Roaming Profiles

[Inox]

Hey guys,

 

From what i've read before, some ppl have a slightly misguided idea at what roaming profiles really are (or maybe I do, I just dont know ;-p )

 

From what I have gathere'd there r 2 main types of profile...Roaming and Mandantory.

 

A mandantory profile is where u setup a profile just the way u want it, copy it to a folder on ya server and chance the user.dat to user.man. Then point all users profiles to this folder for the profile. Changing to .man locks the profile so that users cannot make changes to it.

 

A roaming profile can be many things (but any of these things still makes it roaming)... You can have a true roaming profile where the whole profile roams, e.g. my docs, desktop, etc....or you can have a hybrid roaming profile like some of u were on about a bit further up where the my docs, desktop and start menu r redirected <---this is STILL a roaming profile of sorts as the app data folder and users settings i.e. the user.dat file r still transerfed from and to the server on each logon/logoff. This is also the way I have mine setup. This basically allows any user to move toolbars, make templates in word, etc, and generally change settings and preferences in software on the system (settings that r NOT locked by GP's that is :-p ) and these settings will roam with them.

 

I have a good tried and tested reason for doing this. I dont just think about me right now...I think about the future too and the future techies that r gonna have to deal with these kids.

I was working a high school a few years back (before I knew what a profile was)...and me n my boss setup a w2k network. We did not implemented profiles at this point. This worked ok (apart from being a little slow as u would expect) until one of the kids descovered that if he changed something, then next user to logon would also get that change. So one by one the kids would move menu bars off the side of the screen so we couldnt get them back. This got anoying, so we decided to play them at there own game. They were making others miserable by moving this stuff around so they could no tdo there work etc...so we did the same back to them. We implemented profiles in the manor stated above. This allows them to make a change and it to roam with them. Once the troublesome kids logged on and moved all the toolbars off the screen and then logged off, we had them ! :-) For the next 2 months these kids were forever being told off by teachers and not being able to complete their work properly because the options were not available to them (as they were off screen). They eventually came groveling to us to help them. At which point we made them write us a apology for giving us a hard time before and making our lives difficult. We then simply deleted their profiles and away they went again.

Although having a mandantory profile would have stopped this altogether, is would not have taught them the valuable lesson they learnt from this.

Let me just say that they didn't bother trying to mess with the system again after that as we introduced a fee for having there profiles reset.

I am hoping that by doing this I have samved at least some of the future IT techies from at least a little bit of trouble.

[tarquel]

This is exactly what I was getting at with having roaming profiles :)

 

...so that if a user messes up his/her settings, its only their profile that they will effect.

 

(Laptop's included )

 

Cheers

Nath

[Ric_]

If you don't redirect the app data or making it roaming, it will only effect that user when they log onto that machine (since it will take the settings from the local profile).

 

If you delete the locally stored profiles at logoff, the problem shouldn't happen.

[MkII]

I have that set Ric_ [to delete locally stored profiles] - but it doesn't happen - the profiles are all there. How exactly do you do it??

 

Cheers

[Ric_]

I have that set Ric_ [to delete locally stored profiles] - but it doesn't happen - the profiles are all there. How exactly do you do it??

 

Cheers

 

They don't always delete straight away - sometimes files get locked!

 

The best way is to have a startup script containing delprof so that you blitz the profiles when the workstation starts up. Use this in conjunction with the GPO and you should find that most of the local profiles are irradicated.

[MkII]

Cool! Thanks Ric_!

[SpuffMonkey]

hats pretty much how I have it Smile As I've said before (I think) I have a hidden sub-folder called 'profile' in each users directory which holds all the profile data - I guess others have them seperate in a different location but I find its handy when it comes to permissions i.e. they are already set for the profile, tho I try tweaking it a bit Smile etc...

 

But why? They DON'T NEED a profile! There is absoloutly nothng that should be stored for them!

 

I use redirected folders - but is there an easyway to do IE Favourites? I've seen a way of bodging to a home drive letter - but I don't use them - any other ideas?

[tarquel]

You could allow them to create their own favourites in their own profiles and have GP add a default list (but not remove existing ones - or their saved ones will disappear I'd think ) or just have a useful links section on a internal webserver / school website

 

Regards,

N.

[SpuffMonkey]

You could allow them to create their own favourites in their own profiles and have GP add a default list (but not remove existing ones - or their saved ones will disappear I'd think ) or just have a useful links section on a internal webserver / school website

 

Regards,

N.

 

Sorry - meant to imply that I don't allow any profiles.

[tarquel]

Presumably you mean you dont allow any "roaming" profiles?

 

I cant think of a way to do it off-hand except have a list on a internal website as I mention.

 

Cheers

N.

[Ric_]

You can generate the favourites list using a GPO - without roaming profiles though the users cannot add their own favourites but that's just tough

[ajbritton]

I have that set Ric_ [to delete locally stored profiles] - but it doesn't happen - the profiles are all there. How exactly do you do it??

 

Cheers

 

Mark, you could also try the 'User Profile Hive Cleanup' utility (google for UPHCLEAN and download the MSI from MS). This is a service which hangs around waiting for users to log off, then makes sure the user registry hive is unloaded. This helped me with the problem of profiles not being deleted. I'm certainly going to look at the DELPROF option as well.

 

AJB

[russdev]

welcome ajb

 

that might be useful tool anothier one added to collection

 

russ

[tarquel]

Yep, I've installed it in the past.

 

Oddly, i havent needed to on all machines. Think it was just on the 2k3 servers as i recall - but it was last year i think so my mind is a little fuzzy here

 

Cheers,

N.

[MkII]

Mark, you could also try the 'User Profile Hive Cleanup' utility (google for UPHCLEAN and download the MSI from MS). This is a service which hangs around waiting for users to log off, then makes sure the user registry hive is unloaded. This helped me with the problem of profiles not being deleted. I'm certainly going to look at the DELPROF option as well.

 

AJB

 

Thanks ajb! ...and welcome .

 

Answering an earlier post, 'my documents' folder is scripted at logon, and not set via standard GP.

 

Checking through my profile directory today I have one user with a profile of 114MB, and about 300 users with profiles larger than 10MB. The large profile has 10 word temp files.

 

I have it set to ignore most directories below the profile folder to save on space, but obviously there's still a lot of crap.

 

 

So what do people recommend is the best way to have this set up? I already have a re-directed start menu depending on the PC you log into, and as I say, a scripted home folder.

 

I know one person has made a profile folder, copied a default profile into it, made that mandatory and then pointed all users profiles to it.

[Ric_]

I don't use roaming profiles (as you can probably guess) and the temporary files end up in the My Documents.

 

I use the bad_files.vbs script (see scripts section) to delete temporary files at logon. Works rather well.

[mrtechsystems]

Do easy to setup up aswell

[Ric_]

Do easy to setup up aswell

 

huh? :?

[MkII]

A question from Nathan/Tarquel [who woke up this morning to a busted ADSL router - can we have a short silence please ]

 

"Is it ok to delete the local administrator profile on client PC's?"

 

Now a question from me:

 

I had a go at trying to create a defaulf profile myself, logging in as a test user, setting everything up as desired, then logging off, then in again as administrator to delete the old Default User profile, and copy the test users profile in it's place.

 

I deleted another users server profile, and no other profiles were set up on my target PC. I logged into the new PC with this new test user and all of the settings were lost!

 

Also: I registered Macromedia Studio as my test user ...that info was lost too. I registered it with the Admin user, and that info it kept!!!

 

Help anybody?

[ChrisH]

Did you copy the admin profile over the default?

[MkII]

Did you copy the admin profile over the default?

 

No I didn't.

[Ric_]

To be honest, I usually set it up the admin profile and restart the machine. I then copy the admin profile over the default user profile (no deleting) from a remote machine because it saves logging on again - I'm a little lazy like that.

 

Once you get that to work (it's not hard) you can supposedly copy a default user profile into your NETLOGON share and it takes it from there instead of the local machine - I've never got this to work though.

[RobC]

Works fine for me Ric.

[MkII]

So if you don't set a roaming profile [ you leave the profile location in your user detalis blank ] - I assume that you're saying no profile information is copied from anywhere at logon. The information stored in the local default profile on that machine used instead.

 

Is this correct?

 

[Yes Nathan mentioned that method of copying over the netlogon share, finding the sid of the default user somehow, that I don't recall now]

[Ric_]

No profile info in the users' details means that local profiles will be used.

 

A local profile is created at logon to save any temporary data but is based upon the info in the default profile.