Mandatory Profiles Question

[craigg]

Im confused here,

 

My GPO's and redirections don't seem to be getting applied to the man profile?

 

I am following the tutorial in the wiki...

 

Do I have to apply all GPO's and redirections before i change ntuser.dat to ntuser.man?

 

If so how do I set about adding new policys etc?

 

 

Hope someone can help.

 

Thanks.

[kmount]

Folder redirections/etc should function as normal.

 

Use gpresult to see what policies are being applied when logged on to see if they are being blocked for some reason.

[DMcCoy]

Use the profiles option in system properties to copy the profile. Change permitted to use to everyone. Once it's exported like this then you can set the permissions on the share/folder appropriately. This will set the registry permissions inside the ntuser.dat.

 

If you just copy the profile or do not set this so that the relevant users can write to the registry then things like GPO will fail as they cannot be written once the profile is copied to the machine at logon.

[craigg]

Just gonna give your suggestions a go!

 

Thanks for the fast replys.

[craigg]

Use the profiles option in system properties to copy the profile. Change permitted to use to everyone. Once it's exported like this then you can set the permissions on the share/folder appropriately. This will set the registry permissions inside the ntuser.dat.

 

If you just copy the profile or do not set this so that the relevant users can write to the registry then things like GPO will fail as they cannot be written once the profile is copied to the machine at logon.

 

You said in this reply change the permitted use to everyone. I presume this is before I export it to the server?

 

Would I do this from the folder permissions in docs and settings? There doesnt seem to be an option in the User Profiles option.

 

Cheers

[timzim]

Use gpresult to see what policies are being applied when logged on to see if they are being blocked for some reason.

 

In Group Policy Management Console check the link order to see if your policies are being applied in the correct order (click on the domain name to see link order) - those at the top of the list are applied last & overwrite those below if they're different.

 

The event log on the PC may also give you more info on why redirection is failing.

 

Your users shouldn't need write access to the shared profile since the system will automatically give them write access to the relevant parts of the copy it writes to the PC. You don't want users writing back to the server copy. GPOs should be applied to the profile as it's copied to the PC. Works ok for us.

 

P.S. redirection doesn't work if you have Windows 2000 though (see MS KB295349)

[DMcCoy]

You said in this reply change the permitted use to everyone. I presume this is before I export it to the server?

 

Would I do this from the folder permissions in docs and settings? There doesnt seem to be an option in the User Profiles option.

 

Cheers

 

You don't need to go anywhere near the documents and settings folder. Windows will do it for you. Copy User Profiles in Windows XP

 

If it's greyed out on the profile you want, you need to reboot and make sure you are not logged in the as the users who's profile you wish to copy.

[sted]

You said in this reply change the permitted use to everyone. I presume this is before I export it to the server?

 

Would I do this from the folder permissions in docs and settings? There doesnt seem to be an option in the User Profiles option.

 

Cheers

 

When you export the profile like in the enclosed pic (excuse the butchered usernames etc lol)

[craigg]

Excelent,

 

I'll make a fresh one now and report back.

 

Thanks

[craigg]

It looks like its sorted now!

 

 

I have a nice small 1.28mb profile,

 

Appdata, Mydocs, Desktop & Start Menu redirected via gpo

 

 

 

 

 

 

 

 

Thanks for your help.