used for 30 days and it seems to do the trick for us, you could always do less.

 

I'm not sure what's happening with your creative cloud without more info, but we've been using redirected folders with windows 10 for about a year without any issues with creative cloud software so it can be done