Locking down desktops and mandatory profiles

[Dos_Box]

All together now...roaming profiles are evil, roaming profiles are evil, roaming profiles are evil.

Repeat ad nausiem

[ajbritton]

OK, I'm getting there...

 

When I have used roaming/mandatory profiles, I have enabled to policy which automatically deletes local copies of roaming profiles. This presumably would have no effect on 'local' profiles. Each PC therefore will accumulate a set of profiles unless they are deleted in some way. What's the best course here? Leave them or delete them? If delete, what's the best way to automate it?

[Geoff]

I use Remote Profile Cleaner.

 

http://www.no-nonsens.nl/

[MkII]

Thanks for that link Geoff. Blimey this is such a complicated subject! I have roaming profiles still. Are the policies left in place on each PC then local profiles - or am I confusing things here? I have the GPO setting on to delete cached copies of roaming profiles. I don't have instaled tho' the UPHClean utility, but still, it seems all users in some new machines i've added are filling up with everyone that's logged in's profiles.

[tarquel]

*big eye rolling*

 

Havent we already talked about this?

 

@the people (DB ) not using roaming profiles:

 

so what about when people open office for the first time? I take it that by opening it in the locally created default user (or network one) you achive this but imagine if you forget when creating a new image (or images)? the complaints soon would flood in.

 

Same goes with other apps that have to be run and go through a "mini-config" setup on first run (like office does).

 

Much easier to use roaming profiles I think (for those forgetful and time-limited ppl like myself hehe) - the users dont mind waiting a minute to log on - and they get to customise office a bit too [by way of name etc - pointless but hey, some of them might like it hehe]

 

If a users profile gets corrupted then no problem - wipe it and it'll get recreated on first logon

 

[better than that have to reimage a pc or recreate the network one - imagine the network default user profile not working properly. No one could logon properly lmao]

 

Another thought is that if u have a network one - manditory or whatever - then it would still need to transfer to a pc when a user logs on [just like a roaming profile ] unless it doesnt quite work the same.

 

Just a few pence there

 

Regards

N.

[GrumbleDook]

@tarquel

 

I think you need to really note the difference between roaming profiles and mandatory profiles.

 

Roaming profiles ... bad!

 

Mandatory Profiles ... very good.

 

You start up each application on one test user with a roaming profile ... you make sure everything works fine. You configure all those little bits you want (running M$ Clip art organiser, changing a few other Office options ... first run of Mozilla, setting up partidular websites to have trusted IE status so you don;t get flippin warning messages when trying to access PP presentations via a web browser).

 

You log of the test user allowing all the settings to be saved back to the server. You then change NTUser.dat to NTUser.man ... it is now a mandatory profile. You then point the profile of each user to it (or change the name of it to the profile all users need)

 

If you need to update the profile to take into account the stuff ... you make a copy, give it a name like profiletest ... you point a test user's profile at it ... you log on, make changes, etc ...

 

You copy it back in later on.

 

This can create a large mandatory profile which is why some people like to make sure the defualt user on each workstation has all the settings configured for OO.o etc ... we just use the mandatory profile.

[tarquel]

Thanks for the detail tony.

 

I did/do understand the idea behind it - i just meant that either way they still are going to be transfered to the local machine when a user logs on, although I assume that a manditory one uses the local default user and makes changes to the local one when logging on [thus the manditory bit lol] in combination with them not being able to change it right? [sorry very tired tonight lol

 

I meant that if the manditory profile got corrupted and you had all the pupils pointing to it, then all the pupils wouldnt be able to log on until you fix the profile, whereas with roaming ones and (in my case) having seperate individual ones for each user, if their profile gets corrupt then it wont effect everyone else. Thats all i meant.

 

I guess its slightly longer than using manditory ones but still - its all personal preference at the end of the day.

 

Mattpant was telling me that his manditory profile has ended up changing to 100MB lol

 

Hang on - if it is manditory and not change, how does/can it get bigger?

 

I'll stick to individual roaming profiles for now i think lmao

 

Regards

Nath.

[Ric_]

@tarq: Indeed the network copy of the Default User profile does have to be copied across the network (if it's not cached on the local machine ) but it will only be going one way since nobody can save to it (and hence it cannot be broken).

 

It also means that you get a consistant look to Windows and the apps - easier to teach with

[MkII]

It seems lots of people have thier own idea about roaming profiles, and I'm not sure if you're all singing from the same songsheet! And this seems too big a topic and so messy[/all over the place] on the forum to leave alone. Seems we're gonna be talking about it 'till the cows come home.

 

How about this. Sticky a thread and put the method you use to do it in the first post. Include the pro's and con's, and let people criticise it in the thread. Keep updating the first post as needs be, deleting the queries as they become irrelevant [to keep it tight]. One thread for each method, then we'll at last have definitive information on each methodology, warts and all.

 

What do you think?

[RobC]

Sounds like a good idea to me.

[Andrew]

I'm glad I started this thread, lots of good inputs. It seems this is a complicated subject though with plenty of devotees for each approach. I'm not convinced there is one solution that fits all.

 

I think I'm going to stick with using GPOs and mandatory profiles to lock everything. Thanks all.

 

Andy

[ninjabeaver]

It seems lots of people have thier own idea about roaming profiles, and I'm not sure if you're all singing from the same songsheet! And this seems too big a topic and so messy[/all over the place] on the forum to leave alone. Seems we're gonna be talking about it 'till the cows come home.

 

How about this. Sticky a thread and put the method you use to do it in the first post. Include the pro's and con's, and let people criticise it in the thread. Keep updating the first post as needs be, deleting the queries as they become irrelevant [to keep it tight]. One thread for each method, then we'll at last have definitive information on each methodology, warts and all.

 

What do you think?

 

Would that work better as a wiki?

 

I just cracked up when I read your sig Mark.

[Geoff]

Would that work better as a wiki?

 

Let the edit/revert war commence!

[tarquel]

lmao

 

N.

[MkII]

No takers then...

 

On linuxquestions.org they have a space named linuxanswers [as well as a wiki]. Poeple then submit articles on subjects.

 

I thought this would be a great addition to edugeek - edugeek.answers

 

But maybe this task is just too large. Damn shame coz I think it'd be ver useful. Perhaps a subject for a future conference - then if the speaker was willing to publish something, we'd have a startin point.

[tarquel]

I think theres too many roaming profile type threads here lol

 

It's be nice to combine them and start a new, dedicated thread with a wiki for the answers.

 

My 2p anyhow

 

Nath.

[Dos_Box]

I'll put it on the home page on a big Flash banner 'Roaming profiles are BAD. Get over it!'

 

Think it'll work?

[MkII]

Edugeek answers page or sticky thread on each method.

[alan-d]

I'll put it on the home page on a big Flash banner 'Roaming profiles are BAD. Get over it!'

 

Think it'll work?

 

Nope

[ajbritton]

Roaming profiles RULE! and anyone who says otherwise is girly wuss ;-)

[E1uSiV3]

im a redirected folders kinda man here

[Pear]

I've got a problem. I'm using roaming profiles and its fine for when the users log in but the kiddies here are always looking for ways around the system.

 

So what they do is log in, but whilst windows displays "applying network settings" they pull out the network cable. This leads to the profile not being loaded up and them being given the default profile with full access rights to control panel etc.

 

Does anyone know how to stop that happening ?

[Ric_]

@Pear: There is a GPO setting that prevents logon if the settings are not applied properly - a nightmare usually but probably what you want.

 

Just check the MS Policy Settings spreadsheet.

 

... although if you don't use roaming profiles you wouldn't have this problem - place the Default User profile on the machines.

[Pear]

Thanks.

 

I have already tried the GPO, it works straight after logon but as soon as the logon message changes to applying settings its useless.

 

I see the logic in having the default profile on all the PCs, I found the system like this but I am sure I will consider the alternative.

[Geoff]

put the following in a batch file and put it in the default users Startup program group.

 

shutdown -r -t 0 -f

 

Watch out for rebooting computers.