Change user permissions by modding ntuser.dat?

[Number6]

I have an issue to resolve in the quickest and easiest way possible. Here's the problem.

 

A group of XP workstations were deployed using an image that, to be blunt was based on the wrong default user profile. I didn't set up the image, nor did I deploy the PCs so I'm not exactly sure what happened. The problem is that the defualt profile in the image was based on a "student" profile that had very limited permissions. The image was then deployed to "teacher" PCs an now the teachers are moaning that they can't do basic stuff like install software, install printers, modify wallpapers, etc.

 

I need to reset these machines in a hurry and need to know the best way of doing so.

 

I could obviously re-image all the machines with a newly created image but I would prefer not to have to go round 40'odd PC's, remove the HD, copy the image and put the HD back.

 

Can I modify the default user ntuser.dat file so that I can then just delete the user profiles and copy or export the new ntuser file to the default profile on each machine? If so how would I do this and what keys would I have to add or modify?

 

Any other suggestions?

[srochford]

Are you running a domain? If so, you need to find out what policies will allow whatever it is you want to happen and then configure them - the existing users will then get updated.

 

if you have a domain but you're not sure about group policies then get the new profile right, put it in netlogon in a folder called "default user" and wipe the existing user profiles - at next logon, they will take the default from the server.

 

If you're not running a domain, then you can just get a user profile "right", put it in place on each machine in the "default user" folder and delete existing profiles (but beware of losing data!!)

 

If data loss is an issue (and it probably is if you don't have a domain - where are user files?) then you could just overwrite ntuser.dat in any user profile folder.

[Michael]

In the circumstances I would give staff pre-customised roaming profiles. The default user profile on the workstations only comes into play if a user doesn't have a profile.

 

If you need additional help how to do this, let me know.

[Number6]

Are you running a domain? If so, you need to find out what policies will allow whatever it is you want to happen and then configure them - the existing users will then get updated.

 

 

Hi, thanks for the reply.

 

Yes, running a domain.

 

All the user policies are in place and correct, the problem is purely that, so far as I understand it, when the original image was built a default profile was copied to the image. The wrong profile was copied and that default gave "student" privileges, not higher level "teacher" privileges. Hence, every user that logged on inherited "student" privileges.

 

I can't and don't want to play with the policies themselves, I just want to reset the PCs so that when they next logon they will inherit a more open policy. One way I thought of doing this is to edit the ntuser file, or simply to copy an ntuser file from a higher order machine and copy it to the affected PCs. Then delete the user profiles and at next logon the new, or modified ntuser file will be copied to the new user profile.

 

What I want to know is, am I being too simplistic?

 

Will this plan work? Should I edit the existing ntuser or copy a new one over? Or are there pitfalls that I haven't considered?

[Number6]

In the circumstances I would give staff pre-customised roaming profiles. The default user profile on the workstations only comes into play if a user doesn't have a profile.

 

If you need additional help how to do this, let me know.

 

Roaming profiles are not permitted on our network.

 

Thanks anyway and it would be a plan otherwise.