Cant create Mandatory profiles

[spike]

I've had enough of our roaming profiles so want to setup mandatory profiles for our students.

However I seem to have trouble doing this. I have to confess I relatively new to active directory but I think I’ve covered every base.

 

Firstly I create a new user logged in and setup up everything the way I wanted. I then copied the profile I created to the server.

I set the ntuser.dat to .man set in the profile path its location with the ntuser.man at the end.

 

The problem is when ever I log on using various different test log ons it always creates an account on that pc for the user. Where as my understanding is the mandatory profile should not store settings. I've also tried a complete fresh account with to profile or log in scripts in a new OU and I've block inheritance.

 

I could be just over looking things but I've been playing with it so long that perhaps I'm missing the obvious.

Please help.

[ChrisH]

It will cache a copy locally still. For more info check out the guide on the wiki written by one of our members.

 

http://www.russdev.com/edugeek/doku.php?id=profiles

[Geoff]

It will cache a copy locally still.

 

You can disable that in Group Policies.

 

Computer Configuration -> Admin Templates -> System -> User Profiles -> Delete cached copies of roaming profiles.

 

Remeber to disable slow link detection too, otherwise bad things happen.

[SpuffMonkey]

It will cache a copy locally still.

 

Remeber to disable slow link detection too, otherwise bad things happen.

 

Do you do that by setting "Do Not Detect Slow Network Link" to Enabled?

 

I think we've seen the "bad things" from this - I moved the user areas to a different server and random machines were still looking for the old location - presumably from the local cached profiles - so we'll see how it goes post-Easter.

[Gatt]

IIRC you need to set the "Dont Cache Roaming Profiles" on the Client's Local Group Policy

[ajbritton]

I then copied the profile I created to the server.

I set the ntuser.dat to .man set in the profile path its location with the ntuser.man at the end.

 

How did you copy the profile? If you just dragged the files using Explorer, then the permissions in the user registry will be wrong. You need to use the copy profile function from My computer, Properties, Advanced, User Profiles Settings, (select the profile), Copy To.

[MkII]

Greetings Profile master

 

So are the registry settings in that profile then ajb? Once created you could then just copy the folder to other machines?

 

 

Added a couple of questions to the wiki too:

 

What sort of user should MPM be? - I would assume a standard student user, but MPM needs to have local admin rights to make settings to enable some programs run. [i copy a local profile with admin rights across to default to achieve this - is that a problem?]

 

Does the local profile take precedence over any central profile? - If I set a local proxy for example, it overrides server Group Policy settings.

[ajbritton]

Registry permissions are somehow embedded withing the NTUSER.MAN file. They are NOT the permissions ON the NTUSER.MAN file. The permissions can be set correctly automatically by using the Copy To function in the Windows User Profiles GUI, which sets file permissions AND registry permissions.

 

It is possible to edit the registry permissions with REGEDIT on XP, BUT, it's not as simple as giving Full Access to EVERYONE. If you examine the permissions on a pukka user profile carefully, you will find that the owner of the profile does not necessarily have full access to all areas of it. The Policies section is one example where the System can write to but the user cannot.

 

My advice: Always use the Copy To function. When copying a profile for use as a mandatory profile for multiple users, I typically assign permissions to Everyone.

 

PS - I will look at the Wiki questions when I get chance. Got to go shopping now aargggghh.....

[ajbritton]

@mark: I have added my two cents to the questions no the Wiki.

[MkII]

Excellent! Thanks ajb.

[spike]

Cheers for the responses.

The copying of the profile from My computer, Properties, Advanced, User Profiles Settings with setting the permissions sorted it.

Thanks