What is the best user profile method

[Tom_P]

Hi all,

 

So, user profiles.. This is something i have never really understood and need some help in understanding and what is best going forward.

 

We currently have a mix of redirected mandatory profiles and roaming profiles setup. I have been tasked with updating this setup to the current 'standard' as 'mandatory and roaming is outdated and slow'.

 

Teaching staff at this school generally use the same three PC's every school year, with the exception of the cover teachers who are all over the school. Admin staff use just one PC and SLT have their office PC plus a classroom PC if they also teach. Then pupils use multiple PC's and laptops.

 

I have heard that using local profiles with redirected desktop is the way to go? If so, does this mean when the user logs on it creates a local profile but grabs the desktop from a centralised location?

 

I have also looked into ue-v but this doesnt seem like the end goal is worth the setup. And ESR isn't something we can as i believe a P1 azure licence is required? Also, correct me if im wrong but i can't see how this method would be quicker than a roaming profile if it is downloading the profile from the cloud?

 

Any help in this area is greatly appreciated.

 

Thanks,

Tom.

[Davit2005]

Redirection for documents, app data etc. is the way to go.

 

We had a redirection for the actual Desktop at a previous place for students. We could chuck any shortcuts on there but they could not save anything on the Desktop as they had read only access. The redirected Desktop was in shared folder

 

Steering well clear of roaming would be my advice too.

 

My only caution with redirecting app data is that you might want to exclude certain folders, we had users with iTunes that backed up their phones and this got backed up to the home area too.

 

I'd suggest you could setup with some test users.

Edited July 25, 2022 by Davit2005

[Alex0x7F]

We've recently switched from roaming profiles to local profiles with folder redirection policy. Main thing to note, staff were forced to stop using network shared drives to dump 100's of gb's of crud and rely on Teams Desktop/OneDrive for sharing between colleagues. There will also be a reliance on OneDrive now that our trust have issued a ban on removable storage... I'm sure everyone will adhere to that!

 

Working as you've described it, local profile grabs the desktop from a StaffProfiles share on the server.

 

It has saved many headaches of old users logging in here, there and everywhere with mashooive roaming profiles eating away at our 256gb ssd's!

[midweek]

Local profiles with OneDrive sync and files on demand. Works surprisingly well.

Only real issue is chrome doesn't remember favourites from one pc to the next (we are an M365 school, no Google accounts). Edge does though so staff can use that.

[EssentialRug]

Local profiles with OneDrive sync and files on demand. Works surprisingly well.

Only real issue is chrome doesn't remember favourites from one pc to the next (we are an M365 school, no Google accounts). Edge does though so staff can use that.

 

This is how we do it...works fantastically. We also have a Google Workspace tenancy so that staff can log into Chrome to back up their favourites and we can push things out to them. We pushed a policy in Endpoint Manager to force Chrome sign in so they have to sign in using the account we have provided.

[midweek]

If you do go down the local profile with Onedrive route, I found this blog post invaluable to keep login times to a minimum - https://katystech.blog/windows/windows-10-and-super-fast-logon-times

[Tom_P]

Thanks guys, really helpfull stuff

 

Couple of additional questions regarding local profiles..

 

Do you set local profiles for all users, incl students?

Do you set a limit on when the local profile is deleted from the device?

Do you get the 'user profile failed the logon' error or is this just with roaming profiles?

Any do's or don'ts when setting up?

[EssentialRug]

Thanks guys, really helpfull stuff

 

Couple of additional questions regarding local profiles..

 

Do you set local profiles for all users, incl students?

Do you set a limit on when the local profile is deleted from the device?

Do you get the 'user profile failed the logon' error or is this just with roaming profiles?

Any do's or don'ts when setting up?

 

I can answer one of those! We set profiles to delete if they haven't been used for 60 days.

 

ALSO if you are going down the route of using OneDrive/SharePoint with files on demand, we also set up Storage Sense to auto delete things in the recycle bin, and also to convert downloaded files back to online files if they haven't been used for x amount of days. Keeps our machines nice and clean.

[TechMonkey]

we also set up Storage Sense to auto delete things in the recycle bin, and also to convert downloaded files back to online files if they haven't been used for x amount of days.

This I had not heard of, thank you muchly. One of the things in the back of my head that I've not managed to research.

[Homer]

How many of you are using redirected AppData and how much trouble do you get from some applications with it?

[bknaggs]

How many of you are using redirected AppData and how much trouble do you get from some applications with it?

 

We were using it but somewhere along the line Adobe CC stopped working with redirected AppData so we had to bin it pretty much straight away. I don't remember problems with any other applications.

[Dan2025]

Appdata was enabled at previous place and caused a lot of issues with Activ inspire, painful to resolve as it didn't affect all users and once it affected a user the damage was done. Couldn't find a way to resolve without deleting the programs appdata on the PC/Server for that profile.

Inspire's config to redirect wouldn't work either.

Edited July 26, 2022 by Danwinchelsea

[danielghares]

If you need user profiles to ‘roam’, I’d suggest using fslogix rather than roaming profiles or appdata redirection. We use it for 2000+ users and it’s been faultless. All profiles are stored as virtual hard disk files and get mounted during the login process. So much faster than roaming profiles

[Homer]

If you need user profiles to ‘roam’, I’d suggest using fslogix rather than roaming profiles or appdata redirection. We use it for 2000+ users and it’s been faultless. All profiles are stored as virtual hard disk files and get mounted during the login process. So much faster than roaming profiles

 

OK This looks super interesting, going to have to check this one out!

 

Should speed up logon times everywhere even for students

 

Cheers!

[midweek]

I used fslogix here for a couple of years for our staff logins. While it was mostly great we still got the occasional corrupt profile. You also need to have plenty of network storage for your profiles as they get much bigger than roaming ones.

 

I ditched it recently when we moved to OneDrive Sync as it didn't play nice (in my environment anyway). I probably could have sorted it out but it was just easier to stick everyone on local profiles.

[altecsole]

Redirection for documents, app data etc. is the way to go.

 

 

My only caution with redirecting app data is that you might want to exclude certain folders, we had users with iTunes that backed up their phones and this got backed up to the home area too.

.

Many thanks for this. How do you exclude folders from AppData redirection?

[Davit2005]

Many thanks for this. How do you exclude folders from AppData redirection?

 

Unfortunately this was in a previous employment a few years back. I no longer work in that area.

[TechMonkey]

Many thanks for this. How do you exclude folders from AppData redirection?

 

If I remember correctly there is a GPO.

 

Ah, here it is - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.UserProfiles::ExcludeDirectories

[altecsole]

If I remember correctly there is a GPO.

 

Ah, here it is - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.UserProfiles::ExcludeDirectories

 

Thanks. I thought the folder exclusions were for use with Roaming Profiles, not redirected AppData, but I'll do some testing.

[Tefters]

Been using folder redirection here for about 13 years now, converted it from roaming profiles when I first took over (what a headache that was!).

 

I do Appdata, desktop, documents, photos and music.

 

Worked fine for us over the years, 1 or 2 niggles here and there like Adobe appdata being crap at times for the odd user but simple to fix by nuking the Adobe appdata from their network redirection profile and voila!

Some apps just can't handle network appdata folders, 1 or 2 particular Adobe apps come to mind but can't remember name and we just tell the users "sorry, can't make it work in our environment". Not our fault app developers can't code properly.

 

Overall, I would never go back to roaming and am possibly looking at OneDrive redirection moving forward if I can ever get away from 1:1 iPads which we are rolling out [emoji19]

[2097]

Also just converting

 

We are going onsite to Cloud.

 

Currently Roaming and Mandatory profiles.

 

 

I have created some custom scripts to negate the onedrive update problem ( seems for every user it creates a scheduled take to update ) and i had various updates going on randomly during login which made onedrive loading slower.

 

Mandatory i have running great , works well with Onedrive sync tool , Delprof2 deletes all stuck Mandatory profiles on student machines . Login is quick also. So keeping them !

 

Roaming didnt work so well , so now going to Local with redirected Appdata for staff . Its all working well during testing . Using delprof2 to delete profiles after 60 days inactivity.

 

 

What is every one doing about the limitation on multiple logins with redirected appdata ? i.e. if edge is open up one both logged in machines ?

[Cat_Jam148]

Personally, I wouldn't redirect appdata. It can increase logon times as the profile grows, and tends to get corrupted every-now and then.

 

It was once setup here a decade ago, and we had nothing but trouble with it. I can't imagine what it would be like with Teams, which stores most of it's files in appdata.

 

We don't use any form of redirection anymore apart from the desktop, which is redirected to a local folder on the machine which is copied from a template on the server on each shutdown.

 

Local profiles is the way to go IMO

Edited October 6, 2023 by Cat_Jam148

[ITGuyNW]

We have roaming profiles but I want to go to local when I roll out Windows 11. Just testing it out now actually.

 

I want to redirect the desktop, start menu and set home paths and thats it.